Name update

deploy/openshift/10-scc.yaml

@@ -0,0 +1,80 @@
+---
+# Custom SCC for PXEForge.
+#
+# The default `restricted-v2` SCC blocks host network and all capabilities,
+# which PXE cannot tolerate: DHCPDISCOVER is an L2 broadcast that CNI overlays
+# do not deliver into pod netns. We grant the minimum set needed:
+#
+#   - allowHostNetwork: true     — required to receive broadcast DHCP
+#   - allowHostPorts:   true     — exposes 67/69/4011/80 on the node
+#   - requiredDropCapabilities    strips the usual dangerous caps
+#   - allowedCapabilities:
+#       NET_BIND_SERVICE         — bind <1024 as non-root
+#   - runAsUser.type: MustRunAsRange — force non-root uid mapped via setcap
+#   - readOnlyRootFilesystem: true  — binary is in / (set by image), data
+#                                     dirs are mounted elsewhere
+#
+# We do NOT grant NET_RAW / NET_ADMIN / SYS_ADMIN. Proxy-mode DHCP does not
+# need raw sockets (see architecture memory).
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: pxeforge-scc
+  annotations:
+    kubernetes.io/description: >-
+      Minimal SCC for PXEForge: host network + NET_BIND_SERVICE only, no raw
+      sockets, no privileged mode.
+allowPrivilegedContainer: false
+allowPrivilegeEscalation: false
+allowHostNetwork: true
+allowHostPorts: true
+allowHostPID: false
+allowHostIPC: false
+allowedCapabilities:
+  - NET_BIND_SERVICE
+requiredDropCapabilities:
+  - ALL
+defaultAddCapabilities: []
+readOnlyRootFilesystem: true
+runAsUser:
+  type: MustRunAsRange
+seLinuxContext:
+  type: MustRunAs
+fsGroup:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+volumes:
+  - configMap
+  - downwardAPI
+  - emptyDir
+  - persistentVolumeClaim
+  - projected
+  - secret
+users: []
+groups: []
+---
+# Bind the SCC to the pxeforge service account.
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: pxeforge-scc-use
+rules:
+  - apiGroups: ["security.openshift.io"]
+    resources: ["securitycontextconstraints"]
+    resourceNames: ["pxeforge-scc"]
+    verbs: ["use"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: pxeforge-scc-use
+  namespace: pxeforge
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pxeforge-scc-use
+subjects:
+  - kind: ServiceAccount
+    name: pxeforge
+    namespace: pxeforge