Name update
This commit is contained in:
@@ -1,5 +1,5 @@
|
||||
---
|
||||
# Custom SCC for PXEForge.
|
||||
# Custom SCC for OpenPXE.
|
||||
#
|
||||
# The default `restricted-v2` SCC blocks host network and all capabilities,
|
||||
# which PXE cannot tolerate: DHCPDISCOVER is an L2 broadcast that CNI overlays
|
||||
@@ -19,10 +19,10 @@
|
||||
apiVersion: security.openshift.io/v1
|
||||
kind: SecurityContextConstraints
|
||||
metadata:
|
||||
name: pxeforge-scc
|
||||
name: openpxe-scc
|
||||
annotations:
|
||||
kubernetes.io/description: >-
|
||||
Minimal SCC for PXEForge: host network + NET_BIND_SERVICE only, no raw
|
||||
Minimal SCC for OpenPXE: host network + NET_BIND_SERVICE only, no raw
|
||||
sockets, no privileged mode.
|
||||
allowPrivilegedContainer: false
|
||||
allowPrivilegeEscalation: false
|
||||
@@ -54,27 +54,27 @@ volumes:
|
||||
users: []
|
||||
groups: []
|
||||
---
|
||||
# Bind the SCC to the pxeforge service account.
|
||||
# Bind the SCC to the openpxe service account.
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: pxeforge-scc-use
|
||||
name: openpxe-scc-use
|
||||
rules:
|
||||
- apiGroups: ["security.openshift.io"]
|
||||
resources: ["securitycontextconstraints"]
|
||||
resourceNames: ["pxeforge-scc"]
|
||||
resourceNames: ["openpxe-scc"]
|
||||
verbs: ["use"]
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: pxeforge-scc-use
|
||||
namespace: pxeforge
|
||||
name: openpxe-scc-use
|
||||
namespace: openpxe
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: pxeforge-scc-use
|
||||
name: openpxe-scc-use
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pxeforge
|
||||
namespace: pxeforge
|
||||
name: openpxe
|
||||
namespace: openpxe
|
||||
|
||||
Reference in New Issue
Block a user