apiVersion: v1
items:
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups:
  - system:cluster-admins
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: anyuid provides all features of the restricted SCC
        but allows users to run with any UID and any GID.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:13:43Z"
    generation: 1
    name: anyuid
    resourceVersion: "330"
    uid: 4b0e9c47-d6b9-4838-a493-3dbf40aa382e
  priority: 10
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - MKNOD
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    creationTimestamp: "2024-01-07T10:09:30Z"
    generation: 1
    labels:
      app.kubernetes.io/component: network
      app.kubernetes.io/managed-by: cnao-operator
      app.kubernetes.io/part-of: hyperconverged-cluster
      app.kubernetes.io/version: 4.15.0
      networkaddonsoperator.network.kubevirt.io/version: sha256_47bfdf8f0b085891c4d5fd92e80d10d3cb859b27a5b7acf9d3f8b245
      prometheus.cnao.io: "true"
    name: bridge-marker
    ownerReferences:
    - apiVersion: networkaddonsoperator.network.kubevirt.io/v1
      blockOwnerDeletion: true
      controller: true
      kind: NetworkAddonsConfig
      name: cluster
      uid: 2ce1f12c-83f0-4dea-9c73-0ae54634821d
    resourceVersion: "67496"
    uid: 10967003-b423-47fc-b4fe-4c9b64f07b04
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-cnv:bridge-marker
  volumes:
  - '*'
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    creationTimestamp: "2024-01-07T10:09:39Z"
    generation: 3
    labels:
      app.kubernetes.io/component: storage
      app.kubernetes.io/managed-by: cdi-operator
      app.kubernetes.io/part-of: hyperconverged-cluster
      app.kubernetes.io/version: 4.15.0
      cdi.kubevirt.io: ""
    name: containerized-data-importer
    ownerReferences:
    - apiVersion: cdi.kubevirt.io/v1beta1
      blockOwnerDeletion: true
      controller: true
      kind: CDI
      name: cdi-kubevirt-hyperconverged
      uid: 832c2819-136f-4fbc-a34f-d257feaf7799
    resourceVersion: "68315"
    uid: d4cc3903-3088-4c61-96ff-f12197be4ebc
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: MustRunAsNonRoot
  seLinuxContext:
    type: MustRunAs
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: MustRunAs
  users:
  - system:serviceaccount:openshift-cnv:cdi-sa
  - system:serviceaccount:openshift-cnv:cdi-cronjob
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: 'hostaccess allows access to all host namespaces
        but still requires pods to be run with a UID and SELinux context that are
        allocated to the namespace. WARNING: this SCC allows host access to namespaces,
        file systems, and PIDS.  It should only be used by trusted pods.  Grant with
        caution.'
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:13:43Z"
    generation: 1
    name: hostaccess
    resourceVersion: "331"
    uid: f6517e14-2b37-4dd7-9538-7005843e2ded
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - hostPath
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: |-
        hostmount-anyuid provides all the features of the
        restricted SCC but allows host mounts and any UID by a pod.  This is primarily
        used by the persistent volume recycler. WARNING: this SCC allows host file
        system access as any UID, including UID 0.  Grant with caution.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:13:44Z"
    generation: 1
    name: hostmount-anyuid
    resourceVersion: "332"
    uid: ca7458eb-f168-4845-bd97-67bc6fe220a0
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - MKNOD
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-infra:pv-recycler-controller
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - hostPath
  - nfs
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: hostnetwork allows using host networking and host
        ports but still requires pods to be run with a UID and SELinux context that
        are allocated to the namespace.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:13:44Z"
    generation: 1
    name: hostnetwork
    resourceVersion: "335"
    uid: b3743294-a6f8-42c0-bc14-023fd71303f7
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: MustRunAs
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: true
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_BIND_SERVICE
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: hostnetwork allows using host networking and host
        ports but still requires pods to be run with a UID and SELinux context that
        are allocated to the namespace. On top of the legacy 'hostnetwork' SCC, it
        also requires to drop ALL capabilities and does not allow privilege escalation
        binaries. It will also default the seccomp profile to runtime/default if unset,
        otherwise this seccomp profile is required.
