scripts: Add downstream-only patches for custom Pod securityContext configurations

Signed-off-by: timflannagan <[email protected]>

Author: timflannagan

scripts/catalog-deployment.patch.yaml

@@ -9,3 +9,16 @@
   value:
     name: RELEASE_VERSION
     value: "0.0.1-snapshot"
+- command: update
+  path: spec.template.spec.containers[*].securityContext
+  value:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+- command: update
+  path: spec.template.spec.securityContext
+  value:
+    runAsNonRoot: true
+    runAsUser: 65534
+    seccompProfile:
+      type: RuntimeDefault

scripts/olm-deployment.patch.yaml

@@ -9,3 +9,16 @@
   value:
     name: RELEASE_VERSION
     value: "0.0.1-snapshot"
+- command: update
+  path: spec.template.spec.containers[*].securityContext
+  value:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+- command: update
+  path: spec.template.spec.securityContext
+  value:
+    runAsNonRoot: true
+    runAsUser: 65534
+    seccompProfile:
+      type: RuntimeDefault

scripts/packageserver-deployment.patch.yaml

@@ -33,3 +33,16 @@
             values:
             - packageserver
         topologyKey: "kubernetes.io/hostname"
+- command: update
+  path: spec.install.spec.deployments[0].spec.template.spec.containers[*].securityContext
+  value:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+- command: update
+  path: spec.install.spec.deployments[0].spec.template.spec.securityContext
+  value:
+    runAsNonRoot: true
+    runAsUser: 65534
+    seccompProfile:
+      type: RuntimeDefault