# based on pipelines-scc and https://issues.redhat.com/browse/RUN-1627?focusedId=20932877&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-20932877
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
metadata:
  annotations:
    kubernetes.io/description: >
      podman in pod scc allows to run a semi privileged pod, 
      all containment measures except Linux namespaces are disabled
  name: podman-in-pod
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities:
  - MKNOD
  - SYS_ADMIN
  - SETFCAP
  - SYS_CHROOT
fsGroup:
  type: RunAsAny
groups:
- system:cluster-admins
readOnlyRootFilesystem: false
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
