Not able to create Security Context Constraints either from yaml or from Security*Builder()

[rohanKanojia]

Here is a simple example of Security Context Constraints as a yaml file:

kind: SecurityContextConstraints
apiVersion: v1
metadata:
  name: scc-admin
allowPrivilegedContainer: true
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: RunAsAny
users:
- my-admin-user
groups:
- my-admin-group

I can simply create it using oc binary like this:

~/work : $ oc create -f scc-yaml.yml 
securitycontextconstraints "scc-admin" created
~/work : $ oc get scc
NAME               PRIV      CAPS      SELINUX     RUNASUSER          FSGROUP     SUPGROUP    PRIORITY   READONLYROOTFS   VOLUMES
anyuid             false     []        MustRunAs   RunAsAny           RunAsAny    RunAsAny    10         false            [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
hostaccess         false     []        MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <none>     false            [configMap downwardAPI emptyDir hostPath persistentVolumeClaim projected secret]
hostmount-anyuid   false     []        MustRunAs   RunAsAny           RunAsAny    RunAsAny    <none>     false            [configMap downwardAPI emptyDir hostPath nfs persistentVolumeClaim projected secret]
hostnetwork        false     []        MustRunAs   MustRunAsRange     MustRunAs   MustRunAs   <none>     false            [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
nonroot            false     []        MustRunAs   MustRunAsNonRoot   RunAsAny    RunAsAny    <none>     false            [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
privileged         true      [*]       RunAsAny    RunAsAny           RunAsAny    RunAsAny    <none>     false            [*]
restricted         false     []        MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <none>     false            [configMap downwardAPI emptyDir persistentVolumeClaim projected secret]
scc-admin          true      []        RunAsAny    RunAsAny           RunAsAny    RunAsAny    <none>     false            [awsElasticBlockStore azureDisk azureFile cephFS cinder configMap downwardAPI emptyDir fc flexVolume flocker gcePersistentDisk gitRepo glusterfs iscsi nfs persistentVolumeClaim photonPersistentDisk portworxVolume projected quobyte rbd scaleIO secret vsphere]

But i'm not able to replicate the same thing in Kubernetes Client. When i try to load the whole yaml file as a resource, it doesn't give me any error.

    SecurityContextConstraints scc1 = client.securityContextConstraints()
      .load(getClass().getResourceAsStream("/test-securitycontextconstraints.yml")).get();

When i try to do the same thing using SecurityContextConstraintBuilder(shown in below code snippet). I get the following error :the API version in the data (security.openshift.io/v1) does not match the expected API version (v1)

    SecurityContextConstraints scc2 = new SecurityContextConstraintsBuilder()
      .withNewMetadata().withName("scc1").endMetadata()
      .withAllowPrivilegedContainer(true)
      .withNewRunAsUser()
      .withType("RunAsAny")
      .endRunAsUser()
      .withNewSeLinuxContext()
      .withType("RunAsAny")
      .endSeLinuxContext()
      .withNewFsGroup()
      .withType("RunAsAny")
      .endFsGroup()
      .withNewSupplementalGroups()
      .withType("RunAsAny")
      .endSupplementalGroups()
      .addToUsers("admin")
      .addToGroups("admin-group")
      .build();

    client.securityContextConstraints().createOrReplace(scc2);  // Doesn't work!

Ideally, Kubernetes client should create the security context constraints. All these have been tested on Minishift 1.10.0 using OpenShift 3.6.0 internally.

[piyush-garg]

@hrishin @rohanKanojia @iocanel

OpenShiftClient client = new DefaultOpenShiftClient();
SecurityContextConstraints scc2 = new SecurityContextConstraintsBuilder()
      .withApiVersion("v1")
      .withNewMetadata().withName("scc1").endMetadata()
      .withAllowPrivilegedContainer(true)
      .withNewRunAsUser()
      .withType("RunAsAny")
      .endRunAsUser()
      .withNewSeLinuxContext()
      .withType("RunAsAny")
      .endSeLinuxContext()
      .withNewFsGroup()
      .withType("RunAsAny")
      .endFsGroup()
      .withNewSupplementalGroups()
      .withType("RunAsAny")
      .endSupplementalGroups()
      .addToUsers("admin")
      .addToGroups("admin-group")
      .build();

    client.securityContextConstraints().createOrReplace(scc2);

If i execute the above example just by overiding apiVersion to v1, it works. In kubernetes-model, it is using apiVersion security.openshift.io/v1