apiVersion: v1
items:
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups:
  - system:cluster-admins
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: anyuid provides all features of the restricted SCC
        but allows users to run with any UID and any GID.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2022-02-23T14:35:58Z"
    generation: 1
    name: anyuid
    resourceVersion: "471"
    uid: e76a129d-deb5-4888-b4ba-02389b33caae
  priority: 10
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - MKNOD
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: 'hostaccess allows access to all host namespaces
        but still requires pods to be run with a UID and SELinux context that are
        allocated to the namespace. WARNING: this SCC allows host access to namespaces,
        file systems, and PIDS.  It should only be used by trusted pods.  Grant with
        caution.'
      release.openshift.io/create-only: "true"
    creationTimestamp: "2022-02-23T14:35:59Z"
    generation: 1
    name: hostaccess
    resourceVersion: "472"
    uid: 65f1158e-dada-4aee-b0ff-aaf884fc0133
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - hostPath
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: |-
        hostmount-anyuid provides all the features of the
        restricted SCC but allows host mounts and any UID by a pod.  This is primarily
        used by the persistent volume recycler. WARNING: this SCC allows host file
        system access as any UID, including UID 0.  Grant with caution.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2022-02-23T14:35:59Z"
    generation: 1
    name: hostmount-anyuid
    resourceVersion: "473"
    uid: 8998476b-1f94-49c0-8fa4-4a130a6f49f7
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - MKNOD
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-infra:pv-recycler-controller
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - hostPath
  - nfs
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: hostnetwork allows using host networking and host
        ports but still requires pods to be run with a UID and SELinux context that
        are allocated to the namespace.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2022-02-23T14:35:59Z"
    generation: 1
    name: hostnetwork
    resourceVersion: "474"
    uid: 8109e454-1f80-4dfe-8f3c-87f200f77871
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: MustRunAs
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: true
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_BIND_SERVICE
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: hostnetwork allows using host networking and host
        ports but still requires pods to be run with a UID and SELinux context that
        are allocated to the namespace. On top of the legacy 'hostnetwork' SCC, it
        also requires to drop ALL capabilities and does not allow privilege escalation
        binaries. It will also default the seccomp profile to runtime/default if unset,
        otherwise this seccomp profile is required.
    creationTimestamp: "2022-10-13T22:13:02Z"
    generation: 1
    name: hostnetwork-v2
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      kind: ClusterVersion
      name: version
      uid: 11aa7806-27a6-45c2-8e85-34e8473d716e
    resourceVersion: "187721240"
    uid: 767d4ef1-9602-4b34-8ec4-6cacea6b5645
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: MustRunAs
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  defaultAllowPrivilegeEscalation: false
  forbiddenSysctls:
  - '*'
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    creationTimestamp: "2022-11-04T14:05:07Z"
    generation: 1
    name: log-collector-scc
    resourceVersion: "226805962"
    uid: 5f26a2f9-9963-4069-8f0d-c1d5b730195f
  priority: null
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
  - CHOWN
  - DAC_OVERRIDE
  - FSETID
  - FOWNER
  - SETGID
  - SETUID
  - SETPCAP
  - NET_BIND_SERVICE
  - KILL
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - emptyDir
  - hostPath
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/self-managed-high-availability: "true"
      kubernetes.io/description: machine-api-termination-handler allows the machine-api-termination-handler
        service account to run as root, access host paths and access the host network.
