diff --git a/autopilot/base/clusterrolebindings/autopilot-privileged.yaml b/autopilot/base/clusterrolebindings/autopilot-privileged.yaml new file mode 100644 index 00000000..ca2a5d9e --- /dev/null +++ b/autopilot/base/clusterrolebindings/autopilot-privileged.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: autopilot-privileged + namespace: autopilot +subjects: +- kind: ServiceAccount + name: autopilot + namespace: autopilot +roleRef: + kind: ClusterRole + name: system:openshift:scc:privileged + apiGroup: rbac.authorization.k8s.io diff --git a/autopilot/base/clusterrolebindings/kustomization.yaml b/autopilot/base/clusterrolebindings/kustomization.yaml index 5742f7e4..98e84e4f 100644 --- a/autopilot/base/clusterrolebindings/kustomization.yaml +++ b/autopilot/base/clusterrolebindings/kustomization.yaml @@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - autopilot.yaml +- autopilot-privileged.yaml - prometheus-k8s-autopilot.yaml diff --git a/autopilot/base/daemonsets/autopilot.yaml b/autopilot/base/daemonsets/autopilot.yaml index 8b58bf78..a548b2ac 100644 --- a/autopilot/base/daemonsets/autopilot.yaml +++ b/autopilot/base/daemonsets/autopilot.yaml @@ -36,6 +36,8 @@ spec: image: quay.io/autopilot/autopilot:v2.1.0 imagePullPolicy: Always name: device-plugin-validation + securityContext: + privileged: true containers: - image: quay.io/autopilot/autopilot:v2.1.0 command: @@ -88,3 +90,5 @@ spec: nvidia.com/gpu: '0' requests: nvidia.com/gpu: '0' + securityContext: + privileged: true