OpenShift Security Context Constraints

From NovaOrdis Knowledge Base
Revision as of 19:40, 23 January 2018 by Ovidiu (talk | contribs) (→‎Overview)
Jump to navigation Jump to search

External

Internal

Overview

OpenShift uses Security Context Constraints (SCCs) to control the actions that a pod, and ultimately, a container, can perform and what resources it has the ability to access, security features, access to host features, etc.

A Security Context Constraint (SCC) is an OpenShift primitive that defines capability declarations used by the admission controller to validate pod-related requests. The capabilities are expressed as booleans, lists and strategies. The boolean fields default to the most restrictive values. Values of a list field are checked agains the set to ensure the value is allowed.

Strategy

A strategy implies a mechanism to generate the value and a mechanism to insure that a specified value falls into a set of allowable values.



Admission Controller

Each field of the security context must be validated against SCCs in order for a request to be successful.