Skip to content

Commit 7f23c5d

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1847 from haircommander/userns-scc
OCPNODE-2559: SCC: add nested-podman and restricted-v3
2 parents 57e407f + 218c97c commit 7f23c5d

4 files changed

+159
-0
lines changed

‎bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_cr-scc-nested-container.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/ibm-cloud-managed: "true"
6+
include.release.openshift.io/self-managed-high-availability: "true"
7+
include.release.openshift.io/single-node-developer: "true"
8+
rbac.authorization.kubernetes.io/autoupdate: "true"
9+
name: system:openshift:scc:nested-container
10+
rules:
11+
- apiGroups:
12+
- security.openshift.io
13+
resourceNames:
14+
- nested-container
15+
resources:
16+
- securitycontextconstraints
17+
verbs:
18+
- use

‎bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_cr-scc-restricted-v3.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
annotations:
5+
include.release.openshift.io/ibm-cloud-managed: "true"
6+
include.release.openshift.io/self-managed-high-availability: "true"
7+
include.release.openshift.io/single-node-developer: "true"
8+
rbac.authorization.kubernetes.io/autoupdate: "true"
9+
name: system:openshift:scc:restricted-v3
10+
rules:
11+
- apiGroups:
12+
- security.openshift.io
13+
resourceNames:
14+
- restricted-v3
15+
resources:
16+
- securitycontextconstraints
17+
verbs:
18+
- use

‎bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-nested-container.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
allowHostDirVolumePlugin: false
2+
allowHostIPC: false
3+
allowHostNetwork: false
4+
allowHostPID: false
5+
allowHostPorts: false
6+
allowPrivilegeEscalation: true
7+
allowPrivilegedContainer: false
8+
allowedCapabilities:
9+
- SETUID
10+
- SETGID
11+
apiVersion: security.openshift.io/v1
12+
defaultAddCapabilities:
13+
fsGroup:
14+
type: MustRunAs
15+
ranges:
16+
- min: 0
17+
max: 65534
18+
groups: []
19+
kind: SecurityContextConstraints
20+
metadata:
21+
annotations:
22+
include.release.openshift.io/ibm-cloud-managed: "true"
23+
include.release.openshift.io/self-managed-high-availability: "true"
24+
include.release.openshift.io/single-node-developer: "true"
25+
kubernetes.io/description: 'nested-container is specially tailored for running nested containers.
26+
It balances a tight security profile, while remaining loose enough to be useful to run nested containers in.
27+
In addition to requiring pods run with a user namespace, it allows SETUID and SETGID capabilities, requires the "container_engine_t" SELinux type,
28+
allows any users within the range of 0-65534, allows privilege escalation (to allow a container engine to run new{uid/gid}map), and allows any seccomp profile.
29+
Since any pods running within this SCC must use a user namespace ("hostUsers: false"), their actual UID/GID on the host will be
30+
allocated by the kubelet to be unprivileged, and any capabilities the pod is granted will not apply outside of the pods user namespace.'
31+
name: nested-container
32+
priority:
33+
readOnlyRootFilesystem: false
34+
requiredDropCapabilities:
35+
runAsUser:
36+
type: MustRunAsRange
37+
ranges:
38+
- min: 0
39+
max: 65534
40+
seLinuxContext:
41+
type: MustRunAs
42+
seLinuxOptions:
43+
type: container_engine_t
44+
seccompProfiles:
45+
- "*"
46+
supplementalGroups:
47+
type: MustRunAs
48+
ranges:
49+
- min: 0
50+
max: 65534
51+
users: []
52+
userNamespaceLevel: RequirePodLevel
53+
volumes:
54+
- configMap
55+
- csi
56+
- downwardAPI
57+
- emptyDir
58+
- ephemeral
59+
- persistentVolumeClaim
60+
- projected
61+
- secret

‎bindata/bootkube/scc-manifests/0000_20_kube-apiserver-operator_00_scc-restricted-v3.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
allowHostDirVolumePlugin: false
2+
allowHostIPC: false
3+
allowHostNetwork: false
4+
allowHostPID: false
5+
allowHostPorts: false
6+
allowPrivilegeEscalation: false
7+
allowPrivilegedContainer: false
8+
allowedCapabilities:
9+
- NET_BIND_SERVICE
10+
apiVersion: security.openshift.io/v1
11+
defaultAddCapabilities:
12+
fsGroup:
13+
type: MustRunAs
14+
ranges:
15+
- min: 1000
16+
max: 65534
17+
groups: []
18+
kind: SecurityContextConstraints
19+
metadata:
20+
annotations:
21+
include.release.openshift.io/ibm-cloud-managed: "true"
22+
include.release.openshift.io/self-managed-high-availability: "true"
23+
include.release.openshift.io/single-node-developer: "true"
24+
kubernetes.io/description: restricted-v3 denies access to all host features and requires
25+
pods to be run with user namespace (and may not be root within that user namespace),
26+
and SELinux context that are allocated to the namespace. This is the most restrictive SCC.
27+
On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities
28+
and does not allow privilege escalation binaries. It will also default the seccomp
29+
profile to runtime/default if unset, otherwise this seccomp profile is required.
30+
On top of the legacy 'restricted-v2' SCC, it requires a pod runs in a user namespace.
31+
Because of this, the pod to be any non-root UID within the user namespace (between 1000-65534), and
32+
it will still be unprivileged outside of the user namespace.
33+
name: restricted-v3
34+
priority:
35+
readOnlyRootFilesystem: false
36+
requiredDropCapabilities:
37+
- ALL
38+
runAsUser:
39+
type: MustRunAsRange
40+
ranges:
41+
- min: 1000
42+
max: 65534
43+
seLinuxContext:
44+
type: MustRunAs
45+
seccompProfiles:
46+
- runtime/default
47+
supplementalGroups:
48+
type: MustRunAs
49+
ranges:
50+
- min: 1000
51+
max: 65534
52+
users: []
53+
userNamespaceLevel: RequirePodLevel
54+
volumes:
55+
- configMap
56+
- csi
57+
- downwardAPI
58+
- emptyDir
59+
- ephemeral
60+
- persistentVolumeClaim
61+
- projected
62+
- secret

0 commit comments

Comments
 (0)