Harden OpenShift manual-install SCC troubleshooting guidance
Maintainers usually reply within 1 day
@olivergondza is already working on this.
Since Sep 15, 2026.
Assessment
This issue has not been assessed yet.
Description
Summary
The OpenShift manual-install documentation recommends granting the privileged SCC to the default ServiceAccount in openshift-gitops-operator when the operator image fails the non-root policy.
Rationale
Granting privileged to default makes it available to every workload that uses that ServiceAccount in the namespace. The guidance should not broaden SCC permissions for unrelated workloads.
Affected area
argocd-operator/docs/install/openshift.md- The
runAsUser breaks non-root policytroubleshooting note in the manual-install section.
Required changes
Replace the default ServiceAccount workaround with guidance that uses a dedicated ServiceAccount for the affected deployment. Identify or recommend the least-privileged SCC that resolves the image policy error. State how to bind that SCC only to the dedicated ServiceAccount.
Acceptance criteria
- The documentation does not instruct users to grant
privilegedSCC todefault. - The affected operator deployment uses a dedicated ServiceAccount when an SCC exception is required.
- The documentation recommends the least-privileged suitable SCC before
privileged. - The guidance explains the scope of the SCC binding.
Backlinks
- PR: https://github.com/redhat-developer/gitops-operator/pull/1294
- Review comment: https://github.com/redhat-developer/gitops-operator/pull/1294#discussion_r4016160278
- Requested by: @olivergondza
- Dominant language
- Go
- Stars
- 188
- Forks
- 359
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 21
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from redhat-developer/gitops-operator
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
redhat-developer/gitops-operator#1287 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
redhat-developer/gitops-operator#1311 ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
redhat-developer/gitops-operator#1139 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
redhat-developer/gitops-operator#634 · 1 comment ·
Maintainers usually reply within 1 day
-
triage:required
Difficulty 4/5 3-5 days Newbie friendliness 48/100
redhat-developer/gitops-operator#572 · 2 comments ·
Maintainers usually reply within 1 day
All issues in redhat-developer/gitops-operator
Similar issues
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
cvss-severity:high devguard l3montree-cybersecurity/...ard-k8s-image-inventory pkg:oci/devguard-k8s-ima...ch=amd64&tag=main-amd64 pkg:oci/devguard-k8s-ima...ch=arm64&tag=main-arm64 risk:low state:open
Difficulty 1/5 Under an hour Newbie friendliness 76/100
l3montree-dev/devguard#3094 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
JuliusBrussee/caveman#1127 · 1 comment ·
Maintainers usually reply within 1 day
-
enhancement low priority
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
eugenioenko/ttt#674 ·
Maintainers usually reply within 1 day
-
kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
gpustack/gpustack-operator#640 ·
Maintainers usually reply within 1 day