mward4
9dbe3749ba
- build chain: project, Gitea basic-auth source secret, output ImageStream, BuildConfig (Docker strategy, ubuntu:24.04 base), optional base-image ImageStream and Docker Hub pull secret - runtime: ServiceAccount + least-privilege SCC and its RoleBinding (VShell needs UID 0), PVC for config/certificate, Deployment with ImageStream trigger, ClusterIP Service, passthrough HTTPS Route - all manifests verified with 'oc create --dry-run=client' against the OpenShift 4.22 client scheme (12/12 decode cleanly)
74 lines
1.7 KiB
YAML
74 lines
1.7 KiB
YAML
# OpenShift runs pods under restricted-v2 by default, which forbids UID 0.
|
|
# VShell needs root, so grant a narrow, dedicated SCC instead of anyuid.
|
|
#
|
|
# Quick alternative (broader, uses the stock anyuid SCC):
|
|
# oc adm policy add-scc-to-user anyuid -z vshell -n vshell
|
|
#
|
|
# This SCC is the least-privilege version: no privileged containers, no host
|
|
# namespaces, no hostPath, no extra capabilities, but RunAsAny so the image's
|
|
# root user is allowed.
|
|
apiVersion: security.openshift.io/v1
|
|
kind: SecurityContextConstraints
|
|
metadata:
|
|
name: vshell-root
|
|
labels:
|
|
app.kubernetes.io/name: vshell
|
|
allowHostDirVolumePlugin: false
|
|
allowHostIPC: false
|
|
allowHostNetwork: false
|
|
allowHostPID: false
|
|
allowHostPorts: false
|
|
allowPrivilegedContainer: false
|
|
allowPrivilegeEscalation: true
|
|
allowedCapabilities: []
|
|
defaultAddCapabilities: []
|
|
requiredDropCapabilities: []
|
|
readOnlyRootFilesystem: false
|
|
runAsUser:
|
|
type: RunAsAny
|
|
seLinuxContext:
|
|
type: MustRunAs
|
|
fsGroup:
|
|
type: RunAsAny
|
|
supplementalGroups:
|
|
type: RunAsAny
|
|
seccompProfiles:
|
|
- runtime/default
|
|
volumes:
|
|
- configMap
|
|
- downwardAPI
|
|
- emptyDir
|
|
- persistentVolumeClaim
|
|
- projected
|
|
- secret
|
|
---
|
|
# Namespaced RBAC so only the vshell service account may use that SCC.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: vshell-scc-use
|
|
namespace: vshell
|
|
rules:
|
|
- apiGroups:
|
|
- security.openshift.io
|
|
resources:
|
|
- securitycontextconstraints
|
|
resourceNames:
|
|
- vshell-root
|
|
verbs:
|
|
- use
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: vshell-scc-use
|
|
namespace: vshell
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: vshell-scc-use
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: vshell
|
|
namespace: vshell
|