From 7f3e2ace277deed173d939700ea86a083dbdb00d Mon Sep 17 00:00:00 2001 From: Oded Viner Date: Mon, 27 Apr 2026 16:28:15 +0300 Subject: [PATCH] security: grant scc to rook-ceph-nvmeof service account the rook-ceph-nvmeof service account is not listed in the securitycontextconstraints users, causing cephnvmeofgateway pods to fail on openshift. add the service account to the scc in the helm charts, go scc builder, and test namespace substitution. Signed-off-by: Oded Viner --- .../rook-ceph-cluster/templates/securityContextConstraints.yaml | 1 + .../charts/rook-ceph/templates/securityContextConstraints.yaml | 1 + pkg/apis/ceph.rook.io/v1/scc.go | 1 + tests/framework/installer/ceph_settings.go | 1 + 4 files changed, 4 insertions(+) diff --git a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml index 841707c68..44f84af38 100644 --- a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml +++ b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml @@ -45,4 +45,5 @@ users: - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-mgr - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-osd - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-rgw + - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-nvmeof {{- end }} diff --git a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml index 2dc53b70d..207401b3f 100644 --- a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml +++ b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml @@ -48,6 +48,7 @@ users: - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-mgr - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-osd - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-rgw + - system:serviceaccount:{{ .Release.Namespace }}:rook-ceph-nvmeof --- # scc for the CSI driver kind: SecurityContextConstraints diff --git a/pkg/apis/ceph.rook.io/v1/scc.go b/pkg/apis/ceph.rook.io/v1/scc.go index 8a76c1566..736e5b76b 100644 --- a/pkg/apis/ceph.rook.io/v1/scc.go +++ b/pkg/apis/ceph.rook.io/v1/scc.go @@ -73,6 +73,7 @@ func NewSecurityContextConstraints(name string, namespaces ...string) *secv1.Sec fmt.Sprintf("system:serviceaccount:%s:rook-ceph-mgr", ns), fmt.Sprintf("system:serviceaccount:%s:rook-ceph-osd", ns), fmt.Sprintf("system:serviceaccount:%s:rook-ceph-rgw", ns), + fmt.Sprintf("system:serviceaccount:%s:rook-ceph-nvmeof", ns), }...) } return diff --git a/tests/framework/installer/ceph_settings.go b/tests/framework/installer/ceph_settings.go index 4554eb05c..a5f241898 100644 --- a/tests/framework/installer/ceph_settings.go +++ b/tests/framework/installer/ceph_settings.go @@ -119,6 +119,7 @@ func replaceNamespaces(name, manifest, operatorNamespace, clusterNamespace strin manifest = strings.ReplaceAll(manifest, "rook-ceph:rook-ceph-mgr # serviceaccount:namespace:cluster", clusterNamespace+":rook-ceph-mgr") manifest = strings.ReplaceAll(manifest, "rook-ceph:rook-ceph-osd # serviceaccount:namespace:cluster", clusterNamespace+":rook-ceph-osd") manifest = strings.ReplaceAll(manifest, "rook-ceph:rook-ceph-rgw # serviceaccount:namespace:cluster", clusterNamespace+":rook-ceph-rgw") + manifest = strings.ReplaceAll(manifest, "rook-ceph:rook-ceph-nvmeof # serviceaccount:namespace:cluster", clusterNamespace+":rook-ceph-nvmeof") // SCC namespaces for CSI driver manifest = strings.ReplaceAll(manifest, "rook-ceph:rook-csi-rbd-plugin-sa # serviceaccount:namespace:operator", operatorNamespace+":rook-csi-rbd-plugin-sa")