fix: Add Security context constrint for openshift

[odinnordico]

Pull request

What this PR does / why we need it

When adding the security context, the component fails to be installed in an openshift cluster due to it does not match any securitycontextconstraint

Which issue(s) this PR fixes

Fixes N/A

Describe testing done for PR

• Install TAP in a openshift cluster
• Apply the following file

Click to expand

#@ load("@ytt:data", "data")
#@ load("@ytt:assert", "assert")
​
#@ kubernetes_distribution = data.values.kubernetes_distribution
#@ validDistributions = [None, "", "openshift"]
#@ if kubernetes_distribution not in validDistributions:
#@   assert.fail("{} not in {}".format(kubernetes_distribution, validDistributions))
#@ end
​
#@ if kubernetes_distribution == "openshift":
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: service-binding-nonroot-scc
  namespace: service-bindings
rules:
- apiGroups:
  - security.openshift.io
  resourceNames:
  - service-binding-scc
  resources:
  - securitycontextconstraints
  verbs:
  - use
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: service-binding-nonroot-scc
  namespace: service-bindings
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: service-binding-nonroot-scc
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:serviceaccounts:service-bindings
---
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: MustRunAs
groups: []
kind: SecurityContextConstraints
metadata:
  name: service-binding-scc
priority: null
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
runAsUser:
  type: MustRunAsNonRoot
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
seccompProfiles:
- runtime/default
users: []
volumes:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- persistentVolumeClaim
- projected
- secret
#@ end

• Check SB is up after deleting the deployment and kicking the SB app

Additional information or special notes for your reviewer

[codecov-commenter]

Codecov Report

Merging #297 (ffe0b48) into main (787d0ca) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #297   +/-   ##
=======================================
  Coverage   93.02%   93.02%           
=======================================
  Files          16       16           
  Lines         774      774           
=======================================
  Hits          720      720           
  Misses         42       42           
  Partials       12       12