Merge pull request #871 from liouk/required-scc

AUTH-482: set required-scc for openshift workloads

Author: openshift-merge-bot[bot]

bindata/assets/deployments/console-deployment.yaml

@@ -21,6 +21,7 @@ spec:
         component: ui
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
+        openshift.io/required-scc: restricted-v2
     spec:
       nodeSelector:
         node-role.kubernetes.io/master: ""

bindata/assets/deployments/downloads-deployment.yaml

@@ -22,6 +22,7 @@ spec:
         component: downloads
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
+        openshift.io/required-scc: restricted-v2
     spec:
       nodeSelector:
         kubernetes.io/os: linux

manifests/07-conversionwebhook-ibm-cloud-managed.yaml

@@ -16,6 +16,7 @@ spec:
   template:
     metadata:
       annotations:
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         name: console-conversion-webhook

manifests/07-conversionwebhook.yaml

@@ -16,6 +16,7 @@ spec:
     metadata:
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
+        openshift.io/required-scc: restricted-v2
       labels:
         name: console-conversion-webhook
     spec:

manifests/07-operator-ibm-cloud-managed.yaml

@@ -16,6 +16,7 @@ spec:
   template:
     metadata:
       annotations:
+        openshift.io/required-scc: restricted-v2
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
       labels:
         name: console-operator

manifests/07-operator.yaml

@@ -17,6 +17,7 @@ spec:
     metadata:
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
+        openshift.io/required-scc: restricted-v2
       labels:
         name: console-operator
     spec:

pkg/console/subresource/deployment/deployment_test.go

@@ -25,6 +25,7 @@ import (
 const (
 	workloadManagementAnnotation      = "target.workload.openshift.io/management"
 	workloadManagementAnnotationValue = `{"effect": "PreferredDuringScheduling"}`
+	requiredSCCAnnotation             = "openshift.io/required-scc"
 )
 
 func TestDefaultDeployment(t *testing.T) {
@@ -137,6 +138,7 @@ func TestDefaultDeployment(t *testing.T) {
 		infrastructureConfigResourceVersionAnnotation:  "",
 		consoleImageAnnotation:                         "",
 		workloadManagementAnnotation:                   workloadManagementAnnotationValue,
+		requiredSCCAnnotation:                          "restricted-v2",
 	}
 
 	consoleDeploymentAffinity := &corev1.Affinity{
@@ -1615,6 +1617,7 @@ func TestDefaultDownloadsDeployment(t *testing.T) {
 							Labels: labels,
 							Annotations: map[string]string{
 								workloadManagementAnnotation: workloadManagementAnnotationValue,
+								requiredSCCAnnotation:        "restricted-v2",
 							},
 						},
 						Spec: downloadsDeploymentPodSpecSingleReplica,
@@ -1657,6 +1660,7 @@ func TestDefaultDownloadsDeployment(t *testing.T) {
 							Labels: labels,
 							Annotations: map[string]string{
 								workloadManagementAnnotation: workloadManagementAnnotationValue,
+								requiredSCCAnnotation:        "restricted-v2",
 							},
 						},
 						Spec: *downloadsDeploymentPodSpecHighAvail,