From 69f89ee0a737684e192f71986c729b39c965b90a Mon Sep 17 00:00:00 2001
From: Ori Braunshtein <obraunsh@redhat.com>
Date: Tue, 21 Jul 2026 13:52:36 +0300
Subject: [PATCH] frr-k8s: Replace privileged SCC with custom frr-k8s SCC

The frr-k8s DaemonSet and node-status-cleaner Deployment were using the
broad privileged SCC. Replace it with a purpose-built SCC that grants
only the capabilities required for BGP routing (NET_RAW, NET_ADMIN,
SYS_ADMIN, NET_BIND_SERVICE) plus hostNetwork/hostPorts access.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Ori Braunshtein <obraunsh@redhat.com>
---
 bindata/network/frr-k8s/002-rbac.yaml         | 21 +++++++--
 bindata/network/frr-k8s/003-scc.yaml          | 45 +++++++++++++++++++
 bindata/network/frr-k8s/frr-k8s.yaml          |  7 ++-
 .../network/frr-k8s/node-status-cleaner.yaml  |  2 +-
 pkg/network/render_test.go                    |  2 +-
 5 files changed, 70 insertions(+), 7 deletions(-)
 create mode 100644 bindata/network/frr-k8s/003-scc.yaml

diff --git a/bindata/network/frr-k8s/002-rbac.yaml b/bindata/network/frr-k8s/002-rbac.yaml
index bd282ad933..e97de1b792 100644
--- a/bindata/network/frr-k8s/002-rbac.yaml
+++ b/bindata/network/frr-k8s/002-rbac.yaml
@@ -173,14 +173,29 @@ subjects:
   namespace: openshift-frr-k8s
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: frr-k8s-scc
+  namespace: openshift-frr-k8s
+rules:
+  - apiGroups:
+      - security.openshift.io
+    resourceNames:
+      - frr-k8s
+    resources:
+      - securitycontextconstraints
+    verbs:
+      - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: system:openshift:scc:privileged
+  name: frr-k8s-scc
   namespace: openshift-frr-k8s
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:openshift:scc:privileged
+  kind: Role
+  name: frr-k8s-scc
 subjects:
 - kind: ServiceAccount
   name: frr-k8s-daemon
diff --git a/bindata/network/frr-k8s/003-scc.yaml b/bindata/network/frr-k8s/003-scc.yaml
new file mode 100644
index 0000000000..daa851fb37
--- /dev/null
+++ b/bindata/network/frr-k8s/003-scc.yaml
@@ -0,0 +1,45 @@
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: frr-k8s
+  annotations:
+    kubernetes.io/description: >-
+      Custom SCC for FRR-K8s.
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+allowHostNetwork: true
+allowHostPID: false
+allowHostPorts: true
+allowPrivilegeEscalation: false
+allowPrivilegedContainer: false
+allowedCapabilities:
+  - CHOWN
+  - DAC_OVERRIDE
+  - NET_ADMIN
+  - NET_BIND_SERVICE
+  - NET_RAW
+  - SETGID
+  - SETUID
+  - SYS_ADMIN
+defaultAddCapabilities:
+  - DAC_OVERRIDE
+fsGroup:
+  type: MustRunAs
+readOnlyRootFilesystem: false
+requiredDropCapabilities:
+  - ALL
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+volumes:
+  - configMap
+  - downwardAPI
+  - emptyDir
+  - projected
+  - secret
+users: []
+groups: []
+priority: null
diff --git a/bindata/network/frr-k8s/frr-k8s.yaml b/bindata/network/frr-k8s/frr-k8s.yaml
index 102c5007d9..42b1b60eb4 100644
--- a/bindata/network/frr-k8s/frr-k8s.yaml
+++ b/bindata/network/frr-k8s/frr-k8s.yaml
@@ -25,7 +25,7 @@ spec:
         component: frr-k8s
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: privileged
+        openshift.io/required-scc: frr-k8s
     spec:
       serviceAccountName: frr-k8s-daemon
       priorityClassName: system-node-critical
@@ -167,10 +167,13 @@ spec:
           readOnlyRootFilesystem: true
           capabilities:
             add:
+            - CHOWN
             - NET_ADMIN
+            - NET_BIND_SERVICE
             - NET_RAW
+            - SETGID
+            - SETUID
             - SYS_ADMIN
-            - NET_BIND_SERVICE
         image: {{.FRRK8sImage}}
         env:
         - name: TINI_SUBREAPER
diff --git a/bindata/network/frr-k8s/node-status-cleaner.yaml b/bindata/network/frr-k8s/node-status-cleaner.yaml
index 7a558d73fb..b9fe3e0779 100644
--- a/bindata/network/frr-k8s/node-status-cleaner.yaml
+++ b/bindata/network/frr-k8s/node-status-cleaner.yaml
@@ -18,7 +18,7 @@ spec:
         component: frr-k8s-statuscleaner
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: privileged
+        openshift.io/required-scc: frr-k8s
     spec:
       containers:
       - command:
diff --git a/pkg/network/render_test.go b/pkg/network/render_test.go
index c9ce1f099e..1832163d43 100644
--- a/pkg/network/render_test.go
+++ b/pkg/network/render_test.go
@@ -593,7 +593,7 @@ func Test_renderAdditionalRoutingCapabilities(t *testing.T) {
 					},
 				},
 			},
-			want:        21,
+			want:        23,
 			expectedErr: nil,
 		},
 	}