    creationTimestamp: "2024-01-07T09:13:44Z"
    generation: 1
    name: hostnetwork-v2
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      controller: true
      kind: ClusterVersion
      name: version
      uid: 98f2cc66-ccae-433f-8d2f-3e2edc0fbc34
    resourceVersion: "1590"
    uid: b5a4d696-66b3-453e-b77b-6ede0a7e7635
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: MustRunAs
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      hostpathprovisioner.kubevirt.io/lastAppliedConfiguration: '{"kind":"SecurityContextConstraints","apiVersion":"security.openshift.io/v1","metadata":{"name":"hostpath-provisioner-csi","creationTimestamp":null,"labels":{"app.kubernetes.io/component":"storage","app.kubernetes.io/managed-by":"hostpath-provisioner-operator","app.kubernetes.io/part-of":"hyperconverged-cluster","app.kubernetes.io/version":"4.15.0","k8s-app":"hostpath-provisioner"}},"priority":null,"allowPrivilegedContainer":true,"defaultAddCapabilities":null,"requiredDropCapabilities":["KILL","MKNOD","SETUID","SETGID"],"allowedCapabilities":null,"allowHostDirVolumePlugin":true,"volumes":["*"],"allowHostNetwork":false,"allowHostPorts":false,"allowHostPID":false,"allowHostIPC":false,"seLinuxContext":{"type":"RunAsAny"},"runAsUser":{"type":"RunAsAny"},"supplementalGroups":{"type":"RunAsAny"},"fsGroup":{"type":"RunAsAny"},"readOnlyRootFilesystem":false,"users":["system:serviceaccount:openshift-cnv:hostpath-provisioner-admin-csi"],"groups":[]}'
    creationTimestamp: "2024-01-07T10:11:27Z"
    generation: 1
    labels:
      app.kubernetes.io/component: storage
      app.kubernetes.io/managed-by: hostpath-provisioner-operator
      app.kubernetes.io/part-of: hyperconverged-cluster
      app.kubernetes.io/version: 4.15.0
      k8s-app: hostpath-provisioner
    name: hostpath-provisioner-csi
    resourceVersion: "72310"
    uid: 603a83ff-dc90-4ca5-8d10-ac3d6f6fa1b1
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-cnv:hostpath-provisioner-admin-csi
  volumes:
  - '*'
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities:
  - SYS_NICE
  - NET_BIND_SERVICE
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      kubevirt.io/generation: "1"
      kubevirt.io/install-strategy-identifier: eb3a61c8ea0ab26a82894aa4f8d8dc1fc95f8976
      kubevirt.io/install-strategy-registry: ""
      kubevirt.io/install-strategy-version: sha256:1c24ff8bb41b6f8d94bc8689bac4371550bee4845dfca9e7ccaac51a45ac4deb
    creationTimestamp: "2024-01-07T10:09:59Z"
    generation: 1
    labels:
      app.kubernetes.io/component: compute
      app.kubernetes.io/managed-by: virt-operator
      app.kubernetes.io/part-of: hyperconverged-cluster
      app.kubernetes.io/version: 4.15.0
    name: kubevirt-controller
    resourceVersion: "68808"
    uid: b25b257b-d045-4713-9e09-57f297412b93
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  seccompProfiles:
  - runtime/default
  - unconfined
  - localhost/kubevirt/kubevirt.json
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-cnv:kubevirt-controller
  volumes:
  - '*'
- allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: false
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      kubevirt.io/generation: "1"
      kubevirt.io/install-strategy-identifier: eb3a61c8ea0ab26a82894aa4f8d8dc1fc95f8976
      kubevirt.io/install-strategy-registry: ""
      kubevirt.io/install-strategy-version: sha256:1c24ff8bb41b6f8d94bc8689bac4371550bee4845dfca9e7ccaac51a45ac4deb
    creationTimestamp: "2024-01-07T10:09:59Z"
    generation: 1
    labels:
      app.kubernetes.io/component: compute
      app.kubernetes.io/managed-by: virt-operator
      app.kubernetes.io/part-of: hyperconverged-cluster
      app.kubernetes.io/version: 4.15.0
    name: kubevirt-handler
    resourceVersion: "68805"
    uid: 844006af-e570-4234-bdb5-5001885f0ba6
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-cnv:kubevirt-handler
  volumes:
  - '*'
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    creationTimestamp: "2024-01-07T10:09:29Z"
    generation: 1
    labels:
      app.kubernetes.io/component: network
      app.kubernetes.io/managed-by: cnao-operator
      app.kubernetes.io/part-of: hyperconverged-cluster
      app.kubernetes.io/version: 4.15.0
      networkaddonsoperator.network.kubevirt.io/version: sha256_47bfdf8f0b085891c4d5fd92e80d10d3cb859b27a5b7acf9d3f8b245
      prometheus.cnao.io: "true"
    name: linux-bridge
    ownerReferences:
    - apiVersion: networkaddonsoperator.network.kubevirt.io/v1
      blockOwnerDeletion: true
      controller: true
      kind: NetworkAddonsConfig
      name: cluster
      uid: 2ce1f12c-83f0-4dea-9c73-0ae54634821d
    resourceVersion: "67339"
    uid: 161ff8cf-587d-4830-8188-1a9ff123c420
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-cnv:linux-bridge
  volumes:
  - '*'
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      capability.openshift.io/name: MachineAPI
      include.release.openshift.io/self-managed-high-availability: "true"
      kubernetes.io/description: machine-api-termination-handler allows the machine-api-termination-handler
        service account to run as root, access host paths and access the host network.
