<p>I'm trying to run <code>elasticsearch</code> container in my openshift project. </p>

<p>I got errors:</p>

<blockquote>
  <p>Privileged containers are not allowed capabilities.add: Invalid value:
  "IPC_LOCK": capability may not be added capabilities.add: Invalid
  value: "SYS_RESOURCE": capability may not be added</p>
</blockquote>

<p>I've found out that you need to add <code>privileged scc</code> to user account (or create own dedicated one). </p>

<p>I've tried to follow docu <a href="https://docs.openshift.com/container-platform/3.4/admin_guide/manage_scc.html" rel="nofollow noreferrer">https://docs.openshift.com/container-platform/3.4/admin_guide/manage_scc.html</a> where the following commands are given:</p>

<pre><code>oc create serviceaccount mysvcacct -n myproject
oc adm policy add-scc-to-user privileged system:serviceaccount:myproject:mysvcacct
</code></pre>

<p>However, no single clue is given what is <code>mysvcacct</code> and why it is called <code>mysvcacct</code>.</p>

<p>Because my project is called <code>logging</code>, I've tried the following: </p>

<pre><code>oc create serviceaccount logging -n logging
oc adm policy add-scc-to-user privileged system:serviceaccount:logging:logging 
</code></pre>

<p>but it didn't change anything. I keep getting the same error. </p>

<p>What I'm missing there? What name should I use instead of <code>mysvcacct</code>?</p>

9ilsdx 9rvj 0lo
<p>FYI, I introduce the example of <code>yaml</code> format.</p>

<ul>
<li>You can modify the <code>ServiceAccount</code> name using <code>oc patch dc/your-deploymentConfigName</code> cmd as follows.</li>
</ul>

<pre><code># oc patch dc/elasticsearch --patch '{"spec":{"template":{"spec":{"serviceAccountName": "logging"}}}}'</code></pre>

<ul>
<li>Or using <code>oc edit dc/your-deploymentConfigName</code>, take a look around <code>serviceAccountName</code>.</li>
</ul>

<pre><code># oc edit dc/elasticsearch
    ...
    spec:
      containers:
      - image: docker-registry.default.svc:5000/test/...
        imagePullPolicy: Always
        name: web
        ports:
        - containerPort: 8080
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: logging
      serviceAccountName: logging
</code></pre>
