Adding seccompProfile RuntimeDefault

[tarekabouzeid]

Purpose of this PR

Proposed changes:

• Adding seccompProfile type: RuntimeDefault to controller and webhook

Change Category

• Bugfix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that could affect existing functionality)
• Documentation update

Rationale

Checklist

• I have conducted a self-review of my own code.
• I have updated documentation accordingly.
• I have added tests that prove my changes are effective or that my feature works.
• Existing unit tests pass locally with my changes.

Additional Notes

kubeflow/manifests#2912 (comment)

[jacobsalway]

LGTM as this is encouraged by EKS and in GKE Autopilot. Worth nothing this will only work in k8s 1.19 and above which conflicts with the 1.16+ support we quote in the README, however I want to reduce the quoted support to the e2e test matrix in the next release anyway.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jacobsalway

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jacobsalway]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jacobsalway]

/lgtm

[juliusvonkohout]

@tarekabouzeid @biswassri @jacobsalway we should extend this to all examples as well:

TODO We are missing a securitycontext in https://github.com/kubeflow/manifests/blob/73cbecfe604e84dfc7c0851630a6eb5733022dea/contrib/spark/sparkapplication_example.yaml and it should be upstreamed to the spark repository

    securityContext:
      capabilities:
        drop:
          - ALL
      runAsGroup: 0 # that is best practices on Kubernetes to run as anyuserid!=0 and group 0 for file access
      runAsNonRoot: true
      allowPrivilegeEscalation: false
      seccompProfile:
        type: RuntimeDefault

[juliusvonkohout]

kubeflow/manifests#2966 is an example PR, but all examples in https://github.com/kubeflow/spark-operator/tree/master/examples must be changed as well. A point release of spark-operator would help then with the Kubeflow 1.10 release, to reduce our patches

[tarekabouzeid]

@juliusvonkohout I will submit another PR to update the examples as well

@tarekabouzeid @biswassri @jacobsalway we should extend this to all examples as well:

TODO We are missing a securitycontext in https://github.com/kubeflow/manifests/blob/73cbecfe604e84dfc7c0851630a6eb5733022dea/contrib/spark/sparkapplication_example.yaml and it should be upstreamed to the spark repository

    securityContext:
      capabilities:
        drop:
          - ALL
      runAsGroup: 0 # that is best practices on Kubernetes to run as anyuserid!=0 and group 0 for file access
      runAsNonRoot: true
      allowPrivilegeEscalation: false
      seccompProfile:
        type: RuntimeDefault