sysctl-scc.yaml

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  annotations:
    kubernetes.io/description: "allows pod to run as any UID, with no capabilities, run as privileged and run sysctl commands"
    "helm.sh/hook": pre-install
  name: test-sysctl-privileged-scc
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegedContainer: true
allowPrivilegeEscalation: true
allowedCapabilities: []
allowedFlexVolumes: []
allowedUnsafeSysctls: []
defaultAddCapabilities: []
defaultAllowPrivilegeEscalation: true
fsGroup:
  type: RunAsAny
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
#- SYS_ADMIN
#- KILL
#- MKNOD
#- SETUID
#- SETGID
runAsUser:
  type: RunAsAny
# This can be customized for your host machine
seLinuxContext:
  type: MustRunAs
# seLinuxOptions:
#   level:
#   user:
#   role:
#   type:
supplementalGroups:
  type: RunAsAny
# This can be customized for your host machine
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret
# If you want a priority on your SCC -- set for a value more than 0
priority: 11
users:
- system:serviceaccount:sbu-dev:test-sysctl