SecurityContextConstraints Requirement

Edit online

The ITX Runtime Server Helm chart requires a specific type of SecurityContextConstraints to be defined and bound to the user or service account of the installation. The predefined SecurityContextConstraints, "nonroot-v2", has been verified for this chart. If your user or service account is bound to this SecurityContextConstraints resource, you can proceed to install the chart as described in the support page.

Below is a custom SecurityContextConstraints (SCC) which can be used for finer control of the permissions and capabilities needed to install the chart. It is modeled after the predefined "nonroot-v2" SCC but with the added restriction of only permitting the user and group ID, 1001, which is required by ITX Runtime Server.

Custom SecurityContextConstraints definition:

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  annotations:
    kubernetes.io/description: "This policy allows a single, non-root user"
  name: ibm-itx-rs-scc
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegedContainer: false
allowPrivilegeEscalation: false
allowedCapabilities: 
- NET_BIND_SERVICE
allowedFlexVolumes: null
allowedUnsafeSysctls: null
defaultAddCapabilities: null
defaultAllowPrivilegeEscalation: false
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
seccompProfiles:
- runtime/default
runAsUser:
  type: MustRunAs
  uid: 1001
fsGroup:
  type: MustRunAs
  ranges:
  - max: 1001
    min: 1001
supplementalGroups:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
volumes:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- nfs
- persistentVolumeClaim
- projected
- secret
priority: 0

From the command line, save the YAML object to a file and run the following command to apply the file content.

oc apply -f <file_name>