        This SCC is limited and should not be used for any other service.
    creationTimestamp: "2022-02-23T14:37:25Z"
    generation: 1
    name: machine-api-termination-handler
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      kind: ClusterVersion
      name: version
      uid: 11aa7806-27a6-45c2-8e85-34e8473d716e
    resourceVersion: "2467"
    uid: fa49350d-c4f6-48f4-9ac6-684cccc55f46
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: MustRunAs
  users:
  - system:serviceaccount:openshift-machine-api:machine-api-termination-handler
  volumes:
  - downwardAPI
  - hostPath
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      kubernetes.io/description: node-exporter scc is used for the Prometheus node
        exporter
    creationTimestamp: "2022-02-23T14:39:11Z"
    generation: 1
    name: node-exporter
    resourceVersion: "187776315"
    uid: 9399facb-4e10-42c2-a99c-a5b5585c1408
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - '*'
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: nonroot provides all features of the restricted SCC
        but allows users to run with any non-root UID.  The user must specify the
        UID or it must be specified on the by the manifest of the container runtime.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2022-02-23T14:36:00Z"
    generation: 1
    name: nonroot
    resourceVersion: "475"
    uid: d5e2e436-4d9c-443e-afbb-1926c271919d
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsNonRoot
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_BIND_SERVICE
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: nonroot provides all features of the restricted SCC
        but allows users to run with any non-root UID.  The user must specify the
        UID or it must be specified on the by the manifest of the container runtime.
        On top of the legacy 'nonroot' SCC, it also requires to drop ALL capabilities
        and does not allow privilege escalation binaries. It will also default the
        seccomp profile to runtime/default if unset, otherwise this seccomp profile
        is required.
    creationTimestamp: "2022-10-13T22:13:02Z"
    generation: 1
    name: nonroot-v2
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      kind: ClusterVersion
      name: version
      uid: 11aa7806-27a6-45c2-8e85-34e8473d716e
    resourceVersion: "187721244"
    uid: ea88650b-82af-4a78-bea6-8de7c25d34df
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: MustRunAsNonRoot
  seLinuxContext:
    type: MustRunAs
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_ADMIN
  - NET_RAW
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"allowHostNetwork":false,"allowPrivilegedContainer":false,"allowedCapabilities":["NET_ADMIN","NET_RAW"],"apiVersion":"security.openshift.io/v1","kind":"SecurityContextConstraints","metadata":{"annotations":{},"labels":{"hive.openshift.io/managed":"true"},"name":"pcap-dedicated-admins"},"runAsUser":{"type":"RunAsAny"},"seLinuxContext":{"type":"RunAsAny"}}
    creationTimestamp: "2022-02-23T15:05:15Z"
    generation: 1
    labels:
      hive.openshift.io/managed: "true"
    name: pcap-dedicated-admins
    resourceVersion: "30852"
    uid: b54eb98b-bd3b-44c4-ad56-27fc6afece1e
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - awsElasticBlockStore
  - azureDisk
  - azureFile
  - cephFS
  - cinder
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - fc
  - flexVolume
  - flocker
  - gcePersistentDisk
  - gitRepo
  - glusterfs
  - iscsi
  - nfs
  - persistentVolumeClaim
  - photonPersistentDisk
  - portworxVolume
  - projected
  - quobyte
  - rbd
  - scaleIO
  - secret
  - storageOS
  - vsphere
- allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities:
  - '*'
  allowedUnsafeSysctls:
  - '*'
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups:
  - system:cluster-admins
  - system:nodes
  - system:masters
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: 'privileged allows access to all privileged and host
        features and the ability to run as any user, any group, any fsGroup, and with
        any SELinux context.  WARNING: this is the most relaxed SCC and should be
        used only for cluster administration. Grant with caution.'
      release.openshift.io/create-only: "true"
    creationTimestamp: "2022-02-23T14:36:00Z"
    generation: 1
    name: privileged
    resourceVersion: "476"
    uid: 13c3240e-ff8c-40bc-8f1a-812ac781e3a9
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  seccompProfiles:
  - '*'
  supplementalGroups:
    type: RunAsAny
  users:
  - system:admin
  - system:serviceaccount:openshift-infra:build-controller
  volumes:
  - '*'
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups:
  - system:authenticated
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: restricted denies access to all host features and
        requires pods to be run with a UID, and SELinux context that are allocated
        to the namespace.  This is the most restrictive SCC and it is used by default
        for authenticated users.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2022-02-23T14:36:01Z"
    generation: 1
    name: restricted
    resourceVersion: "479"
    uid: adc86cc4-2e17-4595-b307-8aa966462a9b
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_BIND_SERVICE
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: restricted-v2 denies access to all host features
        and requires pods to be run with a UID, and SELinux context that are allocated
        to the namespace. This is the most restrictive SCC and it is used by default
        for authenticated users. On top of the legacy 'restricted' SCC, it also requires
        to drop ALL capabilities and does not allow privilege escalation binaries.
