# ============================================================
# FIRST-INSTALL ONLY — Apply once per cluster, before running
# the DataQI Helm chart for the first time.
#
# This SecurityContextConstraints (SCC) grants the CloudNativePG
# operator permission to run as UID 10001. OpenShift's default
# restricted-v2 SCC would otherwise block the operator from starting.
#
# Usage:
#   kubectl apply -f dev-ops/openshift-support/first-install/cnpg-scc.yaml
# ============================================================
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: cnpg-manager
  annotations:
    kubernetes.io/description: >
      SCC for the CloudNativePG operator manager. Allows the operator to run
      as UID 10001 as defined in the upstream container image.
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: []
defaultAddCapabilities: []
seccompProfiles:
  - '*'
fsGroup:
  type: MustRunAs
  ranges:
    - min: 10001
      max: 10001
groups: []
priority: 10
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - ALL
runAsUser:
  type: MustRunAsRange
  uidRangeMin: 10001
  uidRangeMax: 10001
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users:
  - system:serviceaccount:cnpg-system:cnpg-manager
volumes:
  - configMap
  - downwardAPI
  - emptyDir
  - projected
  - secret