search

open-cluster-management-io / ocm

Core components in the OCM project. Report here if you found any issues in OCM.
https://open-cluster-management.io
Apache License 2.0
772 stars 95 forks source link

Customize the scc of deployments to make ocm run under different scc #633

Open zhiweiyin318 opened 2 months ago

zhiweiyin318 commented 2 months ago

Describe the enhancement currently the scc in the deployments can not be customized, the ocm may could not run under some restricted scc. need an approach to solve ssc .

the related PRs : https://github.com/open-cluster-management-io/ocm/pull/250 https://github.com/open-cluster-management-io/ocm/pull/252

tamalsaha commented 2 months ago

I was able to get things running under restricted security profile using the following chages.

By restricted profile, I mean pod-security.kubernetes.io/enforce: restricted label on namespaces.

namespaces=( \
  open-cluster-management \
  open-cluster-management-addon \
  open-cluster-management-agent \
  open-cluster-management-agent-addon \
  open-cluster-management-cluster-auth \
  open-cluster-management-cluster-proxy \
  open-cluster-management-hub \
)

for ns in ${namespaces[@]}; do
  kubectl create ns $ns
  kubectl label ns $ns pod-security.kubernetes.io/enforce=restricted
done