# OpenShift runs pods under restricted-v2 by default, which forbids UID 0.
# VShell needs root, so grant a narrow, dedicated SCC instead of anyuid.
#
# Quick alternative (broader, uses the stock anyuid SCC):
#   oc adm policy add-scc-to-user anyuid -z vshell -n vshell
#
# This SCC is the least-privilege version: no privileged containers, no host
# namespaces, no hostPath, no extra capabilities, but RunAsAny so the image's
# root user is allowed.
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: vshell-root
  labels:
    app.kubernetes.io/name: vshell
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegedContainer: false
allowPrivilegeEscalation: true
allowedCapabilities: []
defaultAddCapabilities: []
requiredDropCapabilities: []
readOnlyRootFilesystem: false
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
fsGroup:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
seccompProfiles:
  - runtime/default
volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
---
# Namespaced RBAC so only the vshell service account may use that SCC.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: vshell-scc-use
  namespace: vshell
rules:
  - apiGroups:
      - security.openshift.io
    resources:
      - securitycontextconstraints
    resourceNames:
      - vshell-root
    verbs:
      - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: vshell-scc-use
  namespace: vshell
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: vshell-scc-use
subjects:
  - kind: ServiceAccount
    name: vshell
    namespace: vshell