Chapter 8. Configuring the security context for pods

Procedure

1. Define a custom SCC with the fsGroup.type parameter set to RunAsAny:

   Example: Custom SCC

   apiVersion: security.openshift.io/v1
   kind: SecurityContextConstraints
   metadata:
     annotations:
       kubernetes.io/description: my-scc is a close replica of anyuid scc. pipelines-scc has fsGroup - RunAsAny.
     name: my-scc
   allowHostDirVolumePlugin: false
   allowHostIPC: false
   allowHostNetwork: false
   allowHostPID: false
   allowHostPorts: false
   allowPrivilegeEscalation: true
   allowPrivilegedContainer: false
   allowedCapabilities: null
   defaultAddCapabilities: null
   fsGroup:
     type: RunAsAny
   groups:
   - system:cluster-admins
   priority: 10
   readOnlyRootFilesystem: false
   requiredDropCapabilities:
   - MKNOD
   runAsUser:
     type: RunAsAny
   seLinuxContext:
     type: MustRunAs
   supplementalGroups:
     type: RunAsAny
   volumes:
   - configMap
   - downwardAPI
   - emptyDir
   - persistentVolumeClaim
   - projected
   - secret

2. Create the custom SCC:

   Example: Create the my-scc SCC

   $ oc create -f my-scc.yaml

3. Create a custom service account:

   Example: Create a fsgroup-runasany service account

   $ oc create serviceaccount fsgroup-runasany

4. Associate the custom SCC with the custom service account:

   Example: Associate the my-scc SCC with the fsgroup-runasany service account

   $ oc adm policy add-scc-to-user my-scc -z fsgroup-runasany

   If you want to use the custom service account for privileged tasks, you can associate the privileged SCC with the custom service account by running the following command:

   Example: Associate the privileged SCC with the fsgroup-runasany service account

   $ oc adm policy add-scc-to-user privileged -z fsgroup-runasany

5. Use the custom service account in the pipeline run and task run:

   Example: Pipeline run YAML with fsgroup-runasany custom service account

   apiVersion: tekton.dev/v1
   kind: PipelineRun
   metadata:
     name: <pipeline_run_name>
   spec:
     pipelineRef:
       name: <pipeline_cluster_task_name>
     taskRunTemplate:
       serviceAccountName: 'fsgroup-runasany'

   Example: Task run YAML with fsgroup-runasany custom service account

   apiVersion: tekton.dev/v1
   kind: TaskRun
   metadata:
     name: <task_run_name>
   spec:
     taskRef:
       name: <cluster_task_name>
     taskRunTemplate:
       serviceAccountName: 'fsgroup-runasany'