title: Openshift: unable to validate against any security > context constraint
body: <p>I try to create the following statefulSet: </p>
  
  <pre><code>apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: es-cluster
    namespace: efk
  spec:
    serviceName: elasticsearch
    replicas: 3
    selector:
      matchLabels:
        app: elasticsearch
    template:
      metadata:
        labels:
          app: elasticsearch
      spec:
        containers:
        - name: elasticsearch
          image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.2.0
          resources:
            limits:
              cpu: 1000m
            requests:
              cpu: 100m
          ports:
          - containerPort: 9200
            name: rest
            protocol: TCP
          - containerPort: 9300
            name: inter-node
            protocol: TCP
          volumeMounts:
          - name: data
            mountPath: /usr/share/elasticsearch/data
          env:
          - name: cluster.name
            value: k8s-logs
          - name: node.name
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: discovery.zen.ping.unicast.hosts
            value: "es-cluster-0.elasticsearch,es-cluster-1.elasticsearch,es-cluster-2.elasticsearch"
          - name: discovery.zen.minimum_master_nodes
            value: "2"
          - name: ES_JAVA_OPTS
            value: "-Xms256m -Xmx256m"
        initContainers:
        - name: fix-permissions
          image: busybox
          command: ["sh", "-c", "chown -R 1000:1000 /usr/share/elasticsearch/data"]
          securityContext:
            privileged: true
          volumeMounts:
          - name: data
            mountPath: /usr/share/elasticsearch/data
        - name: increase-vm-max-map
          image: busybox
          command: ["sysctl", "-w", "vm.max_map_count=262144"]
          securityContext:
            privileged: true
        - name: increase-fd-ulimit
          image: busybox
          command: ["sh", "-c", "ulimit -n 65536"]
          securityContext:
            privileged: true
    volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: [ "ReadWriteOnce" ]
        storageClassName: "pv0002"
        resources:
          requests:
            storage: 100Mi
  </code></pre>
  
  <p>Unfortunately I run in the following exception which I don't seem to be able to resolve: </p>
  
  <blockquote>
    <p>create Pod es-cluster-0 in StatefulSet es-cluster failed error: pods
    "es-cluster-0" is forbidden: unable to validate against any security
    context constraint:
    [spec.initContainers[0].securityContext.privileged: Invalid value:
    true: Privileged containers are not allowed
    spec.initContainers[1].securityContext.privileged: Invalid value:
    true: Privileged containers are not allowed
    spec.initContainers[2].securityContext.privileged: Invalid value:
    true: Privileged containers are not allowed]</p>
  </blockquote>
  
  <p>I added: </p>
  
  <pre><code>oc adm policy add-scc-to-user privileged developer
  </code></pre>
  
  <p>Not sure what else I'm supposed to check, I expect it to work. </p>
  
  <p>Note: I use CRC on Mac OSX locally. 
  <a href="https://github.com/code-ready/crc" rel="noreferrer">https://github.com/code-ready/crc</a></p>
  
  <p>Edit, I went overboard and added all possible users that came to mind: </p>
  
  <pre><code>oc describe scc 
  
  Name:                                           privileged
  Priority:                                       &lt;none&gt;
  Access:                                         
    Users:                                        system:admin,system:serviceaccount:openshift-infra:build-controller,developer,deployer,default,builder,statefulset-controller
    Groups:                                       system:cluster-admins,system:nodes,system:masters
  Settings:                                       
    Allow Privileged:                             true
    Allow Privilege Escalation:                   true
    Default Add Capabilities:                     &lt;none&gt;
    Required Drop Capabilities:                   &lt;none&gt;
    Allowed Capabilities:                         *
    Allowed Seccomp Profiles:                     *
    Allowed Volume Types:                         *
    Allowed Flexvolumes:                          &lt;all&gt;
    Allowed Unsafe Sysctls:                       *
    Forbidden Sysctls:                            &lt;none&gt;
    Allow Host Network:                           true
    Allow Host Ports:                             true
    Allow Host PID:                               true
    Allow Host IPC:                               true
    Read Only Root Filesystem:                    false
    Run As User Strategy: RunAsAny                
      UID:                                        &lt;none&gt;
      UID Range Min:                              &lt;none&gt;
      UID Range Max:                              &lt;none&gt;
    SELinux Context Strategy: RunAsAny            
      User:                                       &lt;none&gt;
      Role:                                       &lt;none&gt;
      Type:                                       &lt;none&gt;
      Level:                                      &lt;none&gt;
    FSGroup Strategy: RunAsAny                    
      Ranges:                                     &lt;none&gt;
    Supplemental Groups Strategy: RunAsAny        
      Ranges:                                     &lt;none&gt;
  </code></pre>
  
  <p>Same error wtf... </p>