Merge pull request #484 from kubescape/openshift-scc-support

Assign appropriate SCC RoleBindings for Kubescape components:

charts/kubescape-operator/templates/gateway/deployment.yaml

@@ -170,6 +170,7 @@ spec:
 {{ toYaml .Values.gateway.volumes | indent 8 }}
 {{- end }}
       automountServiceAccountToken: false
+      serviceAccountName: {{ .Values.gateway.name }}
       nodeSelector:
       {{- if .Values.gateway.nodeSelector }}
       {{- toYaml .Values.gateway.nodeSelector | nindent 8 }}

charts/kubescape-operator/templates/gateway/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.gateway.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.gateway.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.gateway.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/gateway/serviceaccount.yaml

@@ -0,0 +1,10 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if $components.gateway.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.gateway.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:
+    kubescape.io/ignore: "true"
+{{- end }}

charts/kubescape-operator/templates/kollector/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.kollector.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.kollector.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.kollector.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/kubescape/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.kubescape.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.kubescape.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.kubescape.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/kubevuln/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.kubevuln.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.kubevuln.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.kubevuln.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/node-agent/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.nodeAgent.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.nodeAgent.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:privileged
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.nodeAgent.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/operator/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.operator.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.operator.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.operator.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/otel-collector/deployment.yaml

@@ -117,7 +117,7 @@ spec:
 {{- if .Values.otelCollector.volumes }}
 {{ toYaml .Values.otelCollector.volumes | indent 6 }}
 {{- end }}
-      serviceAccountName: default
+      serviceAccountName: {{ .Values.otelCollector.name }}
       nodeSelector:
       {{- if .Values.otelCollector.nodeSelector }}
       {{- toYaml .Values.otelCollector.nodeSelector | nindent 8 }}

charts/kubescape-operator/templates/otel-collector/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.otelCollector.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.otelCollector.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.otelCollector.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/otel-collector/serviceaccount.yaml

@@ -0,0 +1,10 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if $components.otelCollector.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.otelCollector.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:
+    kubescape.io/ignore: "true"
+{{- end }}

charts/kubescape-operator/templates/servicediscovery/rolebinding.yaml

@@ -4,6 +4,7 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ .Values.serviceDiscovery.name }}
+  namespace: {{ .Values.ksNamespace }}
   annotations:
     "helm.sh/hook": pre-install,pre-upgrade
     "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded

charts/kubescape-operator/templates/storage/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.storage.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.storage.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.storage.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}

charts/kubescape-operator/templates/synchronizer/scc-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- $components := fromYaml (include "components" .) }}
+{{- if and $components.synchronizer.enabled .Values.global.openshift.scc.enabled }}
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ printf "%s-scc" .Values.synchronizer.name }}
+  namespace: {{ .Values.ksNamespace }}
+  labels:    
+    kubescape.io/ignore: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+- kind: ServiceAccount
+  name: {{ .Values.synchronizer.name }}
+  namespace: {{ .Values.ksNamespace }}
+{{ end }}