OpenShift Security Context Constraints

From NovaOrdis Knowledge Base
Jump to navigation Jump to search

External

Internal

Overview

OpenShift uses Security Context Constraints (SCCs) to control the actions that a pod, and ultimately, a container, can perform and what resources it has the ability to access, security features, access to host features, etc.

A Security Context Constraint (SCC) is an OpenShift primitive that defines capability declarations used by the admission controller to validate pod-related requests. The capabilities are expressed as booleans, lists and strategies. The boolean fields default to the most restrictive values. Values of a list field are checked agains the set to ensure the value is allowed.

Strategy

A strategy implies a mechanism to generate the value and a mechanism to insure that a specified value falls into a set of allowable values.

RUNASUSER

Provides a user ID to run with and validates it.

Available options:

MustRunAs

Requires a “runAsUser” to be configured. Uses the configured “runAsUser” as the default. Validates against the configured “runAsUser”.

MustRunAsRange

MustRunAsNonRoot

RunAsAny=

SELINUXCONTEXT

SUPPLEMENTALGROUPS

FSGROUP

SCC Fields

priority