Bug 1328026

Summary:	SCC prevents the creation of pods which have their own mount volumes instead of persistentVolumeClaim
Product:	OpenShift Container Platform	Reporter:	Jianwei Hou <jhou>
Component:	apiserver-auth	Assignee:	Jordan Liggitt <jliggitt>
Status:	CLOSED NOTABUG	QA Contact:	weiwei jiang <wjiang>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.2.0	CC:	aos-bugs, pweil, wsun
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-04-18 14:17:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Jianwei Hou 2016-04-18 09:06:31 UTC

Description of problem:
The current SCC allows the following volumes:

restricted SCC:
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- secret

hostmount-anyuid SCC:
- configMap
- downwardAPI
- emptyDir
- hostPath
- nfs
- persistentVolumeClaim
- secret

A pod can mount a volume with persistentVolumeClaim or using a volume specification. If a pod specifies a volume directly in its spec.volumes, it can not be created unless the volume type is added to our SCC.

Version-Release number of selected component (if applicable):
openshift v3.2.0.16
kubernetes v1.2.0-36-g4a3f9c5
etcd 2.2.5

How reproducible:
Always

Steps to Reproduce:
1.  oc create -f https://raw.githubusercontent.com/jhou1/docker-iscsi/master/pod.json

Actual results:
Error from server: error when creating "https://raw.githubusercontent.com/jhou1/docker-iscsi/master/pod.json": pods "iscsi" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[0].securityContext.volumes[0]: Invalid value: "iscsi": iscsi volumes are not allowed to be used spec.containers[0].securityContext.volumes[0]: Invalid value: "iscsi": iscsi volumes are not allowed to be used]

Expected results:
Should not see the iscsi volume security context constraint issue

Additional info:

Comment 1 Jordan Liggitt 2016-04-18 14:17:12 UTC

That is working as designed. Only the 'privileged' SCC has access to iscsi volumes by default, so by default, only users/groups that have access to the 'privileged' SCC can create pods with iscsi volumes.

To allow other users to do this, either add them to the privileged SCC, or create a new SCC that allows the desired volume types, and add the user to that SCC.