        It will also default the seccomp profile to runtime/default if unset, otherwise
        this seccomp profile is required.
    creationTimestamp: "2022-10-13T22:13:02Z"
    generation: 1
    name: restricted-v2
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      kind: ClusterVersion
      name: version
      uid: 11aa7806-27a6-45c2-8e85-34e8473d716e
    resourceVersion: "187721260"
    uid: a05be51c-b4f3-4cff-9391-4d200c25ac72
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities:
  - '*'
  allowedUnsafeSysctls:
  - '*'
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"allowHostDirVolumePlugin":true,"allowHostIPC":false,"allowHostNetwork":false,"allowHostPID":false,"allowHostPorts":false,"allowPrivilegeEscalation":true,"allowPrivilegedContainer":true,"allowedCapabilities":["*"],"allowedUnsafeSysctls":["*"],"apiVersion":"security.openshift.io/v1","fsGroup":{"type":"RunAsAny"},"kind":"SecurityContextConstraints","metadata":{"annotations":{},"labels":{"hive.openshift.io/managed":"true"},"name":"splunkforwarder"},"readOnlyRootFilesystem":false,"runAsUser":{"type":"RunAsAny"},"seLinuxContext":{"type":"RunAsAny"},"seccompProfiles":["*"],"supplementalGroups":{"type":"RunAsAny"},"users":["system:serviceaccount:openshift-security:default"],"volumes":["*"]}
    creationTimestamp: "2022-02-23T15:05:22Z"
    generation: 1
    labels:
      hive.openshift.io/managed: "true"
    name: splunkforwarder
    resourceVersion: "31491"
    uid: 771ae18f-14ad-4e93-bcb5-80bdfa30cf73
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  seccompProfiles:
  - '*'
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-security:default
  volumes:
  - '*'
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_ADMIN
  - NET_RAW
  - SYS_ADMIN
  - SYS_PTRACE
  - SYS_CHROOT
  - MKNOD
  - SETFCAP
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: []
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"allowHostDirVolumePlugin":true,"allowHostIPC":false,"allowHostNetwork":true,"allowHostPID":true,"allowHostPorts":true,"allowPrivilegedContainer":false,"allowedCapabilities":["NET_ADMIN","NET_RAW","SYS_ADMIN","SYS_PTRACE","SYS_CHROOT","MKNOD","SETFCAP"],"apiVersion":"security.openshift.io/v1","defaultAddCapabilities":[],"fsGroup":{"type":"RunAsAny"},"kind":"SecurityContextConstraints","metadata":{"annotations":{},"labels":{"app.kubernetes.io/instance":"cluster-config"},"name":"twistlock-scc"},"priority":0,"readOnlyRootFilesystem":true,"requiredDropCapabilities":[],"runAsUser":{"type":"RunAsAny"},"seLinuxContext":{"type":"RunAsAny"},"supplementalGroups":{"type":"RunAsAny"},"users":["system:serviceaccount:prismacloud:twistlock-service"],"volumes":["*"]}
    creationTimestamp: "2022-09-14T20:01:01Z"
    generation: 1
    labels:
      app.kubernetes.io/instance: cluster-config
    name: twistlock-scc
    resourceVersion: "138560528"
    uid: 0b9f7969-7d4c-48ae-8e3e-b5022f437200
  priority: 0
  readOnlyRootFilesystem: true
  requiredDropCapabilities: []
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:prismacloud:twistlock-service
  volumes:
  - '*'
kind: List
metadata:
  resourceVersion: ""
