Skip to content

Commit

Permalink
Remove anyuid instructions for OpenShift (#13795)
Browse files Browse the repository at this point in the history
* Remove anyuid instructions for OpenShift

These instructions are no longer needed after these changes istio/istio#45394

* Removed blank line that caused failure
  • Loading branch information
rh-tokeefe committed Sep 5, 2023
1 parent cb25017 commit c863e9e
Showing 1 changed file with 0 additions and 23 deletions.
23 changes: 0 additions & 23 deletions content/en/docs/setup/platform-setup/openshift/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,6 @@ test: no

Follow these instructions to prepare an OpenShift cluster for Istio.

By default, OpenShift doesn't allow containers running with user ID 1337.
You must enable containers running with UID 1337 for Istio's service accounts
by running the command below. Make sure to replace `istio-system` if you are
deploying Istio in another namespace:

{{< text bash >}}
$ oc adm policy add-scc-to-group anyuid system:serviceaccounts:istio-system
{{< /text >}}

Install Istio using the OpenShift profile:

{{< text bash >}}
Expand All @@ -33,17 +24,3 @@ After installation is complete, expose an OpenShift route for the ingress gatewa
{{< text bash >}}
$ oc -n istio-system expose svc/istio-ingressgateway --port=http2
{{< /text >}}

## Security context constraints for application sidecars

The Istio sidecar injected into each application pod runs with user ID 1337, which is not allowed by default in OpenShift. To allow this user ID to be used, execute the following commands. Replace `<target-namespace>` with the appropriate namespace.

{{< text bash >}}
$ oc adm policy add-scc-to-group anyuid system:serviceaccounts:<target-namespace>
{{< /text >}}

When removing your application, remove the permissions as follows.

{{< text bash >}}
$ oc adm policy remove-scc-from-group anyuid system:serviceaccounts:<target-namespace>
{{< /text >}}

0 comments on commit c863e9e

Please sign in to comment.