Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CSPL-3149 - Address openshift documentation #1403

Merged
merged 2 commits into from
Nov 20, 2024
Merged

CSPL-3149 - Address openshift documentation #1403

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
977bd78
Address openshift documentation
akondur Nov 20, 2024
da70078
Use block
akondur Nov 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions docs/OpenShift.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,10 @@

The Splunk Operator will always start Splunk Enterprise containers using
a specific, unprivileged `splunk(41812)` user and group to allow write access
to Kubernetes PersistentVolumes. This follows best security practices,
which helps prevent any malicious actor from escalating access outside of the
container and compromising the host. For more information, please see the
Splunk Enterprise container's
[Documentation on Security](https://github.com/splunk/docker-splunk/blob/develop/docs/SECURITY.md).
to Kubernetes PersistentVolumes. This follows best security practices, helping
prevent malicious actors from escalating access beyond the container and
compromising the host. For more information, please see the Splunk Enterprise
container's [Documentation on Security](https://github.com/splunk/docker-splunk/blob/develop/docs/SECURITY.md).

The Splunk Enterprise pods are attached to the `default` serviceaccount or the configured
[serviceaccount](CustomResources.md#common-spec-parameters-for-splunk-enterprise-resources) if
Expand All @@ -16,7 +15,8 @@ and runs as user `1001`.
Users of Red Hat OpenShift may find that the default Security Context
Constraint is too restrictive. You can fix this by granting the appropriate
Service Accounts the `nonroot` Security Context Constraint by running the
following commands within your namespace:
following commands within your namespace. If you are using OpenShift 4.14
or later, you must use the `nonroot-v2` Security Context Constraint instead.

For the Splunk Operator pod:
```
Expand Down
Loading