| restricted | anyuid | privileged |
|---|---|---|
| allowHostDirVolumePlugin: false | allowHostDirVolumePlugin: false | allowHostDirVolumePlugin: true |
| allowHostIPC: false | allowHostIPC: false | allowHostIPC: true |
| allowHostNetwork: false | allowHostNetwork: false | allowHostNetwork: true |
| allowHostPID: false | allowHostPID: false | allowHostPID: true |
| allowHostPorts: false | allowHostPorts: false | allowHostPorts: true |
| allowPrivilegeEscalation: true | allowPrivilegeEscalation: true | allowPrivilegeEscalation: true |
| allowPrivilegedContainer: false | allowPrivilegedContainer: false | allowPrivilegedContainer: true |
| allowedCapabilities: null | allowedCapabilities: [ | allowedCapabilities: \* |
| NET_RAW | ||
| FSETID | ||
| SETGID | ||
| SETUID | ||
| CHOWN | ||
| SYS_CHROOT] | ||
| allowedUnsafeSysctls: | allowedUnsafeSysctls: \* | |
| apiVersion: security.openshift.io/v1 | apiVersion: security.openshift.io/v1 | apiVersion: security.openshift.io/v1 |
| defaultAddCapabilities: null | defaultAddCapabilities: null | defaultAddCapabilities: null |
| fsGroup: | fsGroup: RunAsAny | fsGroup: RunAsAny |
| groups: \[\] | groups: system:cluster-admins | groups: system:cluster-admins, system:nodes, system:masters |
| kind: SecurityContextConstraints | kind: SecurityContextConstraints | kind: SecurityContextConstraints |
| name: restricted | name: anyuid | name: privileged |
| resourceVersion: "3512475209" | resourceVersion: "3512475203" | resourceVersion: "340" |
| uid: bdb21b4f-dfda-456a-8aa3-7fdcd8ee2f2d | uid: d35f70ed-47ce-4b22-83d0-b0b2a4bc07f8 | uid: 1df9ef3c-1fab-4031-a2cd-3d7479069050 |
| priority: null | priority: 10 | priority: null |
| readOnlyRootFilesystem: false | readOnlyRootFilesystem: false | readOnlyRootFilesystem: false |
| requiredDropCapabilities: KILL, MKNOD, SETUID, SETGID | requiredDropCapabilities: MKNOD | requiredDropCapabilities: null |
| runAsUser: | runAsUser: RunAsAny | runAsUser: RunAsAny |
| seLinuxContext: | seLinuxContext: MustRunAs | seLinuxContext: RunAsAny |
| supplementalGroups: RunAsAny | supplementalGroups: RunAsAny | supplementalGroups: RunAsAny |
| users: \[\] | users: \[\] | users: system:admin, system:serviceaccount:openshift-infra:build-controller |
| volumes: configMap, csi, downwardAPI, emptyDir, ephemeral, persistentVolumeClaim, projected, secret | volumes: configMap, csi, downwardAPI, emptyDir, ephemeral, persistentVolumeClaim, projected, secret | volumes: \* |
【k8s】scc权限 restricted、anyuid、privileged
云川之下2025-01-10 11:16
相关推荐
GuWenyue3 小时前
传统Agent工具两大痛点！300行代码落地MCP跨语言工具，彻底解耦LLM与工具我叫洋洋4 小时前
C ++ [ hello world ]奋发向前wcx5 小时前
y1,y2总复习笔记5 2026.7.19战族狼魂8 小时前
高频面试题精选：分治与AI Agent架构李剑一9 小时前
你用过网易的将军令嘛？它底层实现账号保护的原理相当简单粗暴Scott9999HH9 小时前
告别流量波动玄学！从法拉第电磁定律到底层 C/C++ 流量累积算法，深度解密工业级电磁流量计选型与开发中达瑞和-高光谱·多光谱9 小时前
1nm到8nm光谱分辨率，你的应用该选哪款光谱相机？香辣牛肉饭10 小时前
【算法】动态规划 最长公共子序列（LCS）旖-旎11 小时前
LeetCode 279：完全平方数（完全背包）—— 题解