Inject SCC within reconcile logic

Author: sats-23

internal/controller/service_account.go

@@ -20,13 +20,13 @@ import (
 	"context"
 	"fmt"
 
+	operatorv1alpha1 "github.com/ocp-power-automation/rsct-operator/api/v1alpha1"
+	securityv1 "github.com/openshift/api/security/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
-
-	operatorv1alpha1 "github.com/ocp-power-automation/rsct-operator/api/v1alpha1"
 )
 
 // ensureRSCTServiceAccount ensures that the RSCT service account exists.
@@ -54,7 +54,7 @@ func (r *RSCTReconciler) ensureRSCTServiceAccount(ctx context.Context, rsct *ope
 	return true, current, nil
 }
 
-// currentRSCTServiceAccount gets the current RSCT service account resource.
+// currentRSCTServiceAccount gets the current RSCT service account resource and ensures it has privileged SCC.
 func (r *RSCTReconciler) currentRSCTServiceAccount(ctx context.Context, nsName types.NamespacedName) (bool, *corev1.ServiceAccount, error) {
 	sa := &corev1.ServiceAccount{}
 	if err := r.Client.Get(ctx, nsName, sa); err != nil {
@@ -63,9 +63,41 @@ func (r *RSCTReconciler) currentRSCTServiceAccount(ctx context.Context, nsName t
 		}
 		return false, nil, err
 	}
+
+	// Try to get the privileged SCC; if not found, skip SCC logic (not OpenShift)
+	scc := &securityv1.SecurityContextConstraints{}
+	err := r.Client.Get(ctx, types.NamespacedName{Name: "privileged"}, scc)
+	if err != nil {
+		// If SCC resource type not found, skip (not OpenShift)
+		if errors.IsNotFound(err) || isNoMatchError(err) {
+			return true, sa, nil
+		}
+		return true, sa, fmt.Errorf("error getting privileged SCC: %w", err)
+	}
+
+	saUser := fmt.Sprintf("system:serviceaccount:%s:%s", nsName.Namespace, nsName.Name)
+	found := false
+	for _, user := range scc.Users {
+		if user == saUser {
+			found = true
+			break
+		}
+	}
+	if !found {
+		scc.Users = append(scc.Users, saUser)
+		if err := r.Client.Update(ctx, scc); err != nil {
+			return true, sa, fmt.Errorf("failed to update privileged SCC: %w", err)
+		}
+	}
+
 	return true, sa, nil
 }
 
+// isNoMatchError checks if the error is a NoMatchError (resource not registered, i.e., not OpenShift)
+func isNoMatchError(err error) bool {
+	return err != nil && (err.Error() == "no matches for kind \"SecurityContextConstraints\" in group \"security.openshift.io\"")
+}
+
 // desiredRSCTServiceAccount returns the desired serivce account resource.
 func desiredRSCTServiceAccount(nsName types.NamespacedName) *corev1.ServiceAccount {
 	return &corev1.ServiceAccount{