operator: Adapt to k8s-1.25 security restrictions

[qinqon]

What this PR does / why we need it:
When deployed at some clusters based on k8s 1.25 the operator get the following error

Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "cluster-network-addons-operator", "kube-rbac-proxy" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "cluster-network-addons-operator", "kube-rbac-proxy" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or containers "cluster-network-addons-operator", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

To fix that the pod and container security context for the operator is fixed following instructions at redhat-openshift-ecosystem/community-operators-prod#1417.

Release note:

Fix operator pod and container security context for k8s-1.25

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[maiqueb]

v2 SCC policies requires you to:

• either leave SeccompProfile empty or set it to runtime/default
• always drop ALL. V1 only dropped KILL, MKNOD, SETUID, SETGID capabilities.
• not use allowPrivilegeEscalation=true

Couldn't you have omitted the SeccompProfile on the pod section ?...

According to the discussion, it should have been possible.

[qinqon]

v2 SCC policies requires you to:

• either leave SeccompProfile empty or set it to runtime/default
• always drop ALL. V1 only dropped KILL, MKNOD, SETUID, SETGID capabilities.
• not use allowPrivilegeEscalation=true

Couldn't you have omitted the SeccompProfile on the pod section ?...

According to the discussion, it should have been possible.

Not seting it throws a warning with

Warning: would violate PodSecurity "restricted:latest": seccompProfile (pod or containers "cluster-network-addons-operator", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

[maiqueb]

v2 SCC policies requires you to:

• either leave SeccompProfile empty or set it to runtime/default
• always drop ALL. V1 only dropped KILL, MKNOD, SETUID, SETGID capabilities.
• not use allowPrivilegeEscalation=true

Couldn't you have omitted the SeccompProfile on the pod section ?...
According to the discussion, it should have been possible.

Not seting it throws a warning with

Warning: would violate PodSecurity "restricted:latest": seccompProfile (pod or containers "cluster-network-addons-operator", "kube-rbac-proxy" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Hm, how about that ...

Would we want to raise it in the linked discussion ?...

I'm OK w/ approving this then.

[maiqueb]

Please consider if we want to provide feedback to in the discussion about this, since something seems to be amiss.

[qinqon]

Please consider if we want to provide feedback to in the discussion about this, since something seems to be amiss.

Let's get the warning gone first, we can improve the situation later on.

[phoracek]

/approve

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: phoracek

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [phoracek]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[phoracek]

/cherry-pick release-0.76

[kubevirt-bot]

@phoracek: new pull request created: #1404

In response to this:

/cherry-pick release-0.76

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[qinqon]

/cherry-pick release-0.65

[kubevirt-bot]

@qinqon: #1401 failed to apply on top of branch "release-0.65":

Applying: operator: Adapt to k8s-1.25 security restrictions
Using index info to reconstruct a base tree...
M	pkg/components/components.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/components/components.go
CONFLICT (content): Merge conflict in pkg/components/components.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 operator: Adapt to k8s-1.25 security restrictions
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-0.65

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.