litmuschaos
/
litmus
mirror of https://github.com/litmuschaos/litmus.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update SCC docs with comments (#3774) 

Signed-off-by: uditgaurav <udit@chaosnative.com>

Signed-off-by: uditgaurav <udit@chaosnative.com>
This commit is contained in:
Udit Gaurav 2022-09-21 21:52:18 +05:30 committed by GitHub
parent 98f26e326c
commit edb161b9cc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
mkdocs/docs/experiments/concepts/security/openshift-scc.md
View File

@ -35,13 +35,20 @@ By default applications would run under the <code>restricted</code> SCC. We can
```bash ```bash
apiVersion: security.openshift.io/v1 apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints kind: SecurityContextConstraints
# To mount the socket path directory in helper pod
allowHostDirVolumePlugin: true allowHostDirVolumePlugin: true
allowHostIPC: false allowHostIPC: false
allowHostNetwork: false allowHostNetwork: false
# To run fault injection on a target container using pid namespace.
# It is used in stress, network, dns and http experiments.
allowHostPID: true allowHostPID: true
allowHostPorts: false allowHostPorts: false
allowPrivilegeEscalation: true allowPrivilegeEscalation: true
# To run some privileged modules in dns, stress and network chaos
allowPrivilegedContainer: true allowPrivilegedContainer: true
# NET_ADMIN & SYS_ADMIN: used in network chaos experiments to perform
# network operations (running tc command in network ns of target container).
# SYS_ADMIN: used in stress chaos experiment to perform cgroup operations.
allowedCapabilities: allowedCapabilities:
- 'NET_ADMIN' - 'NET_ADMIN'
- 'SYS_ADMIN' - 'SYS_ADMIN'
@ -61,14 +68,18 @@ seLinuxContext:
supplementalGroups: supplementalGroups:
type: RunAsAny type: RunAsAny
users: users:
- system:serviceaccount:litmus:agro - system:serviceaccount:litmus:argo
volumes: volumes:
# To allow configmaps mounts on upload scripts or envs.
- configMap - configMap
# To derive the experiment pod name in the experimemnt.
- downwardAPI - downwardAPI
# used for chaos injection like io chaos.
- emptyDir - emptyDir
- hostPath - hostPath
- persistentVolumeClaim - persistentVolumeClaim
- projected - projected
# To authenticate with different cloud providers
- secret - secret
``` ```