add explicit securityContexts to the controller and namespace label f…

…or privileged

This does not really change the configuration, it just makes it explicit and enforce
the defaults, except for the seccompPolicy which changes from Unconfined to RuntimeDefault.
Syscalls filtered by RuntimeDefault policy are 95% namespaced and require capabilities
(which we drop) in the first place, so no practical change there either.

This allows the controller to be compatible to the restricted pod security admission profile.
However, the nmi daemonset requires the privileged profile which is why this also adds the
corresponding label to the namespace, to allow cluster-wide enforcement of a policy lower
than privileged, while preserving privileged for the capz-system namespace.

This is a recommendation in the CAPI v1.3->1.4 upgrade guide.

config/default/namespace.yaml

@@ -2,3 +2,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: system
+  labels:
+    # this is required due to the nmi daemonset
+    pod-security.kubernetes.io/enforce: privileged

config/manager/manager.yaml

@@ -57,6 +57,17 @@ spec:
             valueFrom:
               fieldRef:
                 fieldPath: metadata.namespace
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsUser: 65532
+          runAsGroup: 65532
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       terminationGracePeriodSeconds: 10
       serviceAccountName: manager
       tolerations: