Skip to content

Commit df48505

Browse files
itsomriitsomri
authored
Fix SCC for OCP v0.9 (#562)
* Added scc for kai deployments
1 parent 281f426 commit df48505

File tree

5 files changed

+169
-1
lines changed

5 files changed

+169
-1
lines changed

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
66

77
## [Unreleased]
88

9+
## [v0.9.5] - 20250-10-09
10+
11+
### Added
12+
- Support DRA in kubernetes 1.34
13+
914
### Fixed
1015
- Fixed a bug where the scheduler would not re-try updating podgroup status after failure
16+
- Added missing SCC for Openshift installations
1117

1218
## [v0.9.1] - 20250-09-15
1319

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ $(SERVICE_NAMES):
3333
$(MAKE) build-go SERVICE_NAME=$@
3434
$(MAKE) docker-build-generic SERVICE_NAME=$@
3535

36+
.PHONY: push
37+
push: $(SERVICE_NAMES)
38+
docker push $(DOCKER_REPO_BASE)/crd-upgrader:$(VERSION)
39+
3640
.PHONY: validate
3741
validate: generate manifests clients gen-license generate-mocks lint
3842
git diff --exit-code

‎deployments/kai-scheduler/templates/crd-upgrader.yaml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,35 @@ metadata:
1212
"helm.sh/hook-delete-policy": hook-succeeded
1313
spec:
1414
template:
15+
metadata:
16+
{{- if (lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "clusterversions.config.openshift.io") }}
17+
annotations:
18+
openshift.io/scc: kai-system
19+
{{- else }}
20+
labels:
21+
app: crd-upgrader
22+
{{- end }}
1523
spec:
1624
serviceAccountName: kai-scheduler-crd-manager
25+
{{- if (lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "clusterversions.config.openshift.io") }}
26+
securityContext:
27+
runAsUser: 10000
28+
runAsNonRoot: true
29+
fsGroup: 10000
30+
{{- end }}
1731
containers:
1832
- name: upgrader
1933
image: "{{ .Values.global.registry }}/{{ .Values.crdupgrader.image.name }}:{{ .Chart.Version }}"
2034
imagePullPolicy: {{ .Values.crdupgrader.image.pullPolicy }}
21-
{{- if .Values.global.securityContext }}
35+
{{- if (lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "clusterversions.config.openshift.io") }}
36+
securityContext:
37+
runAsUser: 10000
38+
runAsNonRoot: true
39+
allowPrivilegeEscalation: false
40+
capabilities:
41+
drop:
42+
- ALL
43+
{{- else if .Values.global.securityContext }}
2244
securityContext:
2345
{{- toYaml .Values.global.securityContext | nindent 10 }}
2446
{{- end }}

‎deployments/kai-scheduler/templates/kai-config.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ kind: Config
66
metadata:
77
name: kai-config
88
namespace: {{ .Release.Namespace }}
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade
11+
"helm.sh/hook-weight": "3"
912
spec:
1013
namespace: {{ .Release.Namespace }}
1114
global:

