INT-7432 security context for openshift

[jflinchbaugh]

OpenShift wants more securityContext settings. These settings are also fine in minikube.

Reproduction:

• switch values.yaml to the red hat image: registry.connect.redhat.com/sonatype/nexus-repository-manager:3.43.0-ubi-1
• install the chart into OpenShift Local:

  $ helm install repo .
  W1116 18:33:19.487048   52333 warnings.go:70] would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nexus-repository-manager" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nexus-repository-manager" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nexus-repository-manager" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nexus-repository-manager" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

JIRA: https://issues.sonatype.org/browse/INT-7432 Build: https://jenkins.ci.sonatype.dev/job/nxrm/job/Nexus%20Repository%20Manager%203%20Helm3%20Charts/job/Feature%20Snapshot%20Builds/job/INT-7432-securityContext-for-openshift/

[jflinchbaugh]

Its hard to know from the docs about - RuntimeDefault

The warning message offers "RuntimeDefault" or "Localhost" as acceptable values. "RuntimeDefault" implies the cluster admin can set it for themselves, so more flexible when we don't know how people may have things configured. (and it continued to work without warning.)

[jflinchbaugh]

Feel free to merge this when you like it, or let me know when I can merge it.

[bobotimi]

Feel free to merge this when you like it, or let me know when I can merge it.

+1 Yep, go for it