custom-scc

helm-chart/templates/14-kubeshark-scc.yaml

@@ -0,0 +1,50 @@
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  labels:
+    {{- include "kubeshark.labels" . | nindent 4 }}
+  annotations:
+  {{- if .Values.tap.annotations }}
+    {{- toYaml .Values.tap.annotations | nindent 4 }}
+  {{- end }}
+  name: kubeshark-scc
+priority: 10
+allowPrivilegedContainer: true
+allowHostDirVolumePlugin: true
+allowHostNetwork: true
+allowHostPorts: true
+allowHostPID: true
+allowHostIPC: true
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+  - MKNOD
+allowedCapabilities:
+  - NET_RAW
+  - NET_ADMIN
+  - SYS_ADMIN
+  - SYS_PTRACE
+  - DAC_OVERRIDE
+  - SYS_RESOURCE
+  - CHECKPOINT_RESTORE
+  - SYS_MODULE
+runAsUser:
+  type: RunAsAny
+fsGroup:
+  type: MustRunAs
+seLinuxContext:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+seccompProfiles:
+- '*'
+volumes:
+  - configMap
+  - downwardAPI
+  - emptyDir
+  - persistentVolumeClaim
+  - secret
+  - hostPath
+  - projected
+  - ephemeral
+users:
+  - system:serviceaccount:{{ .Release.Namespace }}:kubeshark-service-account

helm-chart/templates/14-route.yaml

@@ -1,23 +0,0 @@
-apiVersion: route.openshift.io/v1
-kind: Route
-metadata:
-  annotations:
-    {{- if .Values.tap.annotations }}
-    {{- toYaml .Values.tap.annotations | nindent 4 }}
-    {{- end }}
-  labels:
-    {{- include "kubeshark.labels" . | nindent 4 }}
-  name: kubeshark-route
-  namespace: {{ .Release.Namespace }}
-spec:
-  host: {{ .Values.tap.ingress.host }}
-  to:
-    kind: Service
-    name: kubeshark-front
-  port:
-    targetPort: 80
-  tls:
-    termination: edge
-    {{- if .Values.tap.ingress.tls }}
-    {{- toYaml .Values.tap.ingress.tls | nindent 4 }}
-    {{- end }}