Security Bulletin: In IBM Cloud Private on OpenShift icp-scc SecurityContextContraints is erroneously assigned to all pods in all namespaces

Remediation/Fixes

For IBM Cloud Private 3.1.1 or 3.1.2:

In OpenShift clusters, the icp-scc SecurityContextContraints resource is erroneously assigned to all pods in all namespaces that use Deployments, StatefulSets, DaemonSets, Jobs, and other controllers that manage pods. The icp-scc SecurityContextContraints is assigned regardless of the user ID that was used to create the resource or the service account that is assigned to the pod.

To resolve the issue, run the following kubectl commands on the master node:

1. kubectl patch scc icp-scc --type='json' -p='[{"op": "remove", "path": "/groups"}]'
2. kubectl patch scc icp-scc --type='json' -p='[{"op": "add", "path": "/users", "value": ["system:serviceaccount:kube-system:default","system:serviceaccount:istio-system:default", "system:serviceaccount:icp-system:default","system:serviceaccount:cert-manager:default"] }]'

Reference: 

https://www-03preprod.ibm.com/support/knowledgecenter/SSBS6K_3.2.0/supported_environments/openshift/known_issues_openshift.html#scc