Skip to content

Commit

Permalink
bindata: run openshift-apiserver as root explicitly.
Browse files Browse the repository at this point in the history
openshift-apiserver needs to run as root in order to be able to write audit to /var/log/openshift-apiserver.
Currently only "priviledged: true" is specified which can lead to picking SCCs that do not have the RunAsAny policy.

This fixes it by specifying runAsUser: 0 explicitely.
  • Loading branch information
s-urbaniak committed Aug 20, 2021
1 parent 163e5e7 commit 95f401c
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 0 deletions.
2 changes: 2 additions & 0 deletions bindata/v3.11.0/openshift-apiserver/deploy.yaml
Expand Up @@ -49,6 +49,7 @@ spec:
command: ['sh', '-c', 'chmod 0700 /var/log/openshift-apiserver']
securityContext:
privileged: true
runAsUser: 0
volumeMounts:
- mountPath: /var/log/openshift-apiserver
name: audit-dir
Expand All @@ -72,6 +73,7 @@ spec:
# we need to set this to privileged to be able to write audit to /var/log/openshift-apiserver
securityContext:
privileged: true
runAsUser: 0
ports:
- containerPort: 8443
volumeMounts:
Expand Down
2 changes: 2 additions & 0 deletions pkg/operator/v311_00_assets/bindata.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 95f401c

Please sign in to comment.