From f8c1c99cb405d830995e27acabcf16ed82f658fe Mon Sep 17 00:00:00 2001 From: Oded Viner Date: Mon, 11 May 2026 13:47:12 +0300 Subject: [PATCH] nvmeof: add sys_admin to scc allowedcapabilities for gateway pods the nvmeof gateway requires privileged containers with sys_admin capability. the rook-ceph scc only allowed mknod, causing pod creation to fail on openshift with: "unable to validate against any security context constraint" add sys_admin to allowedcapabilities in the helm chart sccs and the go scc helper. this does not affect other daemons (osd, rgw, mgr, mon) since they do not request sys_admin. the operator-openshift.yaml example already includes sys_admin, so this aligns the helm charts to match. Signed-off-by: Oded Viner --- .../rook-ceph-cluster/templates/securityContextConstraints.yaml | 2 +- .../charts/rook-ceph/templates/securityContextConstraints.yaml | 2 +- pkg/apis/ceph.rook.io/v1/scc.go | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml index 44f84af38..cf4ab6ddc 100644 --- a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml +++ b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml @@ -17,7 +17,7 @@ allowHostNetwork: false allowHostPorts: false {{- end }} priority: -allowedCapabilities: ["MKNOD"] +allowedCapabilities: ["MKNOD", "SYS_ADMIN"] allowHostIPC: true readOnlyRootFilesystem: false # drop all default privileges diff --git a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml index bf74f5e08..edc5b2999 100644 --- a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml +++ b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml @@ -19,7 +19,7 @@ allowHostNetwork: false allowHostPorts: false {{- end }} priority: -allowedCapabilities: ["MKNOD"] +allowedCapabilities: ["MKNOD", "SYS_ADMIN"] allowHostIPC: true readOnlyRootFilesystem: false # drop all default privileges diff --git a/pkg/apis/ceph.rook.io/v1/scc.go b/pkg/apis/ceph.rook.io/v1/scc.go index 736e5b76b..452514bdb 100644 --- a/pkg/apis/ceph.rook.io/v1/scc.go +++ b/pkg/apis/ceph.rook.io/v1/scc.go @@ -41,7 +41,7 @@ func NewSecurityContextConstraints(name string, namespaces ...string) *secv1.Sec AllowHostIPC: true, AllowHostNetwork: false, AllowHostPorts: false, - AllowedCapabilities: []corev1.Capability{"MKNOD"}, + AllowedCapabilities: []corev1.Capability{"MKNOD", "SYS_ADMIN"}, RequiredDropCapabilities: []corev1.Capability{"ALL"}, DefaultAddCapabilities: []corev1.Capability{}, RunAsUser: secv1.RunAsUserStrategyOptions{