{{- if .Values.agents.podSecurity.securityContextConstraints.create }}
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
metadata:
  name: {{ template "datadog.fullname" . }}
  labels:
{{ include "datadog.labels" . | indent 4 }}
users:
- system:serviceaccount:{{ .Release.Namespace }}:{{ template "datadog.fullname" . }}
priority: 10
# Allow host ports for dsd / trace intake
allowHostPorts: {{ or .Values.datadog.dogstatsd.useHostPort .Values.datadog.apm.enabled .Values.datadog.apm.portEnabled .Values.agents.useHostNetwork }}
# Allow host PID for dogstatsd origin detection
allowHostPID: {{ or .Values.datadog.securityAgent.compliance.enabled .Values.datadog.dogstatsd.useHostPID }}
# Allow host network for the CRIO check to reach Prometheus through localhost
allowHostNetwork: {{ .Values.agents.useHostNetwork }}
# Allow hostPath for docker / process metrics
volumes:
{{ toYaml .Values.agents.podSecurity.volumes | indent 2 }}
# Use the `spc_t` selinux type to access the
# docker/cri socket + proc and cgroup stats
seLinuxContext:
{{- if .Values.agents.podSecurity.securityContext }}
    rule: MustRunAs
{{ toYaml .Values.agents.podSecurity.securityContext | indent 2 }}
{{- else if .Values.agents.podSecurity.seLinuxContext }}
{{ toYaml .Values.agents.podSecurity.seLinuxContext | replace "rule:" "type:" | indent 2 }}
{{- end }}
# system-probe requires some specific seccomp and capabilities
seccompProfiles:
{{ toYaml .Values.agents.podSecurity.seccompProfiles | indent 2 }}
allowedCapabilities:
{{ toYaml .Values.agents.podSecurity.capabilities | indent 2 }}
#
# The rest is copied from restricted SCC
#
allowHostDirVolumePlugin: true
allowHostIPC: false
allowPrivilegedContainer: {{ .Values.agents.podSecurity.privileged }}
allowedFlexVolumes: []
defaultAddCapabilities: []
fsGroup:
  type: MustRunAs
readOnlyRootFilesystem: false
runAsUser:
  type: RunAsAny
supplementalGroups:
  type: RunAsAny
# If your environment restricts user access to the Docker socket or journald (for logging)
# create or use an existing group that has access and add the GID to
# the lines below (also remove the previous line, `type: RunAsAny`)
#   type: MustRunAs
#   ranges:
#   - min: <min-group-ID>
#   - max: <max-group-ID>
requiredDropCapabilities: []
{{- end }}
