deploy Synology CSI

cluster/synology-storageclass/synology-csi-scc.yaml

@@ -1,29 +1,35 @@
 ---
-kind: SecurityContextConstraints
 apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+allowHostPorts: false
+priority: null
+requiredDropCapabilities: []
+allowPrivilegedContainer: true
+runAsUser:
+  type: RunAsAny
+users:
+  - 'system:serviceaccount:synology-csi:csi-controller-sa'
+  - 'system:serviceaccount:synology-csi:csi-node-sa'
+  - 'system:serviceaccount:synology-csi:csi-snapshotter-sa'
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+seLinuxContext:
+  type: RunAsAny
+readOnlyRootFilesystem: false
 metadata:
   name: synology-csi-scc
-allowHostDirVolumePlugin: true
-allowHostNetwork: true
-allowPrivilegedContainer: true
-allowedCapabilities:
-- 'SYS_ADMIN'
-defaultAddCapabilities: []
+  annotations:
+      argocd.argoproj.io/sync-wave: "3"
 fsGroup:
   type: RunAsAny
 groups: []
-priority:
-readOnlyRootFilesystem: false
-requiredDropCapabilities: []
-runAsUser:
-  type: RunAsAny
-seLinuxContext:
-  type: RunAsAny
+defaultAddCapabilities: []
 supplementalGroups:
   type: RunAsAny
-users:
-- system:serviceaccount:synology-csi:csi-controller-sa
-- system:serviceaccount:synology-csi:csi-node-sa
-- system:serviceaccount:synology-csi:csi-snapshotter-sa
 volumes:
-- '*'
+  - '*'
+allowHostPID: false
+allowHostNetwork: true
+allowPrivilegeEscalation: true
+allowedCapabilities:
+  - SYS_ADMIN