fix: set restricted PSS sample context

[danish9039]

Summary

This PR updates the JupyterLab WorkspaceKind sample so generated workspace pods are compatible with Kubernetes restricted Pod Security Standards.

The change is limited to workspaces/controller/manifests/kustomize/samples/jupyterlab_v1beta1_workspacekind.yaml and adds:

• pod seccompProfile.type: RuntimeDefault
• container runAsUser: 1000
• container seccompProfile.type: RuntimeDefault

Existing fsGroup: 100, allowPrivilegeEscalation: false, capabilities.drop: [ALL], and runAsNonRoot: true are preserved.

No CRD defaults, controller reconciliation logic, codeserver, or rstudio samples are changed.

Validation

• branch based on kubeflow/notebooks:notebooks-v2
• kustomize build workspaces/controller/manifests/kustomize/samples
• source and rendered YAML assertions for the JupyterLab WorkspaceKind
• git diff --check

Related

Related to kubeflow/community-distribution#3487.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andyatmiami for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• workspaces/controller/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[thesuperzapper]

As long as we resolve the comments, I am ok with this change.

But we should also make the change to the other WorkspaceKind samples.

[thesuperzapper]

We have no such requirement to run as 1000, and this has no relation to PSS.

Please remove.

[thesuperzapper]

We should sanity check that this does not break accelerator intergration for NVIDIA or AMD GPUs.

cc @christian-heusel