<p>I try to create the following statefulSet: </p>

<pre><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: es-cluster
  namespace: efk
spec:
  serviceName: elasticsearch
  replicas: 3
  selector:
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
      - name: elasticsearch
        image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.2.0
        resources:
          limits:
            cpu: 1000m
          requests:
            cpu: 100m
        ports:
        - containerPort: 9200
          name: rest
          protocol: TCP
        - containerPort: 9300
          name: inter-node
          protocol: TCP
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
        env:
        - name: cluster.name
          value: k8s-logs
        - name: node.name
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: discovery.zen.ping.unicast.hosts
          value: "es-cluster-0.elasticsearch,es-cluster-1.elasticsearch,es-cluster-2.elasticsearch"
        - name: discovery.zen.minimum_master_nodes
          value: "2"
        - name: ES_JAVA_OPTS
          value: "-Xms256m -Xmx256m"
      initContainers:
      - name: fix-permissions
        image: busybox
        command: ["sh", "-c", "chown -R 1000:1000 /usr/share/elasticsearch/data"]
        securityContext:
          privileged: true
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
      - name: increase-vm-max-map
        image: busybox
        command: ["sysctl", "-w", "vm.max_map_count=262144"]
        securityContext:
          privileged: true
      - name: increase-fd-ulimit
        image: busybox
        command: ["sh", "-c", "ulimit -n 65536"]
        securityContext:
          privileged: true
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: "pv0002"
      resources:
        requests:
          storage: 100Mi
</code></pre>

<p>Unfortunately I run in the following exception which I don't seem to be able to resolve: </p>

<blockquote>
  <p>create Pod es-cluster-0 in StatefulSet es-cluster failed error: pods
  "es-cluster-0" is forbidden: unable to validate against any security
  context constraint:
  [spec.initContainers[0].securityContext.privileged: Invalid value:
  true: Privileged containers are not allowed
  spec.initContainers[1].securityContext.privileged: Invalid value:
  true: Privileged containers are not allowed
  spec.initContainers[2].securityContext.privileged: Invalid value:
  true: Privileged containers are not allowed]</p>
</blockquote>

<p>I added: </p>

<pre><code>oc adm policy add-scc-to-user privileged developer
</code></pre>

<p>Not sure what else I'm supposed to check, I expect it to work. </p>

<p>Note: I use CRC on Mac OSX locally. 
<a href="https://github.com/code-ready/crc" rel="noreferrer">https://github.com/code-ready/crc</a></p>

<p>Edit, I went overboard and added all possible users that came to mind: </p>

<pre><code>oc describe scc 

Name:                                           privileged
Priority:                                       &lt;none&gt;
Access:                                         
  Users:                                        system:admin,system:serviceaccount:openshift-infra:build-controller,developer,deployer,default,builder,statefulset-controller
  Groups:                                       system:cluster-admins,system:nodes,system:masters
Settings:                                       
  Allow Privileged:                             true
  Allow Privilege Escalation:                   true
  Default Add Capabilities:                     &lt;none&gt;
  Required Drop Capabilities:                   &lt;none&gt;
  Allowed Capabilities:                         *
  Allowed Seccomp Profiles:                     *
  Allowed Volume Types:                         *
  Allowed Flexvolumes:                          &lt;all&gt;
  Allowed Unsafe Sysctls:                       *
  Forbidden Sysctls:                            &lt;none&gt;
  Allow Host Network:                           true
  Allow Host Ports:                             true
  Allow Host PID:                               true
  Allow Host IPC:                               true
  Read Only Root Filesystem:                    false
  Run As User Strategy: RunAsAny                
    UID:                                        &lt;none&gt;
    UID Range Min:                              &lt;none&gt;
    UID Range Max:                              &lt;none&gt;
  SELinux Context Strategy: RunAsAny            
    User:                                       &lt;none&gt;
    Role:                                       &lt;none&gt;
    Type:                                       &lt;none&gt;
    Level:                                      &lt;none&gt;
  FSGroup Strategy: RunAsAny                    
    Ranges:                                     &lt;none&gt;
  Supplemental Groups Strategy: RunAsAny        
    Ranges:                                     &lt;none&gt;
</code></pre>

<p>Same error wtf... </p>

<p>Fixed this by using: </p>

<pre><code>oc adm policy add-scc-to-user privileged -z default -n efk
</code></pre>

<p>Manual: </p>

<blockquote>
  <p>-z, --serviceaccount=[]: service account in the current namespace to use as a user</p>
</blockquote>
