SPIRE-253$ cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: test-restricted-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
EOF
namespace/test-restricted-ns created


SPIRE-253$ oc get ns test-restricted-ns -o yaml
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"labels":{"pod-security.kubernetes.io/audit":"restricted","pod-security.kubernetes.io/enforce":"restricted","pod-security.kubernetes.io/warn":"restricted"},"name":"test-restricted-ns"}}
    openshift.io/sa.scc.mcs: s0:c27,c24
    openshift.io/sa.scc.supplemental-groups: 1000750000/10000
    openshift.io/sa.scc.uid-range: 1000750000/10000
    security.openshift.io/MinimallySufficientPodSecurityStandard: restricted
  creationTimestamp: "2025-11-12T10:08:44Z"
  labels:
    kubernetes.io/metadata.name: test-restricted-ns
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
SPIRE-253$ TOKEN=$(oc create token testuser-login -n test-restricted-ns --duration=1h)
CURRENT_CONTEXT=$(oc config current-context)

oc config set-credentials testuser-restricted --token=$TOKEN
oc config set-context testuser-restricted-ctx \
  --cluster=$(oc config view -o jsonpath='{.contexts[0].context.cluster}') \
  --user=testuser-restricted \
  --namespace=test-restricted-ns

oc config use-context testuser-restricted-ctx

# ============================================
# STEP 5: Verify Authorization
# ============================================
echo "=== WHO AM I ==="
oc whoami

echo ""
echo "=== AUTHORIZATION CHECK ==="
oc auth can-i use securitycontextconstraints/test-restricted-scc
User "testuser-restricted" set.
Context "testuser-restricted-ctx" created.
Switched to context "testuser-restricted-ctx".
=== WHO AM I ===
system:serviceaccount:test-restricted-ns:testuser-login

=== AUTHORIZATION CHECK ===
Warning: resource 'securitycontextconstraints' is not namespace scoped in group 'security.openshift.io'

no
SPIRE-253$ cat <<EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: test-restricted-ns-pod
  namespace: test-restricted-ns
spec:
  serviceAccountName: test-unauthorized-sa
  containers:
  - name: test
    image: registry.access.redhat.com/ubi8/ubi-minimal:latest
    command: ["sleep", "3600"]
    securityContext:
      runAsUser: 1000
EOF
Error from server (Forbidden): error when creating "STDIN": pods "test-restricted-ns-pod" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .containers[0].runAsUser: Invalid value: 1000: must be in the ranges: [1000750000, 1000759999], provider "restricted-v3": Forbidden: not usable by user or serviceaccount, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nested-container": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid-v2": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "spire-spiffe-csi-driver": Forbidden: not usable by user or serviceaccount, provider "insights-runtime-extractor-scc": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "spire-agent": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]