---
# Custom SCC for OpenPXE.
#
# The default `restricted-v2` SCC blocks host network and all capabilities,
# which PXE cannot tolerate: DHCPDISCOVER is an L2 broadcast that CNI overlays
# do not deliver into pod netns. We grant the minimum set needed:
#
#   - allowHostNetwork: true     — required to receive broadcast DHCP
#   - allowHostPorts:   true     — exposes 67/69/4011/80 on the node
#   - requiredDropCapabilities    strips the usual dangerous caps
#   - allowedCapabilities:
#       NET_BIND_SERVICE         — bind <1024 as non-root
#   - runAsUser.type: MustRunAsRange — force non-root uid mapped via setcap
#   - readOnlyRootFilesystem: true  — binary is in / (set by image), data
#                                     dirs are mounted elsewhere
#
# We do NOT grant NET_RAW / NET_ADMIN / SYS_ADMIN. Proxy-mode DHCP does not
# need raw sockets (see architecture memory).
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: openpxe-scc
  annotations:
    kubernetes.io/description: >-
      Minimal SCC for OpenPXE: host network + NET_BIND_SERVICE only, no raw
      sockets, no privileged mode.
allowPrivilegedContainer: false
allowPrivilegeEscalation: false
allowHostNetwork: true
allowHostPorts: true
allowHostPID: false
allowHostIPC: false
allowedCapabilities:
  - NET_BIND_SERVICE
requiredDropCapabilities:
  - ALL
defaultAddCapabilities: []
readOnlyRootFilesystem: true
runAsUser:
  type: MustRunAsRange
seLinuxContext:
  type: MustRunAs
fsGroup:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
users: []
groups: []
---
# Bind the SCC to the openpxe service account.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: openpxe-scc-use
rules:
  - apiGroups: ["security.openshift.io"]
    resources: ["securitycontextconstraints"]
    resourceNames: ["openpxe-scc"]
    verbs: ["use"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: openpxe-scc-use
  namespace: openpxe
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: openpxe-scc-use
subjects:
  - kind: ServiceAccount
    name: openpxe
    namespace: openpxe