clear out tenant security context

add scc needed to run tenant
openshift-pipelines · Jan 26, 2023 · 784f5c2 · 784f5c2
1 parent d1ba7dc
commit 784f5c2
Show file tree

Hide file tree

Showing 4 changed files with 46 additions and 5 deletions.
diff --git a/developer/openshift/operators/minio/tenant/kustomization.yaml b/developer/openshift/operators/minio/tenant/kustomization.yaml
@@ -4,3 +4,4 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - tenant.yaml
+  - tenant-permissions.yaml
diff --git a/developer/openshift/operators/minio/tenant/tenant-permissions.yaml b/developer/openshift/operators/minio/tenant/tenant-permissions.yaml
@@ -0,0 +1,35 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: minio
+  namespace: tekton-results
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: minio
+  namespace: tekton-results
+rules:
+  - apiGroups:
+      - security.openshift.io
+    resourceNames:
+      - nonroot
+    resources:
+      - securitycontextconstraints
+    verbs:
+      - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: minio
+  namespace: tekton-results
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: minio
+subjects:
+  - kind: ServiceAccount
+    name: minio
+    namespace: tekton-results
diff --git a/developer/openshift/operators/minio/tenant/tenant.yaml b/developer/openshift/operators/minio/tenant/tenant.yaml
@@ -44,7 +44,7 @@ spec:
   imagePullSecret: {}
   mountPath: /export
   subPath: ""
-  serviceAccountName: ""
+  serviceAccountName: "minio"
   pools:
     - servers: 1
       name: pool-0
@@ -67,8 +67,5 @@ spec:
             requests:
               storage: 1Gi
         status: {}
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000630001
-        runAsGroup: 1000630002
+      securityContext: {}
   requestAutoCert: true
diff --git a/operator/gitops/compute/pipeline-service-manager/role.yaml b/operator/gitops/compute/pipeline-service-manager/role.yaml
@@ -110,6 +110,14 @@ rules:
       - "get"
       - "create"
       - "update"
+  - apiGroups:
+      - security.openshift.io
+    resourceNames:
+      - nonroot
+    resources:
+      - securitycontextconstraints
+    verbs:
+      - use
   - apiGroups:
       - pipelinesascode.tekton.dev
     resources: