Hide Forgot
Description of problem: The current SCC allows the following volumes: restricted SCC: volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClaim - secret hostmount-anyuid SCC: - configMap - downwardAPI - emptyDir - hostPath - nfs - persistentVolumeClaim - secret A pod can mount a volume with persistentVolumeClaim or using a volume specification. If a pod specifies a volume directly in its spec.volumes, it can not be created unless the volume type is added to our SCC. Version-Release number of selected component (if applicable): openshift v3.2.0.16 kubernetes v1.2.0-36-g4a3f9c5 etcd 2.2.5 How reproducible: Always Steps to Reproduce: 1. oc create -f https://raw.githubusercontent.com/jhou1/docker-iscsi/master/pod.json Actual results: Error from server: error when creating "https://raw.githubusercontent.com/jhou1/docker-iscsi/master/pod.json": pods "iscsi" is forbidden: unable to validate against any security context constraint: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed spec.containers[0].securityContext.volumes[0]: Invalid value: "iscsi": iscsi volumes are not allowed to be used spec.containers[0].securityContext.volumes[0]: Invalid value: "iscsi": iscsi volumes are not allowed to be used] Expected results: Should not see the iscsi volume security context constraint issue Additional info:
That is working as designed. Only the 'privileged' SCC has access to iscsi volumes by default, so by default, only users/groups that have access to the 'privileged' SCC can create pods with iscsi volumes. To allow other users to do this, either add them to the privileged SCC, or create a new SCC that allows the desired volume types, and add the user to that SCC.