chore: declare pod securityContext explicitly

[tolusha]

Signed-off-by: Anatolii Bazko abazko@redhat.com

What does this PR do?

Declare securityContext explicitly for all pods managed by che-operator

      securityContext:
        capabilities:
          drop:
            - ALL
        allowPrivilegeEscalation: false
        runAsNonRoot: true

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

eclipse-che/che#21559

How to test this PR?

N/A

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• Custom resource definition file is up to date
• OLM bundles are up to date
• The repository devfile is up to date and works
• Sections What issues does this PR fix or reference and How to test this PR completed
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

Merging #1458 (ad37118) into main (d6f5dbd) will decrease coverage by 0.05%.
The diff coverage is 43.75%.

@@            Coverage Diff             @@
##             main    #1458      +/-   ##
==========================================
- Coverage   60.41%   60.36%   -0.06%     
==========================================
  Files          74       74              
  Lines        6286     6275      -11     
==========================================
- Hits         3798     3788      -10     
- Misses       2118     2119       +1     
+ Partials      370      368       -2     

Impacted Files	Coverage Δ
pkg/deploy/deployment.go	56.38% <0.00%> (-2.51%)	⬇️
pkg/deploy/gateway/gateway.go	83.67% <75.00%> (+0.04%)	⬆️
pkg/deploy/dashboard/deployment_dashboard.go	98.74% <100.00%> (-0.07%)	⬇️
pkg/deploy/dev-workspace/dev_workspace_syncer.go	81.18% <100.00%> (+0.18%)	⬆️
...ploy/devfileregistry/devfileregistry_deployment.go	100.00% <100.00%> (ø)
...deploy/pluginregistry/pluginregistry_deployment.go	100.00% <100.00%> (ø)
pkg/deploy/postgres/postgres_deployment.go	94.07% <100.00%> (+2.77%)	⬆️
pkg/deploy/server/server_deployment.go	81.68% <100.00%> (+1.03%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us.

[tolusha]

on OpenShift :

pods "che-operator-d4bdfcc4d-" is forbidden: unable to validate against
any security context constraint: [provider "anyuid": Forbidden: not
usable by user or serviceaccount, provider restricted:
.spec.securityContext.fsGroup: Invalid value: []int64{1724}: 1724 is not
an allowed group, spec.containers[0].securityContext.runAsUser: Invalid
value: 1724: must be in the ranges: [1000400000, 1000409999], provider
"nonroot": Forbidden: not usable by user or serviceaccount, provider
"hostmount-anyuid": Forbidden: not usable by user or serviceaccount,
provider "machine-api-termination-handler": Forbidden: not usable by
user or serviceaccount, provider "hostnetwork": Forbidden: not usable by
user or serviceaccount, provider "hostaccess": Forbidden: not usable by
user or serviceaccount, provider "node-exporter": Forbidden: not usable
by user or serviceaccount, provider "privileged": Forbidden: not usable
by user or serviceaccount