主页
产品
OpenShift Container Platform
4.5
Authentication and authorization
12.5. Role-based access to security context constraints

12.5. Role-based access to security context constraints

You can specify SCCs as resources that are handled by RBAC. This allows you to scope access to your SCCs to a certain project or to the entire cluster. Assigning users, groups, or service accounts directly to an SCC retains cluster-wide scope.

注意

You cannot assign a SCC to pods created in one of the default namespaces: default, kube-system, kube-public, openshift-node, openshift-infra, openshift. These namespaces should not be used for running pods or services.

To include access to SCCs for your role, specify the scc resource when creating a role.

oc create role <role-name> --verb=use --resource=scc --resource-name=<scc-name> -n <namespace>

$ oc create role <role-name> --verb=use --resource=scc --resource-name=<scc-name> -n <namespace>

Copy to Clipboard

Toggle word wrap

This results in the following role definition:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
...
  name: role-name 
  namespace: namespace 
...
rules:
- apiGroups:
  - security.openshift.io 
  resourceNames:
  - scc-name 
  resources:
  - securitycontextconstraints 
  verbs: 
  - use

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
...
  name: role-name


  namespace: namespace


...
rules:
- apiGroups:
  - security.openshift.io


  resourceNames:
  - scc-name


  resources:
  - securitycontextconstraints


  verbs:


  - use

Copy to Clipboard

Toggle word wrap

1: The role’s name.
2: Namespace of the defined role. Defaults to default if not specified.
3: The API group that includes the SecurityContextConstraints resource. Automatically defined when scc is specified as a resource.
4: An example name for an SCC you want to have access.
5: Name of the resource group that allows users to specify SCC names in the resourceNames field.
6: A list of verbs to apply to the role.

A local or cluster role with such a rule allows the subjects that are bound to it with a role binding or a cluster role binding to use the user-defined SCC called scc-name.

注意

Because RBAC is designed to prevent escalation, even project administrators are unable to grant access to an SCC. By default, they are not allowed to use the verb use on SCC resources, including the restricted SCC.

返回顶部

12.5. Role-based access to security context constraints

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links