Merge pull request #13041 from iamniting/scc

Enhance SCC Function to Support Multiple Namespaces

pkg/apis/ceph.rook.io/v1/scc.go

@@ -26,15 +26,14 @@ import (
 
 // NewSecurityContextConstraints returns a new SecurityContextConstraints for Rook-Ceph to run on
 // OpenShift.
-func NewSecurityContextConstraints(name, namespace string) *secv1.SecurityContextConstraints {
+func NewSecurityContextConstraints(name string, namespaces ...string) *secv1.SecurityContextConstraints {
 	return &secv1.SecurityContextConstraints{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: "security.openshift.io/v1",
 			Kind:       "SecurityContextConstraints",
 		},
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: namespace,
+			Name: name,
 		},
 		AllowPrivilegedContainer: true,
 		AllowHostDirVolumePlugin: true,
@@ -66,12 +65,17 @@ func NewSecurityContextConstraints(name, namespace string) *secv1.SecurityContex
 			secv1.FSProjected,
 			secv1.FSTypeSecret,
 		},
-		Users: []string{
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-system", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:default", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-mgr", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-osd", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-rgw", namespace),
-		},
+		Users: func() (users []string) {
+			for _, ns := range namespaces {
+				users = append(users, []string{
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-system", ns),
+					fmt.Sprintf("system:serviceaccount:%s:default", ns),
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-mgr", ns),
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-osd", ns),
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-rgw", ns),
+				}...)
+			}
+			return
+		}(),
 	}
 }