Bootstrap the "privileged" SCC with all sysctls allowed
@@ -95,6 +95,7 @@ func GetBootstrapSecurityContextConstraints(sccNameToAdditionalGroups map[string
Type: securityapi.SupplementalGroupsStrategyRunAsAny,
},
SeccompProfiles: []string{"*"},
+ AllowedUnsafeSysctls: []string{"*"},
},
// SecurityContextConstraintNonRoot does not allow host access, allocates SELinux labels
// and allows the user to request a specific UID or provide the default in the dockerfile.
