From 1c49eaeca8e5d3853a2f2462e82fb87e5d273756 Mon Sep 17 00:00:00 2001
From: Conan Scott <conanscott@gmail.com>
Date: Wed, 14 Jan 2026 17:42:40 +1100
Subject: [PATCH] add minio-restricted scc

---
 manifests/.DS_Store                           | Bin 10244 -> 10244 bytes
 .../scc/scc-minio-restricted-rolebinding.yaml |  12 ++++++
 manifests/scc/scc-minio-restricted.yaml       |  37 ++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 manifests/scc/scc-minio-restricted-rolebinding.yaml
 create mode 100644 manifests/scc/scc-minio-restricted.yaml

diff --git a/manifests/.DS_Store b/manifests/.DS_Store
index b9108d95a2122fb62cfa896aec6d004b4af0d9b6..1f35663010ecfc5ede5f84e097a5f189587d0332 100644
GIT binary patch
delta 89
zcmV-f0H*(hP=rvBVFS2gaItZg2a$jcvj+$o2m!d0A`o#W7<+p)GBYe7GC4PWEFgP1
vGB7M4H#9kYeF+E^BQHBrUu$e_Zf}Z{ybvD&i?iGiD-W{;Ap8Wg0~G@U?sOXX

delta 91
zcmZn(XbG5*$h<45U}NDl_K6L=o7p*}I2d<LRuU-Gl&Y>aH#O8zFf=r%)lsN6G%_>=
tag2;>YdJYYmG!NI;<Iyd^YVKp?-Gz_?A?4zK%0LvyTUJ)&HqK1nE@Qg96ta6

diff --git a/manifests/scc/scc-minio-restricted-rolebinding.yaml b/manifests/scc/scc-minio-restricted-rolebinding.yaml
new file mode 100644
index 0000000..d4d2dd4
--- /dev/null
+++ b/manifests/scc/scc-minio-restricted-rolebinding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: calibre-sa-restricted-s6
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:restricted-s6
+subjects:
+  - kind: ServiceAccount
+    name: calibre-sa
+    namespace: calibre
\ No newline at end of file
diff --git a/manifests/scc/scc-minio-restricted.yaml b/manifests/scc/scc-minio-restricted.yaml
new file mode 100644
index 0000000..fed864d
--- /dev/null
+++ b/manifests/scc/scc-minio-restricted.yaml
@@ -0,0 +1,37 @@
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: minio-restricted
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: false
+allowPrivilegedContainer: false
+allowedCapabilities: null
+defaultAddCapabilities: null
+fsGroup:
+  type: MustRunAs
+  ranges:
+    - min: 1000
+      max: 1000
+priority: null
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+  - MKNOD
+  - ALL
+runAsUser:
+  type: MustRunAs
+  uid: 501
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+volumes:
+  - configMap
+  - downwardAPI
+  - emptyDir
+  - persistentVolumeClaim
+  - projected
+  - secret