Lab‐7: Deploying privileged container using SCC

STEP-1 Create a namespace/project to deploy the application

[student@servera ~]$ oc create namespace test500

STEP-2 Switch to test500 namespace.

[student@servera ~]$ oc config set-context --namespace test500 --current

STEP-3 Ensure that you are in test500 project/namespace.

[student@servera ~]$ oc project

STEP-4 Create a test5 deployment resource.

[student@servera ~]$ oc create deployment test5 --image quay.io/anandpavithran/infosys:no

STEP-5 Watch the resources created. It will show errors.

[student@servera ~]$ oc get all

STEP-6 Inspect the resoucrces.

[student@servera ~]$ oc describe pod test5-xxxxx|grep scc


[student@servera ~]$ oc describe replicaset/test5-xxxx | grep scc

STEP-7 Take the backup of namespace test500 for comparing and delete the namespace.

[student@servera ~]$ oc get namespace test500 -o yaml > test500-project.yaml


[student@servera ~]$ oc delete namespace test500

STEP-8 Create namespace test500 and switch to test500.Download the file from https://github.com/anandpavithran/microshift/blob/main/test500-project.yaml

[student@servera ~]$ oc apply -f test500-project.yaml


[student@servera ~]$ oc config set-context --namespace test500 --current

STEP-9 Set the SCC to run with anyuid in test500 project and deploy the application.Verify also

[student@servera ~]$ oc adm policy add-scc-to-user anyuid -z default -n test500


[student@servera ~]$ oc create deployment test5 --image quay.io/anandpavithran/infosys:no


[student@servera ~]$ oc describe pod test5-xxxx | grep scc

STEP-10 Enter the pod and execute 'id' command.

[student@servera ~]$ oc rsh test5-xxx

sh-4.4$ id
sh-4.4$ exit
sh-4.4$ exit
Output: Verify the container is running as root user.
STEP-11 Delete the namespace test500.

[student@servera ~]$ oc delete namespace test500