From 026a7d074ba11d242f894b338cec0ca3e9d65a1a Mon Sep 17 00:00:00 2001
From: Travis Nielsen <tnielsen@redhat.com>
Date: Mon, 18 Aug 2025 15:02:53 -0600
Subject: [PATCH] helm: enable host network for openshift if needed

The securityContextConstraints require setting whether
host networking and host port access is needed by the
ceph cluster service accounts. The helm chart now allows
enabling this mode with the settings:
rook-ceph chart: useOperatorHostNetwork: true
rook-ceph-cluster chart: cephClusterSpec.network.provider: host

Signed-off-by: Travis Nielsen <tnielsen@redhat.com>
(cherry picked from commit 82262a84724e96c6112d9c3c8902fdba5afadb25)
---
 .../templates/securityContextConstraints.yaml              | 7 +++++--
 .../rook-ceph/templates/securityContextConstraints.yaml    | 7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml
index 82a0bc363..016546f8b 100644
--- a/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml
+++ b/deploy/charts/rook-ceph-cluster/templates/securityContextConstraints.yaml
@@ -8,10 +8,13 @@ metadata:
 allowPrivilegedContainer: true
 allowHostDirVolumePlugin: true
 allowHostPID: false
-# set to true if running rook with host networking enabled
+{{- if eq .Values.cephClusterSpec.network.provider "host" }}
+allowHostNetwork: true
+allowHostPorts: true
+{{- else }}
 allowHostNetwork: false
-# set to true if running rook with the provider as host
 allowHostPorts: false
+{{- end }}
 priority:
 allowedCapabilities: ["MKNOD"]
 allowHostIPC: true
diff --git a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml
index e84ce8934..b4b6cc5fb 100644
--- a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml
+++ b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml
@@ -8,10 +8,13 @@ metadata:
 allowPrivilegedContainer: true
 allowHostDirVolumePlugin: true
 allowHostPID: false
-# set to true if running rook with host networking enabled
+{{- if .Values.useOperatorHostNetwork }}
+allowHostNetwork: true
+allowHostPorts: true
+{{- else }}
 allowHostNetwork: false
-# set to true if running rook with the provider as host
 allowHostPorts: false
+{{- end }}
 priority:
 allowedCapabilities: ["MKNOD"]
 allowHostIPC: true