aqua-scc.yaml

allowHostDirVolumePlugin: true
allowHostIPC: false
allowHostNetwork: false
allowHostPID: true
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities:
  - SYS_ADMIN
  - NET_ADMIN
  - NET_RAW
  - SYS_PTRACE
  - KILL
  - MKNOD
  - SETGID
  - SETUID
  - SYS_MODULE
  - AUDIT_CONTROL
  - SYSLOG
  - SYS_CHROOT
  - SYS_RESOURCE
  - IPC_LOCK
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
groups: []
kind: SecurityContextConstraints
metadata:
  annotations:
    kubernetes.io/description: aqua scc provides all features of the restricted SCC
      but allows users to run with any non-root UID and access hostPath. The user must
      specify the UID or it must be specified on the by the manifest of the container runtime.
    release.openshift.io/create-only: "true"
  name: aqua-scc
priority: null
readOnlyRootFilesystem: false
requiredDropCapabilities: null
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users: []
volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
  - hostPath