Скачать или смотреть Controlling Application Permissions with Security Context Constraints SCC (OpenShift Administration)

Title :
Controlling Application Permissions with Security Context Constraints SCC (OpenShift Administration)
...................................
** If new to Docker, Podman, Kubernetes and Openshift then first see --    • Docker, Podman, Containers, Kubernetes and...  

** For detail about OpenShift development --
   • OpenShift Tutorial  

Controlling Application Permissions with Security Context Constraints

Security Context Constraints (SCCs)
SCCs control:
• Running privileged containers.
• Requesting extra capabilities for a container
• Using host directories as volumes.
• Changing the SELinux context of a container.
• Changing the user ID.

OpenShift provides eight default SCCs:
• anyuid
• hostaccess
• hostmount-anyuid
• hostnetwork
• node-exporter
• nonroot
• privileged
• restricted


Lab:
• Create service accounts and assign security context constraints (SCCs) to them.
• Assign a service account to a deployment configuration.
• Run applications that need root privileges.

commands--
oc new-project authorization-scc

oc new-app --name gitlab --image quay.io/redhattraining/gitlab-ce:8.4.3-ce.0

Log in as the admin user

oc get pod/pod-id -o yaml | oc adm policy scc-subject-review -f -

oc create sa gitlab-sa

oc adm policy add-scc-to-user anyuid -z gitlab-sa

Log in as the developer user

oc set serviceaccount deployment/gitlab gitlab-sa

oc expose service/gitlab --port 80 --hostname gitlab.apps.ocp4.example.com