16.4. Creating security context constraints

Procedure

1. Define the SCC in a YAML file named scc-admin.yaml:

   kind: SecurityContextConstraints
   apiVersion: security.openshift.io/v1
   metadata:
     name: scc-admin
   allowPrivilegedContainer: true
   runAsUser:
     type: RunAsAny
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   supplementalGroups:
     type: RunAsAny
   users:
   - my-admin-user
   groups:
   - my-admin-group

   Optionally, you can drop specific capabilities for an SCC by setting the requiredDropCapabilities field with the desired values. Any specified capabilities are dropped from the container. To drop all capabilities, specify ALL. For example, to create an SCC that drops the KILL, MKNOD, and SYS_CHROOT capabilities, add the following to the SCC object:

   requiredDropCapabilities:
   - KILL
   - MKNOD
   - SYS_CHROOT

   참고

   You cannot list a capability in both allowedCapabilities and requiredDropCapabilities.

   CRI-O supports the same list of capability values that are found in the Docker documentation.

2. Create the SCC by passing in the file:

   $ oc create -f scc-admin.yaml

   Example output

   securitycontextconstraints "scc-admin" created