istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove anyuid instructions for OpenShift (#13795) 

* Remove anyuid instructions for OpenShift

These instructions are no longer needed after these changes https://github.com/istio/istio/pull/45394

* Removed blank line that caused failure
This commit is contained in:
Tim O'Keefe 2023-09-05 18:15:59 -04:00 committed by GitHub
parent cb25017fa8
commit c863e9e9e8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
content/en/docs/setup/platform-setup/openshift/index.md
View File

@ -13,15 +13,6 @@ test: no
Follow these instructions to prepare an OpenShift cluster for Istio.
By default, OpenShift doesn't allow containers running with user ID 1337.
You must enable containers running with UID 1337 for Istio's service accounts
by running the command below. Make sure to replace `istio-system` if you are
deploying Istio in another namespace:
{{< text bash >}}
$ oc adm policy add-scc-to-group anyuid system:serviceaccounts:istio-system
{{< /text >}}
Install Istio using the OpenShift profile:
{{< text bash >}}
@ -33,17 +24,3 @@ After installation is complete, expose an OpenShift route for the ingress gatewa
{{< text bash >}}
$ oc -n istio-system expose svc/istio-ingressgateway --port=http2
{{< /text >}}
## Security context constraints for application sidecars
The Istio sidecar injected into each application pod runs with user ID 1337, which is not allowed by default in OpenShift. To allow this user ID to be used, execute the following commands. Replace `<target-namespace>` with the appropriate namespace.
{{< text bash >}}
$ oc adm policy add-scc-to-group anyuid system:serviceaccounts:<target-namespace>
{{< /text >}}
When removing your application, remove the permissions as follows.
{{< text bash >}}
$ oc adm policy remove-scc-from-group anyuid system:serviceaccounts:<target-namespace>
{{< /text >}}