feat: Make SR-IOV Network Operator working in STIG-Enabled Kubernetes Cluster

Signed-off-by: Ivan Kolodiazhnyi <ikolodiazhny@nvidia.com>

Author: e0ne

deployment/sriov-network-operator-chart/templates/operator.yaml

@@ -47,6 +47,14 @@ spec:
             requests:
               cpu: 100m
               memory: 100Mi
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
           env:
             - name: WATCH_NAMESPACE
               valueFrom:

deployment/sriov-network-operator-chart/templates/pre-delete-webooks.yaml

@@ -23,6 +23,14 @@ spec:
       containers:
         - name: cleanup
           image: {{ .Values.images.operator }}
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
           command:
             - sriov-network-operator-config-cleanup
           args: