Backport of Add NET_BIND_SERVICE to the security context in the deployment of Mesh Gateway (NET-6463) into release/1.0.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #3549 to be assessed for backporting due to the inclusion of the label backport/1.0.x.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@missylbytes
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: unable to process merge commit: "807c119dc615aed148295111f0f4dce1ef8f6783", automatic backport requires rebase workflow

The below text is copied from the body of the original PR.

---

Adds the NET_BIND_SERVICE to the security context in the deployment of the Mesh Gateway for the Consul Dataplane container.

This is related to this PR hashicorp/consul-dataplane#238 in the Consul Dataplane
NET-6463

How I've tested this PR

• Manual testing to see the security context is added to the Consul Dataplane container

kubectl get deployment -n consul consul-consul-mesh-gateway -o yaml
# Below has been edited for brevity
apiVersion: apps/v1
kind: Deployment
metadata:
  name: consul-consul-mesh-gateway
  namespace: consul
spec:
  template:
    spec:
      containers:
        - args:
            - -addresses=consul-consul-server.consul.svc
            - -grpc-port=8502
            - -proxy-service-id-path=/consul/service/proxy-id
            - -ca-certs=/consul/tls/ca/tls.crt
            - -credential-type=login
            - -login-bearer-token-path=/var/run/secrets/kubernetes.io/serviceaccount/token
            - -login-auth-method=consul-consul-k8s-component-auth-method
            - -login-partition=default
            - -service-partition=default
            - -log-level=info
            - -log-json=false
          command:
            - consul-dataplane
          image: docker.io/hashicorppreview/consul-dataplane:1.2.5-ubi
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL

How I expect others to test this PR

You cant test this without openshift, just install the branch with MeshGateways enabled and check to see if there is a security context.

Someone else was kind enough to test on Openshift:

Checklist

• Tests added

---

Overview of commits

• 47839c2 - 2264c14 - 807c119 - 9320f78 - 89c0a1e - b37685c - a7d3817 - e4f08c9

[hashicorp-cla]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

18 out of 19 committers have signed the CLA.

• hashicorp-copywrite[bot]
• hc-github-team-consul-core
• zalimeni
• david-yu
• analogue
• sarahalsmiller
• jm96441n
• nathancoleman
• mkam
• curtbushko
• wilkermichael
• hashi-derek
• NiniOak
• ndhanushkodi
• thisisnotashwin
• johnlanda
• lkysow
• missylbytes
• Thomas Eckert

---

Thomas Eckert seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA. If you already have a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[missylbytes]

Will reopen if this becomes an issue, but will not be back-porting until then

[david-yu]

@missylbytes No problem, the main concern was 1.2.x.