Skip to content

Commit 37c474f

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #44210 from sheriff-rh/bz2066992
bz2066992 updated installation with custom SCC
2 parents df9e43b + 5b6cd8e commit 37c474f

File tree

4 files changed

+110
-1
lines changed

4 files changed

+110
-1
lines changed

‎modules/compliance-custom-scc.adoc

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/compliance_operator/compliance-operator-advanced.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="compliance-custom-scc_{context}"]
7+
= Creating a custom SCC for the Compliance Operator
8+
9+
In some environments, you must create a custom Security Context Constraints (SCC) file to ensure the correct permissions are available to the Compliance Operator `api-resource-collector`.
10+
11+
.Prerequisites
12+
13+
* You must have `admin` privileges.
14+
15+
.Procedure
16+
. Define the SCC in a YAML file named `restricted-adjusted-compliance.yaml`:
17+
+
18+
.`SecurityContextConstraints` object definition
19+
[source,yaml]
20+
----
21+
allowHostDirVolumePlugin: false
22+
allowHostIPC: false
23+
allowHostNetwork: false
24+
allowHostPID: false
25+
allowHostPorts: false
26+
allowPrivilegeEscalation: true
27+
allowPrivilegedContainer: false
28+
allowedCapabilities: null
29+
apiVersion: security.openshift.io/v1
30+
defaultAddCapabilities: null
31+
fsGroup:
32+
type: MustRunAs
33+
kind: SecurityContextConstraints
34+
metadata:
35+
name: restricted-adjusted-compliance
36+
priority: 30 <1>
37+
readOnlyRootFilesystem: false
38+
requiredDropCapabilities:
39+
- KILL
40+
- SETUID
41+
- SETGID
42+
- MKNOD
43+
runAsUser:
44+
type: MustRunAsRange
45+
seLinuxContext:
46+
type: MustRunAs
47+
supplementalGroups:
48+
type: RunAsAny
49+
users:
50+
- system:serviceaccount:openshift-compliance:api-resource-collector <2>
51+
volumes:
52+
- configMap
53+
- downwardAPI
54+
- emptyDir
55+
- persistentVolumeClaim
56+
- projected
57+
- secret
58+
----
59+
<1> The priority of this SCC must be higher than any other SCC that applies to the `system:authenticated` group.
60+
<2> Service Account used by Compliance Operator Scanner pod.
61+
62+
. Create the SCC:
63+
+
64+
[source,terminal]
65+
----
66+
$ oc create -f restricted-adjusted-compliance.yaml
67+
----
68+
+
69+
.Example output
70+
[source,terminal]
71+
----
72+
securitycontextconstraints.security.openshift.io/restricted-adjusted-compliance created
73+
----
74+
75+
.Verification
76+
. Verify the SCC was created:
77+
+
78+
[source,terminal]
79+
----
80+
$ oc get scc restricted-adjusted-compliance
81+
----
82+
+
83+
.Example output
84+
[source,terminal]
85+
----
86+
NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP PRIORITY READONLYROOTFS VOLUMES
87+
restricted-adjusted-compliance false <no value> MustRunAs MustRunAsRange MustRunAs RunAsAny 30 false ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]
88+
----

‎modules/security-context-constraints-example.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
The following examples show the security context constraints (SCC) format and
99
annotations:
1010

11-
.Annotated `priviledged` SCC
11+
.Annotated `privileged` SCC
1212
[source,yaml]
1313
----
1414
allowHostDirVolumePlugin: true

‎security/compliance_operator/compliance-operator-advanced.adoc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,10 @@ include::modules/compliance-custom-storage.adoc[leveloffset=+1]
1919
include::modules/compliance-apply-remediations-from-scans.adoc[leveloffset=+1]
2020

2121
include::modules/compliance-auto-update-remediations.adoc[leveloffset=+1]
22+
23+
include::modules/compliance-custom-scc.adoc[leveloffset=+1]
24+
25+
[id="additional-resources_compliance-operator-advanced"]
26+
[role="_additional-resources"]
27+
== Additional resources
28+
* xref:../../authentication/managing-security-context-constraints.adoc[Managing security context constraints]

‎security/compliance_operator/compliance-operator-installation.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,22 @@ Before you can use the Compliance Operator, you must ensure it is deployed in th
1010

1111
include::modules/compliance-operator-console-installation.adoc[leveloffset=+1]
1212

13+
[IMPORTANT]
14+
====
15+
If the `restricted` Security Context Constraints (SCC) have been modified to contain the `system:authenticated` group or has added `requiredDropCapabilities`, the Compliance Operator may not function properly due to permissions issues.
16+
17+
You can create a custom SCC for the Compliance Operator scanner pod service account. For more information, see xref:../../security/compliance_operator/compliance-operator-advanced.adoc#compliance-custom-scc_compliance-advanced[Creating a custom SCC for the Compliance Operator].
18+
====
19+
1320
include::modules/compliance-operator-cli-installation.adoc[leveloffset=+1]
1421

22+
[IMPORTANT]
23+
====
24+
If the `restricted` Security Context Constraints (SCC) have been modified to contain the `system:authenticated` group or has added `requiredDropCapabilities`, the Compliance Operator may not function properly due to permissions issues.
25+
26+
You can create a custom SCC for the Compliance Operator scanner pod service account. For more information, see xref:../../security/compliance_operator/compliance-operator-advanced.adoc#compliance-custom-scc_compliance-advanced[Creating a custom SCC for the Compliance Operator].
27+
====
28+
1529
[id="additional-resources-installing-the-compliance-operator"]
1630
[role="_additional-resources"]
1731
== Additional resources

0 commit comments

Comments
 (0)