kubevirt / hyperconverged-cluster-operator / 13113994127

76%

Build Type

push

github

Committed by web-flow

Commit Message

Add 'openshift.io/required-scc' annotation to pods (#3284)

The OpenShift API dictates that a workload should require an SCC by using the  annotation:
https://docs.openshift.com/container-platform/4.17/authentication/managing-security-context-constraints.html#security-context-constraints-requiring_configuring-internal-oauth

'required-scc' prevents customers (or other extension provided) SCCs from being auto-selected by pods. The auto selection can fail in multiple ways: not enough permissions, changes of UID. When combined with pod security admission (on in new clusters in 4.19), this can result in SCCs being selected based on RBAC permissions that violate PSA and results in pods not running.

Signed-off-by: Oren Cohen <ocohen@redhat.com>

# Conflicts:
#	deploy/olm-catalog/community-kubevirt-hyperconverged/1.15.0/manifests/kubevirt-hyperconverged-operator.v1.15.0.clusterserviceversion.yaml

# Conflicts:
#	deploy/olm-catalog/community-kubevirt-hyperconverged/1.15.0/manifests/kubevirt-hyperconverged-operator.v1.15.0.clusterserviceversion.yaml

Run Details

3 of 4 new or added lines in 2 files covered. (75.0%)

1 existing line in 1 file now uncovered.

6160 of 8565 relevant lines covered (71.92%)

0.79 hits per line