virt-operator, virt-controller SCC: Allow SYS_RESOURCE capability
@@ -74,7 +74,7 @@ func NewKubeVirtControllerSCC(namespace string) *secv1.SecurityContextConstraint
scc.SELinuxContext = secv1.SELinuxContextStrategyOptions{
Type: secv1.SELinuxStrategyRunAsAny,
}
- scc.AllowedCapabilities = []corev1.Capability{"NET_ADMIN", "SYS_NICE"}
+ scc.AllowedCapabilities = []corev1.Capability{"NET_ADMIN", "SYS_NICE", "SYS_RESOURCE"}
scc.AllowHostDirVolumePlugin = true
scc.AllowHostNetwork = true
scc.Users = []string{fmt.Sprintf("system:serviceaccount:%s:kubevirt-controller", namespace)}
