Replace system:build-strategy-docker role from the hpo-operator-rolebinding.yml to a more restrictive one

[khansaad]

We have added a ClusterRole in hpo-operator-rolebinding.yml file under kind: ClusterRoleBinding which has a role name as system:build-strategy-docker. This is needed to install python modules inside kubernetes/openshift.

We need to find an alternate solution to make the role more restrictive i.e. avoid giving more permissions to a role than actually required.

[khansaad]

The deployment is failing in openshift with just system:build-strategy-docker role. When we add a new role with scc:anyuid (see below), it works.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
 name: hpo-scc-crb
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: ClusterRole
 name: system:openshift:scc:anyuid
subjects:
- kind: ServiceAccount
  name: hpo-sa
  namespace: "{{ HPO_NAMESPACE }}"

To remove this dependency, we're looking into adding venv (virtual environment) in docker file and see if it works.

[khansaad]

Adding venv is not helping. We're still facing the same issue.
The docker image builds successfully and works on minikube but it fails on openshift when it rebuilds there, due to the restriction it imposes.
Looking deeper into python permissions when the modules are installed.