81 lines
2.2 KiB
YAML
81 lines
2.2 KiB
YAML
---
|
|
# Custom SCC for PXEForge.
|
|
#
|
|
# The default `restricted-v2` SCC blocks host network and all capabilities,
|
|
# which PXE cannot tolerate: DHCPDISCOVER is an L2 broadcast that CNI overlays
|
|
# do not deliver into pod netns. We grant the minimum set needed:
|
|
#
|
|
# - allowHostNetwork: true — required to receive broadcast DHCP
|
|
# - allowHostPorts: true — exposes 67/69/4011/80 on the node
|
|
# - requiredDropCapabilities strips the usual dangerous caps
|
|
# - allowedCapabilities:
|
|
# NET_BIND_SERVICE — bind <1024 as non-root
|
|
# - runAsUser.type: MustRunAsRange — force non-root uid mapped via setcap
|
|
# - readOnlyRootFilesystem: true — binary is in / (set by image), data
|
|
# dirs are mounted elsewhere
|
|
#
|
|
# We do NOT grant NET_RAW / NET_ADMIN / SYS_ADMIN. Proxy-mode DHCP does not
|
|
# need raw sockets (see architecture memory).
|
|
apiVersion: security.openshift.io/v1
|
|
kind: SecurityContextConstraints
|
|
metadata:
|
|
name: pxeforge-scc
|
|
annotations:
|
|
kubernetes.io/description: >-
|
|
Minimal SCC for PXEForge: host network + NET_BIND_SERVICE only, no raw
|
|
sockets, no privileged mode.
|
|
allowPrivilegedContainer: false
|
|
allowPrivilegeEscalation: false
|
|
allowHostNetwork: true
|
|
allowHostPorts: true
|
|
allowHostPID: false
|
|
allowHostIPC: false
|
|
allowedCapabilities:
|
|
- NET_BIND_SERVICE
|
|
requiredDropCapabilities:
|
|
- ALL
|
|
defaultAddCapabilities: []
|
|
readOnlyRootFilesystem: true
|
|
runAsUser:
|
|
type: MustRunAsRange
|
|
seLinuxContext:
|
|
type: MustRunAs
|
|
fsGroup:
|
|
type: MustRunAs
|
|
supplementalGroups:
|
|
type: RunAsAny
|
|
volumes:
|
|
- configMap
|
|
- downwardAPI
|
|
- emptyDir
|
|
- persistentVolumeClaim
|
|
- projected
|
|
- secret
|
|
users: []
|
|
groups: []
|
|
---
|
|
# Bind the SCC to the pxeforge service account.
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: pxeforge-scc-use
|
|
rules:
|
|
- apiGroups: ["security.openshift.io"]
|
|
resources: ["securitycontextconstraints"]
|
|
resourceNames: ["pxeforge-scc"]
|
|
verbs: ["use"]
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: pxeforge-scc-use
|
|
namespace: pxeforge
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: pxeforge-scc-use
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: pxeforge
|
|
namespace: pxeforge
|