CNTRLPLANE-1544: pkg/manifests: Enable user namespaces

[tchap]

This updates the DaemonSet manifests to enable user namespaces and also restrict the DS so that it is aligned with restricted-v3 scc policy.

[openshift-ci-robot]

@tchap: This pull request references CNTRLPLANE-1544 which is a valid jira issue.

Details

In response to this:

This updates the DaemonSet manifests to enable user namespaces and also restrict the DS so that it is aligned with restricted-v3 scc policy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign knobunc for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@tchap: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[alebedev87]

/assign @rikatz

[tchap]

/hold

I've been having issues with merging PRs that affect and break HyperShift. Does this affect HyperShift?

[rikatz]

@tchap do you still need review here, given your last "hold" request?

[tchap]

@rikatz We can still merge this provided this is not being used by Hypershift. Is this being used by Hypershift? 🙂

[rikatz]

@tchap I think you are missing some changes in

cluster-dns-operator/pkg/operator/controller/controller_dns_daemonset.go

Line 84 in 1d014df

func desiredDNSDaemonSet(dns *operatorv1.DNS, coreDNSImage, kubeRBACProxyImage string, caBundleRevisionMap map[string]string) (*appsv1.DaemonSet, error) {

(and on unit test).

From the DNS operator perspective, it considers the old and new manifest the same given this comparison, and it will not recreate the Daemonset nor the DNS pods (which I think is your expectation?)

If so, can you please fix so a cluster being upgraded also gets these directives?

Also, please feel free to ping me in Slack if I take too long to answer here, as I miss a lot of Github notifications (sorry!)