Unable to deploy an APB with privileged security context

[dymurray]

Feature:

Ability to specify if an APB needs privileged security permissions as opposed to 'restricted' by default

Bug:

I am unable to provision an APB which accesses files in /root/ on the container

How to reproduce it:
Create an APB and reference a container in the deployment config which requires root access to run the startup binary.

[dymurray]

Initial thoughts are that an APB would specify in their spec whether or not privileged access is needed.

[jwmatthews]

Note that work on refreshing the ManageIQ APB is waiting on this feature.
Trello card: https://trello.com/c/sxfZlTYm

[rthallisey]

@dymurray has anything changed on this? Can apbs access /root?

[dymurray]

Nothing has changed with this, still a valid issue. APBs can still not be deployed with a privileged scc.

[mhrivnak]

Could you expand on the use case for this? Why does an APB need to access files in /root/ ? Could the APB's Dockerfile make those files available elsewhere?

[dymurray]

@mhrivnak The intention is more that the APB can declare if it needs elevated permisisons up front so that it is launched in the proper context. I'm unsure if /root/ is a good usecase. It's more about consuming images that weren't meant to be run in the restricted scc.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[jmrodri]

/close

[openshift-ci-robot]

@jmrodri: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.