add scc that forces ray pods to run as user 1000 (#56)

Signed-off-by: Kevin <[email protected]>

Author: KPostOffice

ray/operator/base/kustomization.yaml

@@ -22,6 +22,7 @@ resources:
 - ../rbac
 - ../manager
 - ../prometheus
+- ../scc
 
 images:
 - name: kuberay/operator

ray/operator/base/params.yaml

@@ -1,3 +1,5 @@
 varReference:
   - path: subjects[]/namespace
     kind: ClusterRoleBinding
+  - path: users[]
+    kind: SecurityContextConstraints

ray/operator/scc/kustomization.yaml

@@ -0,0 +1,6 @@
+resources:
+- ray_operator_scc.yaml
+
+commonLabels:
+  app.kubernetes.io/name: kuberay
+  app.kubernetes.io/component: kuberay-operator

ray/operator/scc/ray_operator_scc.yaml

@@ -0,0 +1,11 @@
+kind: SecurityContextConstraints
+apiVersion: security.openshift.io/v1
+metadata:
+  name: run-as-ray-user
+seLinuxContext:
+  type: MustRunAs
+runAsUser:
+  type: MustRunAs
+  uid: 1000
+users:
+  - 'system:serviceaccount:$(namespace):kuberay-operator'