scc.yaml

# remember to "oc set sa deployment openvpn-server ovpnrunner"
# also, you need to manually modprobe tun to all worker nodes (or use the modules operator)
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ovpnrunner
  namespace: openvpn-server

---
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
metadata:
  name: anyuid-netadmin
  annotations:
  ⦙ kubernetes.io/description: anyuid scc with mknod and net_admin capabilities
allowedCapabilities:
  - NET_ADMIN
  - MKNOD
fsGroup:
  type: RunAsAny
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: system:openshift:scc:anyuid-netadmin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:anyuid-netadmin
subjects:
- kind: ServiceAccount
  name: ovpnrunner
  namespace: openvpn-server
rules:
- apiGroups:
  - security.openshift.io
  resourceNames:
  - anyuid-netadmin
  resources:
  - securitycontextconstraints
  verbs:
  - use