Add seccompProfile to sub-operator deployment template

[abays]

The managers.yaml template generates Deployments for ~20 child operators. While the template already includes readOnlyRootFilesystem and capability drop (added in 010517ca), it was missing seccompProfile at the pod security context level.

This adds seccompProfile: type: RuntimeDefault to match the umbrella operator's own deployment and satisfy the Restricted Pod Security Standard.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abays

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [abays]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 806fc5b6-1715-48a8-b3fa-d843af1be9af

📥 Commits

Reviewing files that changed from the base of the PR and between 84322c7 and 119e8c3.

📒 Files selected for processing (2)

• bindata/operator/managers.yaml
• config/operator/managers.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Security
  • Enabled the Kubernetes RuntimeDefault seccomp profile for service operator deployments, strengthening pod-level security.

Walkthrough

The manager Deployment pod security context now sets the seccomp profile type to RuntimeDefault in both the generated bindata manifest and the source configuration.

Changes

Manager deployment security

Layer / File(s)	Summary
Configure RuntimeDefault seccomp profile bindata/operator/managers.yaml, config/operator/managers.yaml	Both manager Deployment manifests set the pod security context seccomp profile type to RuntimeDefault.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 119e8

The deployment templates now apply the RuntimeDefault seccomp profile to child operators, improving pod security compliance without introducing an actionable merge-blocking risk; the PR is merge-ready after normal checks and review.

Suggested reviewers: stuggi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the addition of a seccomp profile to the sub-operator deployment template.
Description check	✅ Passed	The description accurately explains the seccomp profile change, its scope, and its security-standard purpose.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

OpenStackControlPlane CRD Size Report

Metric	Value
CRD JSON size	337535 bytes (330KB)
Base branch size	337535 bytes
Change	+0.00%
Status	yellow — growing

Threshold reference

Color	Range	Meaning
🟢 green	< 300KB	Comfortable
🟡 yellow	300–400KB	Growing
🟠 orange	400–750KB	Concerning
🔴 red	> 750KB	Approaching 1.5MB etcd limit (cut in half to allow space for update)

[qodo-code-review]

PR Summary by Qodo

Add RuntimeDefault seccompProfile to sub-operator Deployment template

✨ Enhancement ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Add pod-level RuntimeDefault seccompProfile to generated sub-operator Deployments.
• Align child operators with umbrella operator security defaults.
• Satisfy Kubernetes Restricted Pod Security Standard requirements.

Diagram

graph TD
  A["managers.yaml template"] --> B["Rendered Deployments"] --> C["Sub-operator Pods"] --> D["Pod securityContext"] --> E["seccompProfile: RuntimeDefault"] --> F["Restricted PSS compliance"]
  subgraph Legend
    direction LR
    _cfg["Config/Template"] ~~~ _k8s["Kubernetes Resource"] ~~~ _std["Security Standard"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Patch rendered Deployments (Kustomize/Helm post-render)

• ➕ Avoids changing the shared template
• ➕ Can be applied selectively per-operator/environment
• ➖ Easy for new sub-operators to miss the patch
• ➖ Adds operational complexity and another moving part in the build/release pipeline

2. Set seccompProfile at container securityContext instead of pod

• ➕ More granular control if different containers need different profiles
• ➕ Can override per-container where required
• ➖ More repetitive for single-container Pods
• ➖ Pod-level default is the common, simpler baseline for compliance

Recommendation: Keep the current approach: setting spec.template.spec.securityContext.seccompProfile.type: RuntimeDefault in the shared managers.yaml template is the simplest and most reliable way to ensure all generated sub-operator Deployments inherit a compliant baseline without relying on downstream patches.

Files changed (2) +4 / -0

Other (2) +4 / -0

managers.yamlAdd RuntimeDefault seccompProfile to pod securityContext +2/-0

Add RuntimeDefault seccompProfile to pod securityContext

• Adds 'seccompProfile: { type: RuntimeDefault }' under the pod 'securityContext' for sub-operator Deployments generated from this template. This hardens the Pods and aligns with Restricted PSS expectations.

bindata/operator/managers.yaml

managers.yamlMirror seccompProfile hardening in config template +2/-0

Mirror seccompProfile hardening in config template

• Mirrors the same pod-level 'seccompProfile' addition in the config-side managers template so rendered/manifests remain consistent across build paths.

config/operator/managers.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/bc9f097fef1b483cbc72a85a28dbd76c

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 13m 17s
❌ podified-multinode-edpm-deployment-crc FAILURE in 1h 51m 55s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 2h 00m 14s
❌ openstack-operator-tempest-multinode FAILURE in 1h 53m 45s
❌ openstack-operator-edpm-baremetal-minor-update FAILURE in 1h 52m 22s