The documentation is not sufficient to deploy Ceph-CSI Operator on OpenShift

[nixpanic]

Describe the bug

When deploying ceph-csi-operator on OpenShift, it fails to create Pods for the Ceph-CSI drivers.

Environment details

• Image/version of ceph-csi-operator : latest
• Image/version of Ceph-CSI driver : default picked by the operator
• Kubernetes cluster version : OpenShift 4.18 (but likely any version)
• Ceph cluster version : v19

Steps to reproduce

Steps to reproduce the behavior:

1. Setup details: follow the quickstart or kubernetes installation
2. Deployments are created, Pods can not be started

Actual results

Ceph-CSI driver Pods are not started.

Expected behavior

Ceph-CSI driver Pods are started.

Additional context

It seems the SecurityContextConstraints are missing. Something similar to these need to be added with the right Namespace for the ServiceAccounts:

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: ceph-csi-op-scc
allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
allowedCapabilities:
- SYS_ADMIN
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
groups: []
priority: null
readOnlyRootFilesystem: false
requiredDropCapabilities: null
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
users:
- system:serviceaccount:${NAMESPACE}:ceph-csi-cephfs-ctrlplugin-sa
- system:serviceaccount:${NAMESPACE}:ceph-csi-cephfs-nodeplugin-sa
- system:serviceaccount:${NAMESPACE}:ceph-csi-nfs-ctrlplugin-sa
- system:serviceaccount:${NAMESPACE}:ceph-csi-nfs-nodeplugin-sa
- system:serviceaccount:${NAMESPACE}:ceph-csi-rbd-ctrlplugin-sa
- system:serviceaccount:${NAMESPACE}:ceph-csi-rbd-nodeplugin-sa
volumes:
- configMap
- emptyDir
- hostPath
- projected

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.

[github-actions]

This issue has been automatically closed due to inactivity. Please re-open if this still requires investigation.

[Kajot-dev]

This is essentially privileged scc, which can be expected to be present in all openshift/okd clusters. It would be nice if the operator would have some openshift: true option on the resources, so correct clusterrolebindings (sccs are managed via rbac with the verb use) are deployed

[leela782645]

It would be also possible to ship a custom scc if openshift: true. Currently this is a blocker to switch from ceph-csi (charts) to ceph-csi-operator, which would be the only supported deployment method from version 3.16.0 ongoing.