Merge pull request #754 from kramaranya/scc_pinning

SCC-pinning for openshift workloads
k8snetworkplumbingwg · Aug 9, 2024 · 2dec53f · 2dec53f
2 parents 8b8f651 + 7c592c5
commit 2dec53f
Show file tree

Hide file tree

Showing 6 changed files with 11 additions and 0 deletions.
diff --git a/bindata/manifests/daemon/daemonset.yaml b/bindata/manifests/daemon/daemonset.yaml
@@ -23,6 +23,7 @@ spec:
         openshift.io/component: network
       annotations:
         kubectl.kubernetes.io/default-container: sriov-network-config-daemon
+        openshift.io/required-scc: privileged
     spec:
       hostNetwork: true
       hostPID: true

diff --git a/bindata/manifests/operator-webhook/server.yaml b/bindata/manifests/operator-webhook/server.yaml
@@ -22,6 +22,8 @@ spec:
     metadata:
       labels:
         app: operator-webhook
+      annotations:
+        openshift.io/required-scc: restricted-v2
     spec:
       securityContext:
         runAsNonRoot: true

diff --git a/bindata/manifests/webhook/server.yaml b/bindata/manifests/webhook/server.yaml
@@ -25,6 +25,8 @@ spec:
         component: network
         type: infra
         openshift.io/component: network
+      annotations:
+        openshift.io/required-scc: restricted-v2
     spec:
       securityContext:
         runAsNonRoot: true

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -21,6 +21,8 @@ spec:
     metadata:
       labels:
         control-plane: controller-manager
+      annotations:
+        openshift.io/required-scc: restricted-v2
     spec:
       securityContext:
         runAsNonRoot: true

diff --git a/deploy/operator.yaml b/deploy/operator.yaml
@@ -15,6 +15,8 @@ spec:
     metadata:
       labels:
         name: sriov-network-operator
+      annotations:
+        openshift.io/required-scc: restricted-v2
     spec:
       affinity:
         nodeAffinity:

diff --git a/deployment/sriov-network-operator-chart/templates/operator.yaml b/deployment/sriov-network-operator-chart/templates/operator.yaml
@@ -15,6 +15,8 @@ spec:
       maxUnavailable: 33%
   template:
     metadata:
+      annotations:
+        openshift.io/required-scc: restricted-v2
       labels:
         name: sriov-network-operator
     spec: