add: Security context constraints

ray-operator/config/openshift/kustomization.yaml

@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: opendatahub
+
+configMapGenerator:
+- name: ray-config
+  envs:
+    - params.env
+configurations:
+  - params.yaml
+
+vars:
+- name: namespace
+  objref:
+    kind: ConfigMap
+    name: ray-config
+    apiVersion: v1
+  fieldref:
+    fieldpath: data.namespace
+
+resources:
+- ray_operator_scc.yaml
+- ../default
+
+commonLabels:
+  app.kubernetes.io/name: kuberay
+  app.kubernetes.io/component: kuberay-operator

ray-operator/config/openshift/params.env

@@ -0,0 +1 @@
+namespace=opendatahub

ray-operator/config/openshift/params.yaml

@@ -0,0 +1,7 @@
+varReference:
+  - path: subjects[]/namespace
+    kind: ClusterRoleBinding
+  - path: users[]
+    kind: SecurityContextConstraints
+  - path: spec/template/spec/containers[]/image
+    kind: Deployment

ray-operator/config/openshift/ray_operator_scc.yaml

@@ -0,0 +1,11 @@
+kind: SecurityContextConstraints
+apiVersion: security.openshift.io/v1
+metadata:
+  name: run-as-ray-user
+seLinuxContext:
+  type: MustRunAs
+runAsUser:
+  type: MustRunAs
+  uid: 1000
+users:
+  - 'system:serviceaccount:$(namespace):kuberay-operator'