Applying custom security context constraints

Edit online

Define and apply custom SecurityContextConstraints (SCC) to restrict the container to a single, non-root user and bind it to your target namespace.

About this task

The Helm charts require a specific type of SecurityContextConstraints (SCC) to be defined and bound to your service account. The predefined nonroot-v2 SCC is verified for this chart. For finer control over permissions and privileges, apply a custom definition that restricts the container to user and group ID 1001.

Procedure

To apply the SecurityContextConstraints definition to your project in the Red Hat OpenShift web console, complete the following steps:

Click the + icon in the top menu of the console.

Copy and paste the following SecurityContextConstraints YAML definition into the text area:

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  annotations:
    kubernetes.io/description: "This policy allows a single, non-root user"
  name: ibm-itx-rs-scc
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegedContainer: false
allowPrivilegeEscalation: false
allowedCapabilities:
- NET_BIND_SERVICE
allowedFlexVolumes: null
allowedUnsafeSysctls: null
defaultAddCapabilities: null
defaultAllowPrivilegeEscalation: false
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
seccompProfiles:
- runtime/default
runAsUser:
  type: MustRunAs
  uid: 1001
fsGroup:
  type: MustRunAs
  ranges:
  - max: 1001
    min: 1001
supplementalGroups:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
volumes:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- nfs
- persistentVolumeClaim
- projected
- secret
priority: 0

Click Create.

To apply the definition by using the command-line interface, complete the following steps:
1. Save the SecurityContextConstraints YAML definition shown above as a file.
2. Run the oc apply command:
```
oc apply -f <file_name>
```
To bind the custom SecurityContextConstraints to the service accounts in your target namespace, run the following command:
```
oc adm policy add-scc-to-group ibm-itx-rs-scc system:serviceaccounts:<target_namespace>
```
Where target_namespace represents the specific Red Hat OpenShift project or namespace name for your deployment.