helm: Added Pod Security Policy

[pierluigilenoci]

Reason for Change:
We want to deploy secrets-store-csi-driver-provider-azure successfully in k8s cluster with a restricted pod-security policy enabled.

Requirements

• squashed commits
• included documentation
• added unit tests and e2e tests (if applicable).

Issue Fixed:
Fixes #404

Does this change contain code from or inspired by another project?

• Yes
• No

Special Notes for Reviewers:

This is inspired by @mo-saeed code from #404

[codecov-io]

Codecov Report

Merging #443 (ed0e949) into master (e1071ff) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #443   +/-   ##
=======================================
  Coverage   64.03%   64.03%           
=======================================
  Files           7        7           
  Lines         506      506           
=======================================
  Hits          324      324           
  Misses        148      148           
  Partials       34       34           

[pierluigilenoci]

@aramase @sozercan can we push this forward? What is needed to do that?

[aramase]

{{- if .Values.rbac.pspEnabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: {{ template "sscdpa.psp.fullname" . }}
spec:
  hostNetwork: true
  seLinux:
    rule: RunAsAny
  privileged: {{ .Values.linux.privileged }}
  volumes:
    - hostPath
    - secret
  hostPorts:
    - min: 0
      max: 65535
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  runAsUser:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
{{- end }}

[aramase]

Also, please include the default labels in the PodSecurityPolicy, Role and RoleBinding

[sozercan]

@aramase should this match deployment PSP here? https://github.com/Azure/secrets-store-csi-driver-provider-azure/blob/master/deployment/pod-security-policy.yaml#L57-L73

[aramase]

@sozercan Apart from the allowedHostPaths , the rest of the spec is very similar here. Imposing the different host paths can get tedious if users want to mount custom env file or more. WDYT?

Also, that file seems to be a little outdated. We should update it in a follow up PR.

[sozercan]

sounds good. we can have a follow up to address that.

[aramase]

Opened #479 to track the change.

[aramase]

@pierluigilenoci Added comments. PTAL and also rebase the PR when you get a chance.

[pierluigilenoci]

@aramase sorry it took me a while but last week I just couldn't. 👍🏻