Post-Update Security Hardening

You must perform the steps in this section only after the monthly update is complete and the environment runs version 26.6 or later. These hardening steps are optional. You must apply them when you want to move to the hardened-security posture for OpenShift.

To harden security for environment version 26.6 or later:

1. Complete the post-update security hardening procedure. For more information, see Post-Update Security Hardening for SCM and Siebel Pods.
2. Remove the privileged SCC grant from SCM:

   oc -n <scm_namespace> adm policy remove-scc-from-user privileged -z scm-service-account

3. Remove unused SCC grants from the default service account:

   oc adm policy remove-scc-from-user nonroot-v2 -z default -n <namespace>
   oc adm policy remove-scc-from-user privileged -z default -n <namespace>
   oc adm policy remove-scc-from-user hostmount-anyuid -z default -n <namespace>

4. Remove old SCC grants for Siebel and observability that are no longer required:

   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z list-svc-sa
   oc -n <siebel_namespace> adm policy remove-scc-from-user privileged -z list-svc-sa
   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z default
   oc -n <siebel_namespace> adm policy remove-scc-from-user hostmount-anyuid -z default
   oc -n <siebel_namespace> adm policy remove-scc-from-user privileged -z default
   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z get-and-create-configmaps
   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z <siebel_namespace>-traefik
   oc -n <siebel_namespace> adm policy remove-scc-from-user anyuid -z prometheus
   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z prometheus-adapter
   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z prometheus-alertmanager
   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z kube-state-metrics
   oc -n <siebel_namespace> adm policy remove-scc-from-user nonroot-v2 -z <siebel_namespace>-opensearch-dashboards