From 227d6ee06b2ae3e7a7054d1a4e1f6698a12db20f Mon Sep 17 00:00:00 2001
From: Travis Nielsen <tnielsen@redhat.com>
Date: Mon, 18 Aug 2025 15:02:53 -0600
Subject: [PATCH] helm: enable host network for openshift if needed

The securityContextConstraints require setting whether
host networking and host port access is needed by the
ceph cluster service accounts. The helm chart now allows
enabling this mode with the settings:
rook-ceph chart: useOperatorHostNetwork: true
rook-ceph-cluster chart: cephClusterSpec.network.provider: host

Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 82262a84724e96c6112d9c3c8902fdba5afadb25)
---
 .../templates/securityContextConstraints.yaml              | 7 +++++--
 .../rook-ceph/templates/securityContextConstraints.yaml    | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml
index 82a0bc363..016546f8b 100644
--- a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml
+++ b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml
@@ -8,10 +8,13 @@ metadata:
 allowPrivilegedContainer: true
 allowHostDirVolumePlugin: true
 allowHostPID: false
-# set to true if running rook with host networking enabled
+{{- if eq .Values.cephClusterSpec.network.provider "host" }}
+allowHostNetwork: true
+allowHostPorts: true
+{{- else }}
 allowHostNetwork: false
-# set to true if running rook with the provider as host
 allowHostPorts: false
+{{- end }}
 priority:
 allowedCapabilities: ["MKNOD"]
 allowHostIPC: true
diff --git a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml
index 44451e851..fc107669e 100644
--- a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml
+++ b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml
@@ -8,10 +8,13 @@ metadata:
 allowPrivilegedContainer: true
 allowHostDirVolumePlugin: true
 allowHostPID: false
-# set to true if running rook with host networking enabled
+{{- if .Values.useOperatorHostNetwork }}
+allowHostNetwork: true
+allowHostPorts: true
+{{- else }}
 allowHostNetwork: false
-# set to true if running rook with the provider as host
 allowHostPorts: false
+{{- end }}
 priority:
 allowedCapabilities: ["MKNOD"]
 allowHostIPC: true