add: Security context constraints

ray-operator/config/openshift/kuberay-operator-image-patch.yaml

@@ -0,0 +1,10 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kuberay-operator
+spec:
+  template:
+    spec:
+      containers:
+      - name: kuberay-operator
+        image: $(image)

ray-operator/config/openshift/kustomization.yaml

@@ -0,0 +1,44 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: opendatahub
+
+configMapGenerator:
+- name: ray-config
+  envs:
+    - params.env
+
+configurations:
+  - params.yaml
+
+vars:
+- name: namespace
+  objref:
+    kind: ConfigMap
+    name: ray-config
+    apiVersion: v1
+  fieldref:
+    fieldpath: data.namespace
+- name: image
+  objref:
+    kind: ConfigMap
+    name: ray-config
+    apiVersion: v1
+  fieldref:
+    fieldpath: data.odh-kuberay-operator-controller-image
+
+resources:
+- ray_operator_scc.yaml
+- ../default
+
+commonLabels:
+  app.kubernetes.io/name: kuberay
+  app.kubernetes.io/component: kuberay-operator
+
+patches:
+- path: kuberay-operator-image-patch.yaml
+  target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: kuberay-operator

ray-operator/config/openshift/params.env

@@ -0,0 +1,2 @@
+namespace=opendatahub
+odh-kuberay-operator-controller-image=quay.io/kuberay/operator:v0.6.0

ray-operator/config/openshift/params.yaml

@@ -0,0 +1,5 @@
+varReference:
+  - path: users[]
+    kind: SecurityContextConstraints
+  - path: spec/template/spec/containers[]/image
+    kind: Deployment

ray-operator/config/openshift/ray_operator_scc.yaml

@@ -0,0 +1,11 @@
+kind: SecurityContextConstraints
+apiVersion: security.openshift.io/v1
+metadata:
+  name: run-as-ray-user
+seLinuxContext:
+  type: MustRunAs
+runAsUser:
+  type: MustRunAs
+  uid: 1000
+users:
+  - 'system:serviceaccount:$(namespace):kuberay-operator'