Skip to content

Commit 4aac378

Browse files
abrennan89abrennan89
authored
Merge pull request #38480 from sounix000/pod-timeout-info-privileged-scc-docs-RHDEVDOCS-3243
RHDEVDOCS-3243 Update privileged security context documentation to include information about pod timeouts
2 parents 1d42dc3 + 76fb516 commit 4aac378

File tree

2 files changed

+124
-1
lines changed

2 files changed

+124
-1
lines changed

‎cicd/pipelines/using-pods-in-a-privileged-security-context.adoc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[id='using-pods-in-a-privileged-security-context']
1+
[id="using-pods-in-a-privileged-security-context"]
22
= Using pods in a privileged security context
33
include::modules/common-attributes.adoc[]
44
include::modules/pipelines-document-attributes.adoc[]
@@ -24,7 +24,9 @@ In addition, the `Buildah` cluster task, shipped as part of the OpenShift Pipeli
2424

2525
include::modules/op-running-pipeline-and-task-run-pods-with-privileged-security-context.adoc[leveloffset=+1]
2626

27+
include::modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account.adoc[leveloffset=+1]
2728

29+
[id="additional-references_using-pods-in-a-privileged-security-context"]
2830
== Additional resources
2931

3032
* For information on managing SCCs, refer to xref:../../authentication/managing-security-context-constraints.adoc[Managing security context constraints].

‎modules/op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account.adoc

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
[id="op-running-pipeline-run-and-task-run-with-custom-scc-and-service-account_{context}"]
2+
= Running pipeline run and task run by using a custom SCC and a custom service account
3+
4+
When using the `pipelines-scc` security context constraint (SCC) associated with the default `pipelines` service account, the pipeline run and task run pods may face timeouts. This happens because in the default `pipelines-scc` SCC, the `fsGroup.type` parameter is set to `MustRunAs`.
5+
6+
[NOTE]
7+
====
8+
For more information about pod timeouts, see link:https://bugzilla.redhat.com/show_bug.cgi?id=1995779[BZ#1995779].
9+
====
10+
11+
To avoid pod timeouts, you can create a custom SCC with the `fsGroup.type` parameter set to `RunAsAny`, and associate it with a custom service account.
12+
13+
[NOTE]
14+
====
15+
As a best practice, use a custom SCC and a custom service account for pipeline runs and task runs. This approach allows greater flexibility and does not break the runs when the defaults are modified during an upgrade.
16+
====
17+
18+
.Procedure
19+
20+
. Define a custom SCC with the `fsGroup.type` parameter set to `RunAsAny`:
21+
+
22+
.Example: Custom SCC
23+
[source,yaml]
24+
----
25+
apiVersion: security.openshift.io/v1
26+
kind: SecurityContextConstraints
27+
metadata:
28+
annotations:
29+
kubernetes.io/description: my-scc is a close replica of anyuid scc. pipelines-scc has fsGroup - RunAsAny.
30+
name: my-scc
31+
allowHostDirVolumePlugin: false
32+
allowHostIPC: false
33+
allowHostNetwork: false
34+
allowHostPID: false
35+
allowHostPorts: false
36+
allowPrivilegeEscalation: true
37+
allowPrivilegedContainer: false
38+
allowedCapabilities: null
39+
defaultAddCapabilities: null
40+
fsGroup:
41+
type: RunAsAny
42+
groups:
43+
- system:cluster-admins
44+
priority: 10
45+
readOnlyRootFilesystem: false
46+
requiredDropCapabilities:
47+
- MKNOD
48+
runAsUser:
49+
type: RunAsAny
50+
seLinuxContext:
51+
type: MustRunAs
52+
supplementalGroups:
53+
type: RunAsAny
54+
volumes:
55+
- configMap
56+
- downwardAPI
57+
- emptyDir
58+
- persistentVolumeClaim
59+
- projected
60+
- secret
61+
----
62+
63+
. Create the custom SCC:
64+
+
65+
.Example: Create the `my-scc` SCC
66+
[source,terminal]
67+
----
68+
$ oc create -f my-scc.yaml
69+
----
70+
71+
. Create a custom service account:
72+
+
73+
.Example: Create a `fsgroup-runasany` service account
74+
[source,terminal]
75+
----
76+
$ oc create serviceaccount fsgroup-runasany
77+
----
78+
79+
. Associate the custom SCC with the custom service account:
80+
+
81+
.Example: Associate the `my-scc` SCC with the `fsgroup-runasany` service account
82+
[source,terminal]
83+
----
84+
$ oc adm policy add-scc-to-user my-scc -z fsgroup-runasany
85+
----
86+
+
87+
If you want to use the custom service account for privileged tasks, you can associate the `privileged` SCC with the custom service account by running the following command:
88+
+
89+
.Example: Associate the `privileged` SCC with the `fsgroup-runasany` service account
90+
[source,terminal]
91+
----
92+
$ oc adm policy add-scc-to-user privileged -z fsgroup-runasany
93+
----
94+
95+
. Use the custom service account in the pipeline run and task run:
96+
+
97+
.Example: Pipeline run YAML with `fsgroup-runasany` custom service account
98+
[source,yaml]
99+
----
100+
apiVersion: tekton.dev/v1beta1
101+
kind: PipelineRun
102+
metadata:
103+
name: <pipeline-run-name>
104+
spec:
105+
pipelineRef:
106+
name: <pipeline-cluster-task-name>
107+
serviceAccountName: 'fsgroup-runasany'
108+
----
109+
+
110+
.Example: Task run YAML with `fsgroup-runasany` custom service account
111+
[source,yaml]
112+
----
113+
apiVersion: tekton.dev/v1beta1
114+
kind: TaskRun
115+
metadata:
116+
name: <task-run-name>
117+
spec:
118+
taskRef:
119+
name: <cluster-task-name>
120+
serviceAccountName: 'fsgroup-runasany'
121+
----

0 commit comments

Comments
 (0)