kubevirt / hyperconverged-cluster-operator / 13107858167

72%

main: 76%

Build Type

Pull #3284

github

Committed by orenc1

Commit Message

Add 'openshift.io/required-scc' annotation to pods

The OpenShift API dictates that a workload should require an SCC by using the  annotation:
https://docs.openshift.com/container-platform/4.17/authentication/managing-security-context-constraints.html#security-context-constraints-requiring_configuring-internal-oauth

'required-scc' prevents customers (or other extension provided) SCCs from being auto-selected by pods. The auto selection can fail in multiple ways: not enough permissions, changes of UID. When combined with pod security admission (on in new clusters in 4.19), this can result in SCCs being selected based on RBAC permissions that violate PSA and results in pods not running.

Signed-off-by: Oren Cohen <ocohen@redhat.com>

# Conflicts:
#	deploy/olm-catalog/community-kubevirt-hyperconverged/1.15.0/manifests/kubevirt-hyperconverged-operator.v1.15.0.clusterserviceversion.yaml

# Conflicts:
#	deploy/olm-catalog/community-kubevirt-hyperconverged/1.15.0/manifests/kubevirt-hyperconverged-operator.v1.15.0.clusterserviceversion.yaml

Pull Request Pull Request #3284: Add `openshift.io/required-scc` annotation to pods

Run Details

3 of 4 new or added lines in 2 files covered. (75.0%)

1 existing line in 1 file now uncovered.

6160 of 8565 relevant lines covered (71.92%)

0.79 hits per line