From 4f9a075674934a2f5fb61bd568aca70956e58d29 Mon Sep 17 00:00:00 2001
From: Conan Scott <conanscott@gmail.com>
Date: Mon, 12 Jan 2026 17:55:49 +1100
Subject: [PATCH] initial commit

---
 README.md                                     |   4 ++
 bootstrap/okd-platform-application.yaml       |  24 ++++++++++++
 manifests/.DS_Store                           | Bin 0 -> 6148 bytes
 manifests/scc/.DS_Store                       | Bin 0 -> 6148 bytes
 .../scc/scc-restricteds6-rolebinding.yaml     |  12 ++++++
 manifests/scc/scc-restricteds6.yaml           |  37 ++++++++++++++++++
 6 files changed, 77 insertions(+)
 create mode 100644 README.md
 create mode 100644 bootstrap/okd-platform-application.yaml
 create mode 100644 manifests/.DS_Store
 create mode 100644 manifests/scc/.DS_Store
 create mode 100644 manifests/scc/scc-restricteds6-rolebinding.yaml
 create mode 100644 manifests/scc/scc-restricteds6.yaml

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..051ab44
--- /dev/null
+++ b/README.md
@@ -0,0 +1,4 @@
+# YAML for any cluster-scoped objects suchs as cluster roles/bindings, SCC etc. 
+
+- Added SCC restricted-s6 for s6-overlay images
+- Added ClusterRole/Bindings for s6-overlay SCC
\ No newline at end of file
diff --git a/bootstrap/okd-platform-application.yaml b/bootstrap/okd-platform-application.yaml
new file mode 100644
index 0000000..796599e
--- /dev/null
+++ b/bootstrap/okd-platform-application.yaml
@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: okd-platform
+  annotations:
+    argocd.argoproj.io/sync-wave: "-10"
+spec:
+  orphanedResources:
+    warn: false # Disable warning
+  project: infrastructure
+  destination:
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: https://gitea.apilab.us/cscott/okd-platform.git
+    targetRevision: main
+    path: manifests
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: false
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true
diff --git a/manifests/.DS_Store b/manifests/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..ea329e17be9afe654e2c38bfa1651e0f0e7be787
GIT binary patch
literal 6148
zcmeHKPfrs;6rTsxZb4*$RuN;eu@@6a1jG<x45icv2Lqu5i-2`^JG2|NJI(Gw1wzs@
zp8NoQ024oei5ETTL9gD7A3?9)eDh}mSoNk6voD$Xy?Jlm+nL{H=j{+eAirH1BSa^J
zXxKO=y0H6+a6fNt(xEI#MBq7shUGE~M=z~L+w9m7GY~WIuQ9;C-A)n^o7h(K`1k8N
zK{z`45jr{(XU-<Iq}Hu%6l<(m49##m$eaEeA1yQHT9IyAD-Laz_4F+BLeuf6F9Mtj
z#VPCe9k0TgdA99U0ufu34lSjn%KG5`{>||lBgXjD<iUusKQ%r&VoXj<9UP>zO!oS%
zrSg_r_t>GN5Ad`R(xWhfC#b01IQEV@jo^dTkh}S;>(PEvUESw;&iCql{R4gJzDy=_
z;o{(>q02*MeZVs9t*X!0Im=w;=iP0(R`s1qv0>VdS1pC~aaeTrXj$+7Vd@gCJUlWj
z?>2Bw`p6*C-SsK;M81X1&47lbWBO`Y?+t99x$YthoX}z3>Uw}I&xf==?`<-C;tn#r
z(BQ6Mh57+vTTE%y^nKH-(){j*Yg*J@@bWASS-s@g%#$nc6=`v}=u@6DJN;F1n9a?#
zgqF=+lNOz1rGix;9cc<7`?_ifec3bXG=<U9lfsHIOlHVEvO>1V9(hWhk>}(Uc}G5x
zFXS5}L5Hg_3=?o0reO}|;Q`oC0|$JWpd)(4SL8VAAwW&NVz)Y0v|0UlsZpLfD-={I
z(q6!u_qD^fGe>cCR{4#$QTtWaouco#%&TIiXm!!DP9>^MXx*oB_3@%(24V*OBm?|>
zFtBmVDQrm;M+bJ|3V@hEvk=tzU4q9L3Udlu648SKG89pUg1TaW3`e`6=H(Q&B+76C
z>hb~V$)Ij1AfAr-4KbZSPGa2048#naWS~<HbzcAP{QCZXGAJI!48#olR}4U+P%Pwe
zORBcEZI0Jk1KT5PT==|}L=l3WD#t?MrFamV5cC;bLCh&^Nkj`u{39S}h`X49zskUO
D6Jp^y

