Security context constraints prioritization
Security context constraints (SCCs) have a priority field that affects the ordering when attempting to validate a request by the admission controller.
|
|
Setting an SCC priority greater than 0 for the default Red Hat OpenShift Container Platform SCCs can cause critical cluster instability. |
A priority value of 0 is the lowest possible priority. A nil priority is considered a 0, or lowest, priority. Higher priority SCCs are moved to the front of the set when sorting.
When the complete set of available SCCs is determined, the SCCs are ordered in the following manner:
-
The highest priority SCCs are ordered first.
-
If the priorities are equal, the SCCs are sorted from most restrictive to least restrictive.
-
If both the priorities and restrictions are equal, the SCCs are sorted by name.
By default, the anyuid SCC granted to cluster administrators is given priority
in their SCC set. This allows cluster administrators to run pods as any
user by specifying RunAsUser in the pod’s SecurityContext.