Enterprise License Job PodSecurityPolicy

[lkysow]

• add podsecuritypolicy for enterprise license job following the pattern
  for other psps
• set same requirements across resources for rendering: servers enabled
  and enterprise license secret fully specified. The different resources
  had different requirements before, for example that clients are running
  or that bootstrapACLs are true
• always create a separate service account for the job, even if acls are
  disabled. This is to match the pattern across the rest of the templates
  where we always create a separate service account
• remove comment across our PSP's that RunAsAny prevented running as root. This is not correct.

[lkysow]

@adilyse would appreciate a look at this from you. In #172 you made using a separate service account for the ent-license job dependent on whether ACLs were enabled. This was because the clusterrole was only needed if acls were enabled.

Now the clusterrole is needed if ACLs are enabled or if psp's are enabled. I could add that conditional to the service account but I looked at the rest of our templates and we're always creating a service account, even if we don't need to target it via a clusterrole rule. I think this pattern makes sense (to always have a service account per component) but would like your review.

[ishustava]

Looks good to me! I left a couple of comments, but nothing blocking.

[ishustava]

I'm curious, are you deleting these comments because of duplication?

[lkysow]

I'm deleting them because they're incorrect. RunAsAny means the container can run as anything. It doesn't prevent root. MustRunAs or MayRunAs can be used to prevent root.