‎deployments/kai-scheduler/templates/rbac/scc.yaml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Copyright 2025 NVIDIA CORPORATION
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
{{- if (lookup "apiextensions.k8s.io/v1" "CustomResourceDefinition" "" "clusterversions.config.openshift.io") }}
5+
kind: SecurityContextConstraints
6+
apiVersion: security.openshift.io/v1
7+
metadata:
8+
name: kai-system
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade
11+
"helm.sh/hook-weight": "-1"
12+
"helm.sh/hook-delete-policy": before-hook-creation
13+
allowHostDirVolumePlugin: false
14+
allowHostIPC: false
15+
allowHostNetwork: false
16+
allowHostPID: false
17+
allowHostPorts: false
18+
allowPrivilegeEscalation: true
19+
allowPrivilegedContainer: false
20+
allowedCapabilities: null
21+
defaultAddCapabilities: null
22+
fsGroup:
23+
type: RunAsAny
24+
groups: []
25+
priority: 1
26+
readOnlyRootFilesystem: false
27+
requiredDropCapabilities: null
28+
runAsUser:
29+
type: MustRunAs
30+
uid: 10000
31+
seLinuxContext:
32+
type: MustRunAs
33+
supplementalGroups:
34+
type: RunAsAny
35+
users:
36+
- system:serviceaccount:{{ .Release.Namespace }}:admission
37+
- system:serviceaccount:{{ .Release.Namespace }}:binder
38+
- system:serviceaccount:{{ .Release.Namespace }}:kai-operator
39+
- system:serviceaccount:{{ .Release.Namespace }}:pod-grouper
40+
- system:serviceaccount:{{ .Release.Namespace }}:podgroup-controller
41+
- system:serviceaccount:{{ .Release.Namespace }}:queue-controller
42+
- system:serviceaccount:{{ .Release.Namespace }}:scheduler
43+
- system:serviceaccount:{{ .Release.Namespace }}:node-scale-adjuster
44+
- system:serviceaccount:{{ .Release.Namespace }}:kai-scheduler-crd-manager
45+
volumes:
46+
- awsElasticBlockStore
47+
- azureDisk
48+
- azureFile
49+
- cephFS
50+
- cinder
51+
- configMap
52+
- csi
53+
- downwardAPI
54+
- emptyDir
55+
- ephemeral
56+
- fc
57+
- flexVolume
58+
- flocker
59+
- gcePersistentDisk
60+
- gitRepo
61+
- glusterfs
62+
- iscsi
63+
- nfs
64+
- persistentVolumeClaim
65+
- photonPersistentDisk
66+
- portworxVolume
67+
- projected
68+
- quobyte
69+
- rbd
70+
- scaleIO
71+
- secret
72+
- storageOS
73+
- vsphere
74+
---
75+
apiVersion: rbac.authorization.k8s.io/v1
76+
kind: ClusterRole
77+
metadata:
78+
name: kai-system-scc
79+
annotations:
80+
"helm.sh/hook": pre-install,pre-upgrade
81+
"helm.sh/hook-weight": "-1"
82+
"helm.sh/hook-delete-policy": before-hook-creation
83+
rules:
84+
- apiGroups:
85+
- security.openshift.io
86+
resourceNames:
87+
- kai-system
88+
resources:
89+
- securitycontextconstraints
90+
verbs:
91+
- use
92+
---
93+
apiVersion: rbac.authorization.k8s.io/v1
94+
kind: ClusterRoleBinding
95+
metadata:
96+
name: kai-system-scc
97+
annotations:
98+
"helm.sh/hook": pre-install,pre-upgrade
99+
"helm.sh/hook-weight": "-1"
100+
"helm.sh/hook-delete-policy": before-hook-creation
101+
roleRef:
102+
apiGroup: rbac.authorization.k8s.io
103+
kind: ClusterRole
104+
name: kai-system-scc
105+
subjects:
106+
- kind: ServiceAccount
107+
name: admission
108+
namespace: {{ .Release.Namespace }}
109+
- kind: ServiceAccount
110+
name: binder
111+
namespace: {{ .Release.Namespace }}
112+
- kind: ServiceAccount
113+
name: kai-operator
114+
namespace: {{ .Release.Namespace }}
115+
- kind: ServiceAccount
116+
name: pod-grouper
117+
namespace: {{ .Release.Namespace }}
118+
- kind: ServiceAccount
119+
name: podgroup-controller
120+
namespace: {{ .Release.Namespace }}
121+
- kind: ServiceAccount
122+
name: queue-controller
123+
namespace: {{ .Release.Namespace }}
124+
- kind: ServiceAccount
125+
name: scheduler
126+
namespace: {{ .Release.Namespace }}
127+
- kind: ServiceAccount
128+
name: node-scale-adjuster
129+
namespace: {{ .Release.Namespace }}
130+
- kind: ServiceAccount
131+
name: kai-scheduler-crd-manager
132+
namespace: {{ .Release.Namespace }}
133+
{{- end }}

0 commit comments

Comments
 (0)