fix: add missing seccompProfile to comply with restricted policy

[hamidos]

What type of PR is this?

/kind bug

What does this PR do / why we need it:

Add missing seccompProfile to comply with restricted policy

Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:

#1492

[svghadi]

Hi @hamidos, thanks for the PR. The change looks good. Can you fix the code-gen CI job? Below should probably fix it

make operator-sdk controller-gen
make generate manifests bundle

[hamidos]

Hello @svghadi , Thank you for your feedback.
I did fix the code-gen CI job, and also added the seccompProfile to the argocd components applicationset, dex, notifications, redis and exporter job .

[svghadi]

Awesome. I will run some local tests to see if any other deployment needs seccompProfile.

[svghadi]

Ran some tests, the change looks good. We are still missing securityContext for keycloak deployment, can we handle that in this PR?

$ kubectl label --overwrite --dry-run=server ns test pod-security.kubernetes.io/enforce=restricted
Warning: existing pods in namespace "test" violate the new PodSecurity enforce level "restricted:latest"
Warning: keycloak-6b8bbb786d-zrssz: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile
namespace/test labeled (server dry run)

The changes will probably need to be made in 2 places for keycloak:

• argocd-operator/controllers/argocd/keycloak.go

  Line 199 in f8b8fab

  func getKeycloakContainer(cr *argoproj.ArgoCD) corev1.Container {

• argocd-operator/controllers/argocd/keycloak.go

  Line 593 in f8b8fab

  func newKeycloakDeployment(cr *argoproj.ArgoCD) *k8sappsv1.Deployment {

[hamidos]

Hello @svghadi,
I've added the security context for keycloak deployment.
It would be a good idea to enable restricted profile in the namespaces while running the E2E KUTTL tests.

[svghadi]

Yes, sounds good. However, it seems that KUTTL doesn't support adding labels to the namespaces it automatically creates during tests, which happens for most of our tests. Maybe we could create a new test that manually creates a namespace with the required pod security labels, deploys an ArgoCD CR in it, and then runs the tests.

[svghadi]

LGTM. Thanks @hamidos for the contribution.