fix: make security context configs more restrictive

[vtikoo]

Reason for Change:
Updated the security context related configs of the sgx device plugin to be more restrictive.

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• tested upgrade from previous version

Notes:

[vtikoo]

/assign @salsal97 @jackfrancis

[salsal97]

Looks good! Does the test also need to be updated? Its at test/e2e/kubernetes/workloads/sgx-test.yaml

[mboersma]

/azp run pr-e2e

[azure-pipelines]

Azure Pipelines could not run because the pipeline triggers exclude this branch/path.

[jackfrancis]

We should definitely keep the E2E test up-to-date w/ doc recommendations!

[vtikoo]

@salsal97 @jackfrancis the e2e test is a slightly different scenario, as its not using a device plugin and directly accessing /dev/sgx on the host.
We can however update the e2e test to use a device plugin in a future PR, as thats the workflow we are recommending users. Any thoughts on that?

[jackfrancis]

@vtikoo Makes sense. So it sounds like we're not really testing/validating what we're recommending?

What would be involved to update our tests? Is it as simple as updating the spec we kubectl apply onto the cluster?

[vtikoo]

@jackfrancis It would involve installing the sgx device plugin before the actual test workload runs.

For installing the device plugin, we could either kubectl apply it and wait for it to be ready, or create an addon/extension. The latter would be more effort, but might be useful to users as well.

[jackfrancis]

Right, thanks for clarifying, yeah, let's add a follow-up task to do the kubectl apply + run updated spec in the E2E tests.

[jackfrancis]

/lgtm

[acs-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jackfrancis, salsal97, vtikoo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jackfrancis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jackfrancis]

Added this backlog issue: #3462