Merge pull request #17503 from OdedViner/test_nvme_ocp

nvmeof: add sys_admin to scc allowedcapabilities for gateway pods

deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml

@@ -17,7 +17,7 @@ allowHostNetwork: false
 allowHostPorts: false
 {{- end }}
 priority:
-allowedCapabilities: ["MKNOD"]
+allowedCapabilities: ["MKNOD", "SYS_ADMIN"]
 allowHostIPC: true
 readOnlyRootFilesystem: false
 # drop all default privileges

deploy/charts/rook-ceph/templates/securityContextConstraints.yaml

@@ -19,7 +19,7 @@ allowHostNetwork: false
 allowHostPorts: false
 {{- end }}
 priority:
-allowedCapabilities: ["MKNOD"]
+allowedCapabilities: ["MKNOD", "SYS_ADMIN"]
 allowHostIPC: true
 readOnlyRootFilesystem: false
 # drop all default privileges

pkg/apis/ceph.rook.io/v1/scc.go

@@ -41,7 +41,7 @@ func NewSecurityContextConstraints(name string, namespaces ...string) *secv1.Sec
 		AllowHostIPC:             true,
 		AllowHostNetwork:         false,
 		AllowHostPorts:           false,
-		AllowedCapabilities:      []corev1.Capability{"MKNOD"},
+		AllowedCapabilities:      []corev1.Capability{"MKNOD", "SYS_ADMIN"},
 		RequiredDropCapabilities: []corev1.Capability{"ALL"},
 		DefaultAddCapabilities:   []corev1.Capability{},
 		RunAsUser: secv1.RunAsUserStrategyOptions{