helm: Enable user namespaces for deployment

Also switch to hostmount-anyuid-v2 SCC instead of privileged.

Author: tchap

helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml

@@ -28,7 +28,7 @@ spec:
         {{- include "olmv1.annotations" . | nindent 8 }}
         {{- if .Values.options.openshift.enabled }}
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: privileged
+        openshift.io/required-scc: hostmount-anyuid-v2
         {{- end }}
       labels:
         app.kubernetes.io/name: catalogd

helm/olmv1/templates/deployment-olmv1-system-operator-controller-controller-manager.yml

@@ -27,7 +27,7 @@ spec:
         {{- include "olmv1.annotations" . | nindent 8 }}
         {{- if .Values.options.openshift.enabled }}
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: privileged
+        openshift.io/required-scc: hostmount-anyuid-v2
         {{- end }}
       labels:
         app.kubernetes.io/name: operator-controller

helm/olmv1/templates/rbac/clusterrole-catalogd-manager-role.yml

@@ -41,7 +41,7 @@ rules:
     resources:
       - securitycontextconstraints
     resourceNames:
-      - privileged
+      - hostmount-anyuid-v2
     verbs:
       - use
   {{- end }}

helm/olmv1/templates/rbac/clusterrole-operator-controller-manager-role.yml

@@ -68,7 +68,7 @@ rules:
     resources:
       - securitycontextconstraints
     resourceNames:
-      - privileged
+      - hostmount-anyuid-v2
     verbs:
       - use
   {{- end }}

helm/olmv1/values.yaml

@@ -66,10 +66,10 @@ deployments:
     nodeSelector:
       kubernetes.io/os: linux
       node-role.kubernetes.io/control-plane: ""
+    hostUsers: false
     securityContext:
       runAsNonRoot: true
-      seccompProfile:
-        type: RuntimeDefault
+      runAsUser: 1000
     terminationGracePeriodSeconds: 10
     tolerations:
       - effect: NoSchedule

manifests/experimental-e2e.yaml

@@ -2125,13 +2125,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule
@@ -2284,13 +2284,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule

manifests/experimental.yaml

@@ -2038,13 +2038,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule
@@ -2183,13 +2183,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule

manifests/standard-e2e.yaml

@@ -1876,13 +1876,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule
@@ -2029,13 +2029,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule

manifests/standard.yaml

@@ -1789,13 +1789,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule
@@ -1928,13 +1928,13 @@ spec:
                     operator: In
                     values:
                       - linux
+      hostUsers: false
       nodeSelector:
         kubernetes.io/os: linux
         node-role.kubernetes.io/control-plane: ""
       securityContext:
         runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
+        runAsUser: 1000
       terminationGracePeriodSeconds: 10
       tolerations:
         - effect: NoSchedule