Skip to content

Document new SCC allowEmptyDirVolumePlugin restriction. #1528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adellape merged 1 commit into from
Feb 17, 2016
Merged

Document new SCC allowEmptyDirVolumePlugin restriction. #1528

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions admin_guide/manage_scc.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,9 @@ To get a current list of SCCs:
====
----
$ oc get scc
NAME PRIV CAPS HOSTDIR SELINUX RUNASUSER
privileged true [] true RunAsAny RunAsAny
restricted false [] false MustRunAs MustRunAsRange
NAME PRIV CAPS HOSTDIR EMPTYDIR SELINUX RUNASUSER FSGROUP SUPGROUP PRIORITY
privileged true [] true true RunAsAny RunAsAny RunAsAny RunAsAny <none>
restricted false [] false false MustRunAs MustRunAsRange RunAsAny RunAsAny <none>
----
====

Expand All @@ -50,6 +50,7 @@ To examine a particular SCC, use `oc get`, `oc describe`, `oc export`, or `oc ed
----
$ oc edit scc restricted
allowHostDirVolumePlugin: false
allowEmptyDirVolumePlugin: true
allowHostNetwork: false
allowHostPorts: false
allowPrivilegedContainer: false
Expand Down Expand Up @@ -198,6 +199,7 @@ user:
$ oc edit scc privileged

allowHostDirVolumePlugin: true
allowEmptyDirVolumePlugin: true
allowPrivilegedContainer: true
apiVersion: v1
groups:
Expand Down Expand Up @@ -394,6 +396,20 @@ $ oc edit scc restricted

. Save the changes.

=== Block the emptyDir Volume Plug-in

The use of `emptyDir` volumes is enabled by default, but can be disabled in your cluster if desired.

. Edit the *restricted* SCC:
+
----
$ oc edit scc restricted
----

. Add `*allowEmptyDirVolumePlugin: false*`.

. Save the changes.

=== Ensure That Admission Attempts to Use a Specific SCC First

You may control the sort ordering of SCCs in admission by setting the `Priority`
Expand Down
15 changes: 8 additions & 7 deletions architecture/additional_concepts/authorization.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,13 +269,13 @@ administrators using the CLI:
====
----
$ oc get scc
NAME PRIV CAPS HOSTDIR SELINUX RUNASUSER FSGROUP SUPGROUP PRIORITY
anyuid false [] false MustRunAs RunAsAny RunAsAny RunAsAny 10
hostaccess false [] true MustRunAs MustRunAsRange RunAsAny RunAsAny <none>
hostmount-anyuid false [] true MustRunAs RunAsAny RunAsAny RunAsAny <none>
nonroot false [] false MustRunAs MustRunAsNonRoot RunAsAny RunAsAny <none>
privileged true [] true RunAsAny RunAsAny RunAsAny RunAsAny <none>
restricted false [] false MustRunAs MustRunAsRange RunAsAny RunAsAny <none>
NAME PRIV CAPS HOSTDIR EMPTYDIR SELINUX RUNASUSER FSGROUP SUPGROUP PRIORITY
anyuid false [] false true MustRunAs RunAsAny RunAsAny RunAsAny 10
hostaccess false [] true true MustRunAs MustRunAsRange RunAsAny RunAsAny <none>
hostmount-anyuid false [] true true MustRunAs RunAsAny RunAsAny RunAsAny <none>
nonroot false [] false true MustRunAs MustRunAsNonRoot RunAsAny RunAsAny <none>
privileged true [] true true RunAsAny RunAsAny RunAsAny RunAsAny <none>
restricted false [] false true MustRunAs MustRunAsRange RunAsAny RunAsAny <none>
----
====

Expand All @@ -287,6 +287,7 @@ CLI. For example, for the privileged SCC:
# oc export scc/privileged

allowHostDirVolumePlugin: true
allowEmptyDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
Expand Down
1 change: 1 addition & 0 deletions rest_api/kubernetes_v1.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7959,6 +7959,7 @@ NamespaceList is a list of Namespaces.
|allowPrivilegedContainer|allow containers to run as privileged|true|boolean|false
|allowedCapabilities|capabilities that are allowed to be added|true|<<v1.Capability>> array|
|allowHostDirVolumePlugin|allow the use of the host dir volume plugin|true|boolean|false
|allowEmptyDirVolumePlugin|allow the use of the empty dir volume plugin|true|boolean|false
|allowHostNetwork|allow the use of the hostNetwork in the pod spec|true|boolean|false
|allowHostPorts|allow the use of the host ports in the containers|true|boolean|false
|allowHostPID|allow the use of the host pid in the containers|true|boolean|false
Expand Down