        This SCC is limited and should not be used for any other service.
    creationTimestamp: "2024-01-07T09:14:47Z"
    generation: 1
    name: machine-api-termination-handler
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      controller: true
      kind: ClusterVersion
      name: version
      uid: 98f2cc66-ccae-433f-8d2f-3e2edc0fbc34
    resourceVersion: "2120"
    uid: 18ab9e43-036b-49e8-80dc-00389a3c23b5
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: MustRunAs
  users:
  - system:serviceaccount:openshift-machine-api:machine-api-termination-handler
  volumes:
  - downwardAPI
  - hostPath
- allowHostDirVolumePlugin: true
  allowHostIPC: false
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      kubernetes.io/description: node-exporter scc is used for the Prometheus node
        exporter
    creationTimestamp: "2024-01-07T09:35:09Z"
    generation: 1
    labels:
      app.kubernetes.io/managed-by: cluster-monitoring-operator
      app.kubernetes.io/part-of: openshift-monitoring
    name: node-exporter
    resourceVersion: "22143307"
    uid: 03792a07-83f0-41bc-a7dc-5b0414e8feac
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - '*'
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: nonroot provides all features of the restricted SCC
        but allows users to run with any non-root UID.  The user must specify the
        UID or it must be specified on the by the manifest of the container runtime.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:13:45Z"
    generation: 1
    name: nonroot
    resourceVersion: "337"
    uid: 2111537a-8ebc-46c4-83df-27559b15fda5
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsNonRoot
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_BIND_SERVICE
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: nonroot provides all features of the restricted SCC
        but allows users to run with any non-root UID.  The user must specify the
        UID or it must be specified on the by the manifest of the container runtime.
        On top of the legacy 'nonroot' SCC, it also requires to drop ALL capabilities
        and does not allow privilege escalation binaries. It will also default the
        seccomp profile to runtime/default if unset, otherwise this seccomp profile
        is required.
    creationTimestamp: "2024-01-07T09:13:45Z"
    generation: 1
    name: nonroot-v2
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      controller: true
      kind: ClusterVersion
      name: version
      uid: 98f2cc66-ccae-433f-8d2f-3e2edc0fbc34
    resourceVersion: "1637"
    uid: 779e52b2-db1f-45a1-a982-bac1bd1530e7
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: MustRunAsNonRoot
  seLinuxContext:
    type: MustRunAs
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities:
  - SETFCAP
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups:
  - system:cluster-admins
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: pipelines-scc is a close replica of anyuid scc. pipelines-scc
        has fsGroup - MustRunAs.
      operator.tekton.dev/last-applied-hash: 8afba66f104a1fecb21c0e69db551a1e7050eeab113a3758877b0affc57090bb
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:57:02Z"
    generation: 1
    name: pipelines-scc
    ownerReferences:
    - apiVersion: operator.tekton.dev/v1alpha1
      blockOwnerDeletion: true
      controller: true
      kind: TektonInstallerSet
      name: rhosp-rbac-5kwwz
      uid: 6c04fea2-7cd1-4f96-b367-43198a7e619a
    resourceVersion: "49402"
    uid: c43ef16f-a3a3-4934-8958-b687470e468a
  priority: 10
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - MKNOD
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities:
  - '*'
  allowedUnsafeSysctls:
  - '*'
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups:
  - system:cluster-admins
  - system:nodes
  - system:masters
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: 'privileged allows access to all privileged and host
        features and the ability to run as any user, any group, any fsGroup, and with
        any SELinux context.  WARNING: this is the most relaxed SCC and should be
        used only for cluster administration. Grant with caution.'
