Helm chart missing OpenShift SCC for AuthBridge sidecars

[r3v5]

Problem

The kagenti-authbridge SecurityContextConstraints (SCC) only exists in the kustomize overlay (config/security/kagenti-authbridge-scc.yaml). Helm-only installs on OpenShift are missing it, requiring customers to manually apply the SCC out-of-band:

kubectl apply -f kagenti-operator/config/security/kagenti-authbridge-scc.yaml

Without the SCC, AuthBridge sidecar pods fail on OpenShift because:

• restricted-v2 SCC blocks CSI volumes (needed for SPIRE workload API socket via csi.spiffe.io)
• proxy-init init container requires NET_ADMIN capability for iptables rules

Proposed Solution

Add an OpenShift SCC template to the Helm chart, gated by a new value openshift.scc.enable (default: false).

New file: charts/kagenti-operator/templates/openshift/scc.yaml

Include all 3 resources from config/security/kagenti-authbridge-scc.yaml:

• SecurityContextConstraints — kagenti-authbridge
• ClusterRole — system:openshift:scc:kagenti-authbridge (grants use verb)
• ClusterRoleBinding — binds operator SA to the ClusterRole

Templatize the hardcoded namespace: kagenti-operator-system → {{ .Release.Namespace }} and the ServiceAccount name → {{ .Values.controllerManager.serviceAccountName }}.

Update: charts/kagenti-operator/values.yaml

# [OPENSHIFT]: OpenShift-specific resources
openshift:
  scc:
    enable: false

This follows the existing pattern used by networkPolicy.enable and prometheus.enable.

Impact

• Non-OpenShift clusters: no change (default false)
• OpenShift customers: helm install --set openshift.scc.enable=true gets a fully working install with no manual steps

[r3v5]

CC: @akram @kevincogan

[kevincogan]

@r3v5 Thanks for writing this up. I agree with the direction that Helm installs on OpenShift should include the AuthBridge SCC path so they behave consistently with the OpenShift kustomize install path.

Two things seem worth clarifying before we call this fully addressed:

1. The issue proposes an explicit openshift.scc.enable value defaulting to false, but the current Helm template appears to render the SCC automatically on OpenShift when RBAC is enabled. That may be fine, but since this creates SCC and ClusterRoleBinding resources, I think the opt-in vs auto-enable behavior should be intentional.

2. The SCC appears to cover the SPIRE CSI volume case, but it does not appear to cover the current proxy-init path. Current upstream still builds proxy-init with root plus NET_ADMIN/NET_RAW, while the proposed SCC has MustRunAsNonRoot, allowedCapabilities: [], and requiredDropCapabilities: [ALL]. If OpenShift installs are expected to use egressEnforcement: none, we should document that. If not, the SCC may need to support the current proxy-init security context.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this issue is still relevant, please comment or remove the stale label.