Add SecurityContext to containers <JIRA:OSPRH-34267>

[mumesan]

Description:

Applies a hardened SecurityContext to the OpenstackProvisionServer containers. This SecurityContext makes sure that it runs as non root, does not allow privilege escalation, read only root file system, drops all capabilities and runtime Seccomp profile. Also created emptyDir scratch volumes for the paths that still need to be writable.

Jira: OSPRH-34267

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mumesan
Once this PR has been reviewed and has the lgtm label, please assign rabi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• WIP

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 6cdc0902-2928-482b-9404-50a8db060736

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/fcc08c814e09403aae02dcd34ac6c9ba

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 53m 24s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 31m 41s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 2h 33m 18s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/def39de18ae940f8880fcdcaf521dc42

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 27m 53s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 12m 47s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 2h 09m 28s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/537242e8ba5e480ca230432473ae98af

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 33m 44s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 18m 14s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 2h 14m 33s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/5baaac87c16c480ab123f5879e241842

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 33m 14s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 07m 32s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 2h 15m 35s

[mumesan]

recheck

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/cfc1fba42c2e4746a7b81e6af622e82d

✔️ openstack-baremetal-operator-content-provider SUCCESS in 2h 32m 29s
❌ openstack-baremetal-operator-crc-podified-edpm-baremetal RETRY_LIMIT Host unreachable in 1h 13m 42s
❌ openstack-baremetal-operator-edpm-baremetal-minor-update FAILURE in 2h 14m 41s