【k8s】scc权限 restricted、anyuid、privileged

云川之下2025-01-10 11:16

restricted	anyuid	privileged
allowHostDirVolumePlugin: false	allowHostDirVolumePlugin: false	allowHostDirVolumePlugin: true
allowHostIPC: false	allowHostIPC: false	allowHostIPC: true
allowHostNetwork: false	allowHostNetwork: false	allowHostNetwork: true
allowHostPID: false	allowHostPID: false	allowHostPID: true
allowHostPorts: false	allowHostPorts: false	allowHostPorts: true
allowPrivilegeEscalation: true	allowPrivilegeEscalation: true	allowPrivilegeEscalation: true
allowPrivilegedContainer: false	allowPrivilegedContainer: false	allowPrivilegedContainer: true
allowedCapabilities: null	allowedCapabilities: [	allowedCapabilities: $\*$
	NET_RAW
	FSETID
	SETGID
	SETUID
	CHOWN
	SYS_CHROOT]
allowedUnsafeSysctls:		allowedUnsafeSysctls: $\*$
apiVersion: security.openshift.io/v1	apiVersion: security.openshift.io/v1	apiVersion: security.openshift.io/v1
defaultAddCapabilities: null	defaultAddCapabilities: null	defaultAddCapabilities: null
fsGroup:	fsGroup: RunAsAny	fsGroup: RunAsAny
groups: \[\]	groups: $system:cluster-admins$	groups: $system:cluster-admins, system:nodes, system:masters$
kind: SecurityContextConstraints	kind: SecurityContextConstraints	kind: SecurityContextConstraints
name: restricted	name: anyuid	name: privileged
resourceVersion: "3512475209"	resourceVersion: "3512475203"	resourceVersion: "340"
uid: bdb21b4f-dfda-456a-8aa3-7fdcd8ee2f2d	uid: d35f70ed-47ce-4b22-83d0-b0b2a4bc07f8	uid: 1df9ef3c-1fab-4031-a2cd-3d7479069050
priority: null	priority: 10	priority: null
readOnlyRootFilesystem: false	readOnlyRootFilesystem: false	readOnlyRootFilesystem: false
requiredDropCapabilities: $KILL, MKNOD, SETUID, SETGID$	requiredDropCapabilities: $MKNOD$	requiredDropCapabilities: null
runAsUser:	runAsUser: RunAsAny	runAsUser: RunAsAny
seLinuxContext:	seLinuxContext: MustRunAs	seLinuxContext: RunAsAny
supplementalGroups: RunAsAny	supplementalGroups: RunAsAny	supplementalGroups: RunAsAny
users: \[\]	users: \[\]	users: $system:admin, system:serviceaccount:openshift-infra:build-controller$
volumes: $configMap, csi, downwardAPI, emptyDir, ephemeral, persistentVolumeClaim, projected, secret$	volumes: $configMap, csi, downwardAPI, emptyDir, ephemeral, persistentVolumeClaim, projected, secret$	volumes: $\*$