fix(helm): do not mix ignore and podSecurity labels

[sathieu]

What this PR does / why we need it:

• helm: Label exempted namespaces #2029 (and fix(helm): Fix "Label exempted namespaces" #2246) introduced a way to label extra exempted namespaces
• chore: remove PSP and migrate to PSA #2174 added PodSecurity labels to namespaces using the same job

As a result, using postInstall.labelNamespace.extraNamespaces will set restricted PodSecurity on those namespaces. This will most probably render the cluster unusable when it contains kube-system.

To fix this, we add another job.

[codecov-commenter]

Codecov Report

Base: 53.68% // Head: 53.59% // Decreases project coverage by -0.08% ⚠️

Coverage data is based on head (f01d3c1) compared to base (0fdd27e).
Patch has no changes to coverable lines.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2451      +/-   ##
==========================================
- Coverage   53.68%   53.59%   -0.09%     
==========================================
  Files         117      117              
  Lines       10292    10292              
==========================================
- Hits         5525     5516       -9     
- Misses       4346     4352       +6     
- Partials      421      424       +3     

Flag	Coverage Δ
unittests	53.59% <ø> (-0.09%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...onstrainttemplate/constrainttemplate_controller.go	55.74% <0.00%> (-1.44%)	⬇️
pkg/readiness/object_tracker.go	82.91% <0.00%> (-1.07%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[sozercan]

good catch! I think we'll need to address this for post-upgrade too?

should we add a new container to the existing job instead of a new job?

[sathieu]

good catch! I think we'll need to address this for post-upgrade too?

Yes. Done.

should we add a new container to the existing job instead of a new job?

No preferred method, I've changed to single-job.

[sozercan]

Thank you! LGTM

[maxsmythe]

LGTM, thank you for the fix!