add OCP SCC info #7119
add OCP SCC info #7119
Conversation
| @@ -338,6 +338,36 @@ When you deploy to Kubernetes, the container must be granted the `CHECKPOINT_RES | |||
| - ALL | |||
| ---- | |||
|
|
|||
| ==== Red Hat OpenShift security context constraints | |||
|
|
|||
| To deploy applications to Red Hat OpenShift with InstantOn, you must specify a security context constraint (SCC) that at a minimum grants the capabilities to the defaults that are needed for InstantOn. The following example defines an SCC with these capabilities that is called `defaultAddCapabilities`: | |||
There was a problem hiding this comment.
This doesn't read right to me.
that at a minimum grants the capabilities to the defaults that are needed for InstantOn.
The capabilities listed under defaultAddCapabilities are adding the capabilities to the set of capabilities which are granted to any pod. So it is adding capabilities to that list of default capabilities. To me it would make more sense to read like this:
that at a minimum specifies a list of additional capabilities that are added to any pod. The following example defines an SCC with the required capabilities by using the parameter called
defaultAddCapabilities:
| - SETPCAP | ||
| ---- | ||
|
|
||
| The applications you deploy must be associated with this SCC, for example, by specifying the `serviceAccountName` setting in the deployment yaml file. The following example specifies the `defaultAddCapabilities` SCC that was defined in the previous example: |
There was a problem hiding this comment.
This is confusing because defaultAddCapabilities is treated as if it is an SCC name, but before defaultAddCapabilities is a parameter of the SCC yaml file. I think it would be better to use a name like liberty-instanton-scc:
The applications you deploy must be associated with an SCC that adds the required capabilities. For example, assume there is an SCC deployed called
liberty-instanton-sccthat added the required capabilities. The following example specifies theserviceAccountNameparameter to set the SCC name toliberty-instanton-scc:
|
|
||
| [source,yaml] | ||
| ---- | ||
| serviceAccountName: defaultAddCapabilities |
There was a problem hiding this comment.
Change to:
serviceAccountName: liberty-instanton-scc
#7090