OpenShift Security Context Constraints: Difference between revisions
| Line 15: | Line 15: | ||
OpenShift uses Security Context Constraints (SCCs) to control the actions that a pod, and ultimately, a container, can perform and what resources it has the ability to access, security features, access to host features, etc. | OpenShift uses Security Context Constraints (SCCs) to control the actions that a pod, and ultimately, a container, can perform and what resources it has the ability to access, security features, access to host features, etc. | ||
A ''Security Context Constraint (SCC)'' is an OpenShift primitive that defines capability declarations used by the [[# | A ''Security Context Constraint (SCC)'' is an OpenShift primitive that defines capability declarations used by the [[#Admission_Controller|admission controller]] to validate pod-related requests. The capabilities are expressed as booleans, lists and [[#Strategy|strategies]]. The boolean fields default to the most restrictive values. Values of a list field are checked agains the set to ensure the value is allowed. | ||
=Strategy= | =Strategy= | ||
Revision as of 19:40, 23 January 2018
External
- https://docs.openshift.com/container-platform/latest/architecture/additional_concepts/authorization.html#security-context-constraints
- https://docs.openshift.com/container-platform/latest/admin_guide/manage_scc.html
- https://docs.openshift.com/container-platform/latest/install_config/persistent_storage/pod_security_context.html
Internal
- OpenShift Security Concepts
- Docker Concepts - Privileged Container
- Security Context Constrains Operations
Overview
OpenShift uses Security Context Constraints (SCCs) to control the actions that a pod, and ultimately, a container, can perform and what resources it has the ability to access, security features, access to host features, etc.
A Security Context Constraint (SCC) is an OpenShift primitive that defines capability declarations used by the admission controller to validate pod-related requests. The capabilities are expressed as booleans, lists and strategies. The boolean fields default to the most restrictive values. Values of a list field are checked agains the set to ensure the value is allowed.
Strategy
A strategy implies a mechanism to generate the value and a mechanism to insure that a specified value falls into a set of allowable values.
Admission Controller
Each field of the security context must be validated against SCCs in order for a request to be successful.