kubevirt / hyperconverged-cluster-operator / 13097001245

72%

main: 76%

Pull #3284

github

Add 'openshift.io/required-scc' annotation to pods

The OpenShift API dictates that a workload should require an SCC by using the  annotation:
https://docs.openshift.com/container-platform/4.17/authentication/managing-security-context-constraints.html#security-context-constraints-requiring_configuring-internal-oauth

'required-scc' prevents customers (or other extension provided) SCCs from being auto-selected by pods. The auto selection can fail in multiple ways: not enough permissions, changes of UID. When combined with pod security admission (on in new clusters in 4.19), this can result in SCCs being selected based on RBAC permissions that violate PSA and results in pods not running.

Signed-off-by: Oren Cohen <ocohen@redhat.com>

# Conflicts:
#	deploy/olm-catalog/community-kubevirt-hyperconverged/1.15.0/manifests/kubevirt-hyperconverged-operator.v1.15.0.clusterserviceversion.yaml

3 of 4 new or added lines in 2 files covered. (75.0%)

6158 of 8565 relevant lines covered (71.9%)

0.79 hits per line