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:13:46Z"
    generation: 1
    name: privileged
    resourceVersion: "338"
    uid: 1cad61c5-23fc-4b82-b494-fd1eff657cd0
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  seccompProfiles:
  - '*'
  supplementalGroups:
    type: RunAsAny
  users:
  - system:admin
  - system:serviceaccount:openshift-infra:build-controller
  volumes:
  - '*'
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: restricted denies access to all host features and
        requires pods to be run with a UID, and SELinux context that are allocated
        to the namespace.
      release.openshift.io/create-only: "true"
    creationTimestamp: "2024-01-07T09:13:46Z"
    generation: 1
    name: restricted
    resourceVersion: "342"
    uid: 29479e36-acfd-4c7d-996c-bb2906c43e38
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - KILL
  - MKNOD
  - SETUID
  - SETGID
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: false
  allowHostIPC: false
  allowHostNetwork: false
  allowHostPID: false
  allowHostPorts: false
  allowPrivilegeEscalation: false
  allowPrivilegedContainer: false
  allowedCapabilities:
  - NET_BIND_SERVICE
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    annotations:
      include.release.openshift.io/ibm-cloud-managed: "true"
      include.release.openshift.io/self-managed-high-availability: "true"
      include.release.openshift.io/single-node-developer: "true"
      kubernetes.io/description: restricted-v2 denies access to all host features
        and requires pods to be run with a UID, and SELinux context that are allocated
        to the namespace. This is the most restrictive SCC and it is used by default
        for authenticated users. On top of the legacy 'restricted' SCC, it also requires
        to drop ALL capabilities and does not allow privilege escalation binaries.
        It will also default the seccomp profile to runtime/default if unset, otherwise
        this seccomp profile is required.
    creationTimestamp: "2024-01-07T09:13:46Z"
    generation: 1
    name: restricted-v2
    ownerReferences:
    - apiVersion: config.openshift.io/v1
      controller: true
      kind: ClusterVersion
      name: version
      uid: 98f2cc66-ccae-433f-8d2f-3e2edc0fbc34
    resourceVersion: "1681"
    uid: 02ba6ceb-6dcd-47ac-a441-c50f30d29124
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  seccompProfiles:
  - runtime/default
  supplementalGroups:
    type: RunAsAny
  users: []
  volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: true
  allowHostPID: false
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities:
  - MKNOD
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: []
  fsGroup:
    type: MustRunAs
  groups: []
  kind: SecurityContextConstraints
  metadata:
    creationTimestamp: "2024-01-07T10:03:22Z"
    generation: 1
    name: rook-ceph
    resourceVersion: "22143655"
    uid: 0282784c-fe49-4bb7-bb2b-d14ee38563d7
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities:
  - ALL
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: MustRunAs
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-storage:rook-ceph-system
  - system:serviceaccount:openshift-storage:default
  - system:serviceaccount:openshift-storage:rook-ceph-mgr
  - system:serviceaccount:openshift-storage:rook-ceph-osd
  - system:serviceaccount:openshift-storage:rook-ceph-rgw
  volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - hostPath
  - persistentVolumeClaim
  - projected
  - secret
- allowHostDirVolumePlugin: true
  allowHostIPC: true
  allowHostNetwork: true
  allowHostPID: true
  allowHostPorts: true
  allowPrivilegeEscalation: true
  allowPrivilegedContainer: true
  allowedCapabilities:
  - SYS_ADMIN
  apiVersion: security.openshift.io/v1
  defaultAddCapabilities: null
  fsGroup:
    type: RunAsAny
  groups: []
  kind: SecurityContextConstraints
  metadata:
    creationTimestamp: "2024-01-07T10:03:22Z"
    generation: 1
    name: rook-ceph-csi
    resourceVersion: "22143656"
    uid: b95c9343-73c2-4bdd-8ef8-05c9963a3305
  priority: null
  readOnlyRootFilesystem: false
  requiredDropCapabilities: null
  runAsUser:
    type: RunAsAny
  seLinuxContext:
    type: RunAsAny
  supplementalGroups:
    type: RunAsAny
  users:
  - system:serviceaccount:openshift-storage:rook-csi-rbd-plugin-sa
  - system:serviceaccount:openshift-storage:rook-csi-rbd-provisioner-sa
  - system:serviceaccount:openshift-storage:rook-csi-cephfs-plugin-sa
  - system:serviceaccount:openshift-storage:rook-csi-cephfs-provisioner-sa
  - system:serviceaccount:openshift-storage:rook-csi-nfs-plugin-sa
  - system:serviceaccount:openshift-storage:rook-csi-nfs-provisioner-sa
  volumes:
  - configMap
  - emptyDir
  - hostPath
  - projected
kind: List
metadata:
  resourceVersion: ""
