openshift_rbac.yaml

#
# Copyright (c) 2024, Oracle and/or its affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
#
---

# Create a Security Context Contraint
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
metadata:
  name: sidb-oracle-user-scc
allowPrivilegedContainer: false
allowedCapabilities:
  - SYS_NICE
runAsUser:
  type: MustRunAs
  uid: 54321
seLinuxContext:
  type: RunAsAny
fsGroup:
  type: MustRunAs
  ranges:
  - min: 54321
    max: 54321
supplementalGroups:
   type: MustRunAs
   ranges:
   - min: 54321
     max: 54321
--- 

# Create a Security Context Contraint
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
metadata:
  name: sidb-oracle-root-user-scc
allowPrivilegedContainer: false
allowedCapabilities:
  - SYS_NICE
runAsUser:
  type: MustRunAsRange
  uidRangeMin: 0
  uidRangeMax: 54321
seLinuxContext:
  type: RunAsAny
fsGroup:
  type: MustRunAs
  ranges:
  - min: 0
    max: 54321
supplementalGroups:
  type: MustRunAs
  ranges:
  - min: 0
    max: 5432
---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sidb-sa
  namespace: sidb-ns
---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: use-sidb-scc
  namespace: sidb-ns
rules:
  - apiGroups:
    - security.openshift.io
    verbs:
    - use
    resources:
    - securitycontextconstraints
    resourceNames:
    - sidb-oracle-user-scc
    - sidb-oracle-root-user-scc
---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: use-sidb-scc
  namespace: sidb-ns
subjects:
  - kind: ServiceAccount
    name: sidb-sa
    namespace: sidb-ns
roleRef:
  kind: Role
  name: use-sidb-scc
  apiGroup: rbac.authorization.k8s.io