(scorecard): Add new images for default untar and storage options

[everettraven]

Description of the change:

• Adds new images definitions for building custom untar and storage images for scorecard that run as a non-root user by default
• Updates defaults for the operator-sdk scorecard --storage-image and --untar-image options to use the new images so that scorecard pods are compliant with best practices for restricted PSA environments.
• Updates the image build Makefile targets and GitHub actions to include building these images

Motivation for the change:

• fixes [Scorecard] - Create images that run as a non-root user by default #6295

Checklist

If the pull request includes user-facing changes, extra documentation is required:

• Add a new changelog fragment in changelog/fragments (see changelog/fragments/00-template.yaml)
• Add or update relevant sections of the docs website in website/content/en/docs

[everettraven]

Holding for a bit for conversations and reviews.

/hold

[everettraven]

@acornett21 or @theishshah Would you mind testing/taking a look at this? I tested this and everything looked good, but would like some further verification on this.

I tested this by doing the following:

1. Creating a KinD cluster:

kind create cluster

2. Creating a test namespace:

kubectl create ns scorecard-test-ns

3. Setting the namespace as restricted:

kubectl label --overwrite ns scorecard-test-ns pod-security.kubernetes.io/audit=restricted pod-security.kubernetes.io/enforce-version=v1.25 pod-security.kubernetes.io/warn=restricted

4. Running scorecard on a version of operator-sdk built from this PR:

operator-sdk scorecard --namespace scorecard-test-ns --pod-security=restricted bundle/

Note: The operator I tested with was from the testdata and is under testdata/go/v3/memcached-operator

[acornett21]

@everettraven I can test this on Monday on OpenShift 4.12/4.13.

[acornett21]

Tests Info Below for 4.12

oc version
Client Version: 4.8.11
Server Version: 4.12.3
Kubernetes Version: v1.25.4+a34b9e9

./operator-sdk scorecard --pod-security=restricted quay.io/opdev/simple-demo-operator-bundle:v0.0.6 --output json
{
  "kind": "TestList",
  "apiVersion": "scorecard.operatorframework.io/v1alpha3",
  "items": [
    {
      "kind": "Test",
      "apiVersion": "scorecard.operatorframework.io/v1alpha3",
      "spec": {
        "image": "quay.io/operator-framework/scorecard-test:v1.12.0",
        "entrypoint": [
          "scorecard-test",
          "olm-bundle-validation"
        ],
        "labels": {
          "suite": "olm",
          "test": "olm-bundle-validation-test"
        },
        "storage": {
          "spec": {
            "mountPath": {}
          }
        }
      },
...
./operator-sdk scorecard --pod-security=restricted quay.io/opdev/simple-demo-operator-bundle:v0.0.6 --output json --namespace scorecard-test
{
  "kind": "TestList",
  "apiVersion": "scorecard.operatorframework.io/v1alpha3",
  "items": [
    {
      "kind": "Test",
      "apiVersion": "scorecard.operatorframework.io/v1alpha3",
      "spec": {
        "image": "quay.io/operator-framework/scorecard-test:v1.12.0",
        "entrypoint": [
          "scorecard-test",
          "olm-status-descriptors"
        ],
        "labels": {
          "suite": "olm",
          "test": "olm-status-descriptors-test"
        },
        "storage": {
          "spec": {
            "mountPath": {}
          }
        }
      },
...

Tests for 4.13

 oc version
Client Version: 4.8.11
Server Version: 4.13.0-ec.3
Kubernetes Version: v1.26.0+9eb81c2

./operator-sdk scorecard --pod-security=restricted quay.io/opdev/simple-demo-operator-bundle:v0.0.6 --output json
{
  "kind": "TestList",
  "apiVersion": "scorecard.operatorframework.io/v1alpha3",
  "items": [
    {
      "kind": "Test",
      "apiVersion": "scorecard.operatorframework.io/v1alpha3",
      "spec": {
        "image": "quay.io/operator-framework/scorecard-test:v1.12.0",
        "entrypoint": [
          "scorecard-test",
          "basic-check-spec"
        ],
        "labels": {
          "suite": "basic",
          "test": "basic-check-spec-test"
        },
        "storage": {
          "spec": {
            "mountPath": {}
          }
        }
      },
...
./operator-sdk scorecard --pod-security=restricted quay.io/opdev/simple-demo-operator-bundle:v0.0.6 --output json
{
  "kind": "TestList",
  "apiVersion": "scorecard.operatorframework.io/v1alpha3",
  "items": [
    {
      "kind": "Test",
      "apiVersion": "scorecard.operatorframework.io/v1alpha3",
      "spec": {
        "image": "quay.io/operator-framework/scorecard-test:v1.12.0",
        "entrypoint": [
          "scorecard-test",
          "basic-check-spec"
        ],
        "labels": {
          "suite": "basic",
          "test": "basic-check-spec-test"
        },
        "storage": {
          "spec": {
            "mountPath": {}
          }
        }
      },

This looks good on both versions of OpenShift.

[everettraven]

@acornett21 Thanks for the verification!

/hold cancel

[oceanc80]

/lgtm

[rashmigottipati]

/lgtm

[grokspawn]

/approve