From 86afa591ba310d2e3da93d1376c804e1a4f08dbc Mon Sep 17 00:00:00 2001
From: Nitin Goyal <nigoyal@redhat.com>
Date: Thu, 12 Oct 2023 18:08:51 +0530
Subject: [PATCH] security: enhance SCC Function to Support Multiple Namespaces

Currently, the function receives a single namespace string and appends
it to the users. This approach is insufficient when dealing with
multiple CephClusters running in different namespaces, as there will be
only one SCC. This update modifies the function to create users for all
specified namespaces, ensuring compatibility with multiple namespaces.

Signed-off-by: Nitin Goyal <nigoyal@redhat.com>
---
 pkg/apis/ceph.rook.io/v1/scc.go | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/pkg/apis/ceph.rook.io/v1/scc.go b/pkg/apis/ceph.rook.io/v1/scc.go
index 6610da8e5..8db6efb74 100644
--- a/pkg/apis/ceph.rook.io/v1/scc.go
+++ b/pkg/apis/ceph.rook.io/v1/scc.go
@@ -26,15 +26,14 @@ import (
 
 // NewSecurityContextConstraints returns a new SecurityContextConstraints for Rook-Ceph to run on
 // OpenShift.
-func NewSecurityContextConstraints(name, namespace string) *secv1.SecurityContextConstraints {
+func NewSecurityContextConstraints(name string, namespaces ...string) *secv1.SecurityContextConstraints {
 	return &secv1.SecurityContextConstraints{
 		TypeMeta: metav1.TypeMeta{
 			APIVersion: "security.openshift.io/v1",
 			Kind:       "SecurityContextConstraints",
 		},
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: namespace,
+			Name: name,
 		},
 		AllowPrivilegedContainer: true,
 		AllowHostDirVolumePlugin: true,
@@ -66,12 +65,17 @@ func NewSecurityContextConstraints(name, namespace string) *secv1.SecurityContex
 			secv1.FSProjected,
 			secv1.FSTypeSecret,
 		},
-		Users: []string{
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-system", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:default", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-mgr", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-osd", namespace),
-			fmt.Sprintf("system:serviceaccount:%s:rook-ceph-rgw", namespace),
-		},
+		Users: func() (users []string) {
+			for _, ns := range namespaces {
+				users = append(users, []string{
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-system", ns),
+					fmt.Sprintf("system:serviceaccount:%s:default", ns),
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-mgr", ns),
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-osd", ns),
+					fmt.Sprintf("system:serviceaccount:%s:rook-ceph-rgw", ns),
+				}...)
+			}
+			return
+		}(),
 	}
 }