Prerequisites for Updating to Version 26.6

You must complete the following steps before you run the monthly update to version 26.6 on OpenShift:

1. Create a custom non-root builder SCC as follows:
   Note: Perform this step only when you want to apply the OpenShift hardened-security posture for the image-builder service account.

   # nonroot-builder-scc.yaml
   allowHostDirVolumePlugin: false
   allowHostIPC: false
   allowHostNetwork: false
   allowHostPID: false
   allowHostPorts: false
   allowPrivilegeEscalation: true
   allowPrivilegedContainer: false
   allowedCapabilities: null
   apiVersion: security.openshift.io/v1
   defaultAddCapabilities: null
   fsGroup:
       type: RunAsAny
   groups: []
   kind: SecurityContextConstraints
   metadata:
       name: nonroot-builder
   priority: null
   readOnlyRootFilesystem: false
   requiredDropCapabilities:
   - KILL
   - MKNOD
   runAsUser:
       type: RunAsAny
   seLinuxContext:
       type: MustRunAs
   supplementalGroups:
       type: RunAsAny
   users: []
   volumes:
   - configMap
   - downwardAPI
   - emptyDir
   - persistentVolumeClaim
   - projected
   - secret

2. Apply the custom SCC:

   kubectl apply -f <path_to_nonroot-builder-scc.yaml>

3. Add required SCCs to Siebel and observability service accounts:
   Note: Existing service accounts should already have the required SCC grants from the current deployment. No additional action is needed for them. But for the monthly update to version 26.6, add the required SCC grants only for the new service accounts introduced in version 26.6.

   oc adm policy add-scc-to-user nonroot-v2 -z ses-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z sai-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z smc-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z cgw-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z connectivity-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z sfs-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z persistence-cleanup-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-builder -z image-builder-sa -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z prometheus-alertmanager -n <namespace>
   oc adm policy add-scc-to-user anyuid -z siebel-metric-exporter -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z oracle-db-monitoring -n <namespace>
   oc adm policy add-scc-to-user nonroot-v2 -z log-aggregator -n <namespace>
   oc adm policy add-scc-to-user hostmount-anyuid -z node-logs-collector -n <namespace>