literal 0
HcmV?d00001

diff --git a/manifests/scc/.DS_Store b/manifests/scc/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..f17f369bffc9afb842e3b5d8cbe4399c28e7334c
GIT binary patch
literal 6148
zcmeHKK~KUk6#l9lh+epucrr7d=i<flBzPlUh@KS~LWHr5VZv=c-S53t2tiFuj3MN8
z>HFHgzSq95>$(DP?d9+WXaQ(43pP$DzDS~%ypxVXOM~dtM~MszR46go>1_?hfHAOd
z49MQS<enYyiMek#`**;7oMA}at!n0&vfk&;&e<yR71vnd1v5;Gs^48Ms*>LB&||B7
z1u|+9JV7j%EQ{|19a>b(2_9L`IHt4?C<p9W@k!97zE2!eKUFVtym8bR1?yrzV&76V
zGuCs?XQcis_4ZdWJ%pGp=yelQtg*~=2CFq|63M&HZ9+}H;f9=?X>>m^yuVETZtkCq
zU6F%=E0Qzvv93-<ri3$Dt4g`^?@+Ako^$;se4}JFi!JW<ZO0tWe0XL{YMy#DX$%+x
z#=x2Z`94I<f@#3oqkcLl^a?<f-v~`C%UwcjqJU|@+9Neg&YKdwsS8&O=grw3g??$k
z+M_pz3zrWUMt0$b;&gQSkF+~n>d~YzU<_<CaO|rsIsfm!zyEI=S<M(Q1`dh=*XZ;*
zZH5%i)}7$wtc{qTnI%cT+M}9KgyUEXaulC4Yoaca0x=C(dt?if{Rk)xCX9i9W#9v*
Cv5@xw

literal 0
HcmV?d00001

diff --git a/manifests/scc/scc-restricteds6-rolebinding.yaml b/manifests/scc/scc-restricteds6-rolebinding.yaml
new file mode 100644
index 0000000..d4d2dd4
--- /dev/null
+++ b/manifests/scc/scc-restricteds6-rolebinding.yaml
@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: calibre-sa-restricted-s6
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:restricted-s6
+subjects:
+  - kind: ServiceAccount
+    name: calibre-sa
+    namespace: calibre
\ No newline at end of file
diff --git a/manifests/scc/scc-restricteds6.yaml b/manifests/scc/scc-restricteds6.yaml
new file mode 100644
index 0000000..7540bd0
--- /dev/null
+++ b/manifests/scc/scc-restricteds6.yaml
@@ -0,0 +1,37 @@
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: restricted-s6
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: false
+allowPrivilegedContainer: false
+allowedCapabilities: null
+defaultAddCapabilities: null
+fsGroup:
+  type: MustRunAs
+  ranges:
+    - min: 1000
+      max: 2000
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+  - ALL
+runAsUser:
+  type: MustRunAsRange
+  uidRangeMin: 1000
+  uidRangeMax: 2000
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+volumes:
+  - configMap
+  - downwardAPI
+  - emptyDir
+  - persistentVolumeClaim
+  - projected
+  - secret
+priority: 5  # Higher than restricted (0) but lower than anyuid (10)
\ No newline at end of file