Use restricted-v3 SCC profile

Author: tchap

bindata/assets/openshift-controller-manager/deploy.yaml

@@ -33,14 +33,13 @@ spec:
       name: openshift-controller-manager
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: nonroot-v2
+        openshift.io/required-scc: restricted-v3
       labels:
         app: openshift-controller-manager-a
         controller-manager: "true"
     spec:
       hostUsers: false
       securityContext:
-        runAsNonRoot: true
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000

bindata/assets/openshift-controller-manager/informer-clusterrole.yaml

@@ -21,12 +21,3 @@ rules:
   - create
   - patch
   - update
-  # Allow for nonroot-v2 SCC
-- apiGroups:
-  - security.openshift.io
-  resources:
-  - securitycontextconstraints
-  resourceNames:
-  - nonroot-v2
-  verbs:
-  - use

bindata/assets/openshift-controller-manager/route-controller-manager-clusterrole.yaml

@@ -49,12 +49,3 @@ rules:
   - get
   - list
   - watch
-# Allow for nonroot-v2 SCC
-- apiGroups:
-  - security.openshift.io
-  resources:
-  - securitycontextconstraints
-  resourceNames:
-  - nonroot-v2
-  verbs:
-  - use

bindata/assets/openshift-controller-manager/route-controller-manager-deploy.yaml

@@ -23,14 +23,13 @@ spec:
       name: route-controller-manager
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: nonroot-v2
+        openshift.io/required-scc: restricted-v3
       labels:
         app: route-controller-manager
         route-controller-manager: "true"
     spec:
       hostUsers: false
       securityContext:
-        runAsNonRoot: true
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000

manifests/09_deployment.yaml

@@ -19,13 +19,12 @@ spec:
       name: openshift-controller-manager-operator
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-        openshift.io/required-scc: nonroot-v2
+        openshift.io/required-scc: restricted-v3
       labels:
         app: openshift-controller-manager-operator
     spec:
       hostUsers: false
       securityContext:
-        runAsNonRoot: true
         runAsUser: 1000
         runAsGroup: 1000
         fsGroup: 1000