feat: Add security contexts to controller managers (#2759)

* Add security contexts to controller managers

Signed-off-by: kunal-511 <yoyokvunal@gmail.com>

* Fix indentation

Signed-off-by: kunal-511 <yoyokvunal@gmail.com>

* Update label

Signed-off-by: kunal-511 <yoyokvunal@gmail.com>

* Update manager.yaml

Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

* Update jobset_security_context.yaml

Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

* Updated helm charts for the jobset security context

Signed-off-by: kunal-511 <yoyokvunal@gmail.com>

* Removed already there in upstream

Signed-off-by: kunal-511 <yoyokvunal@gmail.com>

* add security context to helm charts

Signed-off-by: kunal-511 <yoyokvunal@gmail.com>

---------

Signed-off-by: kunal-511 <yoyokvunal@gmail.com>
Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
Co-authored-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Author: kunal-511

charts/kubeflow-trainer/values.yaml

@@ -92,16 +92,14 @@ manager:
     #   memory: 300Mi
 
   # -- Security context for manager containers.
-  securityContext: {}
-    # readOnlyRootFilesystem: true
-    # privileged: false
-    # allowPrivilegeEscalation: false
-    # runAsNonRoot: true
-    # capabilities:
-    #   drop:
-    #   - ALL
-    # seccompProfile:
-    #   type: RuntimeDefault
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    capabilities:
+      drop:
+      - ALL
+    seccompProfile:
+      type: RuntimeDefault
 
 webhook:
   # -- Specifies how unrecognized errors are handled.

manifests/base/manager/manager.yaml

@@ -23,6 +23,14 @@ spec:
       containers:
         - name: manager
           image: ghcr.io/kubeflow/trainer/trainer-controller-manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           volumeMounts:
             - mountPath: /tmp/k8s-webhook-server/serving-certs
               name: cert