Skip to content

Commit

Permalink
Explicitly request "use" verb on SCC (#1457)
Browse files Browse the repository at this point in the history
In order to notify pod-security.kubernetes.io that we intent to
create (potentially privileged) SCCs, so it labels us as "privileged",
we have to explicitly request "use" verb for scc.

With this change, CNAO's namespace is marked as
pod-security.kubernetes.io/enforce: priviledged
even before we deploy any of our privileged components. This assures
that CNAO does not show up in audit logs.

Signed-off-by: Petr Horáček <phoracek@redhat.com>

Signed-off-by: Petr Horáček <phoracek@redhat.com>
Co-authored-by: Petr Horáček <phoracek@redhat.com>
  • Loading branch information
kubevirt-bot and phoracek committed Nov 22, 2022
1 parent ea38ef1 commit c9fed60
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions pkg/components/components.go
Original file line number Diff line number Diff line change
Expand Up @@ -397,6 +397,7 @@ func GetClusterRole() *rbacv1.ClusterRole {
"get",
"list",
"watch",
"use",
},
},
{
Expand Down

0 comments on commit c9fed60

Please sign in to comment.