fix: Add Security context constraint for openshift (#297)

* fix: Add Security context constraint for openshift

Signed-off-by: Diego Alfonso <[email protected]>

.github/workflows/ci.yaml

@@ -89,6 +89,7 @@ jobs:
         cp NOTICE "bundle/NOTICE"
         cp VERSION "bundle/VERSION"
         cp config/carvel/bundle.yaml "bundle/bundle.yaml"
+        cp config/carvel/bundle.yaml "bundle/openshift.yaml"
         cp -r samples "bundle/samples"
 
         echo "##[group]Build Service Bindings"

config/carvel/openshift.yaml

@@ -0,0 +1,83 @@
+#@ load("@ytt:data", "data")
+
+#@  kubernetes_distribution = ""
+#@  if hasattr(data.values, 'kubernetes_distribution'):
+#@    kubernetes_distribution = data.values.kubernetes_distribution
+#@  end
+#@  if hasattr(data.values, 'shared') and hasattr(data.values.shared, 'kubernetes_distribution'):
+#@    kubernetes_distribution = data.values.shared.kubernetes_distribution
+#@  end
+
+#@  if kubernetes_distribution == "openshift":
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: service-binding-nonroot-scc
+  namespace: service-bindings
+rules:
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - service-binding-scc
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: service-binding-nonroot-scc
+  namespace: service-bindings
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: service-binding-nonroot-scc
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: system:serviceaccounts:service-bindings
+---
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: false
+allowPrivilegedContainer: false
+allowedCapabilities: null
+apiVersion: security.openshift.io/v1
+defaultAddCapabilities: null
+fsGroup:
+  type: MustRunAs
+groups: []
+kind: SecurityContextConstraints
+metadata:
+  name: service-binding-scc
+priority: null
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+- ALL
+runAsUser:
+  type: MustRunAsNonRoot
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+seccompProfiles:
+- runtime/default
+users: []
+volumes:
+- configMap
+- csi
+- downwardAPI
+- emptyDir
+- ephemeral
+- persistentVolumeClaim
+- projected
+- secret
+#@  end

config/carvel/package-install.values.yaml

@@ -13,3 +13,5 @@ service_account_name: service-binding-kc
 cluster_role_name: service-binding-kc
 cluster_role_binding_name: service-binding-kc
 sync_period: 10m
+shared:
+  kubernetes_distribution: null

config/carvel/package-install.yaml

@@ -2,6 +2,25 @@
 #! SPDX-License-Identifier: Apache-2.0
 
 #@ load("@ytt:data", "data")
+#@ load("@ytt:base64", "base64")
+#@ load("@ytt:yaml", "yaml")
+
+#@ def collect_values():
+#@  values = {}
+#@  if hasattr(data.values, "shared"):
+#@    values["shared"] = data.values.shared
+#@  end
+#@  return values
+#@ end
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: service-bindings-values
+  namespace: #@ data.values.namespace
+stringData:
+  values.yaml: #@ yaml.encode(collect_values())
 
 ---
 apiVersion: packaging.carvel.dev/v1alpha1
@@ -22,6 +41,10 @@ spec:
       #@ if data.values.package_prerelease != None:
       prereleases: #@ data.values.package_prerelease
       #@ end
+  values:
+  - secretRef:
+      name: service-bindings-values
+
 
 ---
 apiVersion: kapp.k14s.io/v1alpha1

config/carvel/package.yaml

@@ -25,5 +25,6 @@ spec:
           paths:
           - "-"
           - bundle.yaml
+          - openshift.yaml
       deploy:
       - kapp: {}