Fix cert-manager deployment on hardening environments

[oomichi]

What type of PR is this?

/kind bug

What this PR does / why we need it:

On hardening environments, cert-manager pods could not be created from the corresponding deployments.
This adds the securityContext to solve the issue.

This is the similar change like #9398

Which issue(s) this PR fixes:

Fixes #9349

Does this PR introduce a user-facing change?:

Fix cert-manager deployment on hardening environments

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[oomichi]

There is not any cert-manager pod on the hardening job like

TASK [debug] *******************************************************************
task path: /builds/kargo-ci/kubernetes-sigs-kubespray/tests/testcases/020_check-pods-running.yml:24
Wednesday 19 October 2022  06:20:59 +0000 (0:00:00.369)       0:00:04.881 ***** 
ok: [instance-1] => {
    "msg": [
        "NAMESPACE     NAME                                      READY   STATUS    RESTARTS      AGE     IP               NODE         NOMINATED NODE   READINESS GATES",
        "default       netchecker-server-5857c6bc77-z869h        2/2     Running   1 (59s ago)   64s     10.233.87.131    instance-1   <none>           <none>",
        "kube-system   calico-kube-controllers-56fd7b8dc-vtmjz   1/1     Running   0             97s     172.30.113.243   instance-1   <none>           <none>",
        "kube-system   calico-node-vnq45                         1/1     Running   0             114s    172.30.113.243   instance-1   <none>           <none>",
        "kube-system   coredns-74d6c5659f-zkdbb                  1/1     Running   0             77s     10.233.87.129    instance-1   <none>           <none>",
        "kube-system   dns-autoscaler-6656dfd4c6-vmw2v           1/1     Running   0             73s     10.233.87.130    instance-1   <none>           <none>",
        "kube-system   etcd-instance-1                           1/1     Running   0             2m47s   172.30.113.243   instance-1   <none>           <none>",
        "kube-system   kube-apiserver-instance-1                 1/1     Running   1             2m47s   172.30.113.243   instance-1   <none>           <none>",
        "kube-system   kube-controller-manager-instance-1        1/1     Running   1             2m47s   172.30.113.243   instance-1   <none>           <none>",
        "kube-system   kube-proxy-c95pq                          1/1     Running   0             114s    172.30.113.243   instance-1   <none>           <none>",
        "kube-system   kube-scheduler-instance-1                 1/1     Running   1             2m46s   172.30.113.243   instance-1   <none>           <none>"
    ]
}

even if enabling cert-manager deployment.
That might be due to deployment issue which is reported on the issue.

[oomichi]

All cert-manager pods are running after applying this change:

ok: [instance-1] => {
    "msg": [
        "NAMESPACE      NAME                                       READY   STATUS    RESTARTS      AGE    IP              NODE         NOMINATED NODE   READINESS GATES",
        "cert-manager   cert-manager-7d457bb758-sdlbc              1/1     Running   0             101s   10.233.87.129   instance-1   <none>           <none>",
        "cert-manager   cert-manager-cainjector-79bfdbf497-tzvdx   1/1     Running   0             101s   10.233.87.130   instance-1   <none>           <none>",
        "cert-manager   cert-manager-webhook-5fb958587d-jjzwb      1/1     Running   0             101s   10.233.87.131   instance-1   <none>           <none>",
        "default        netchecker-server-5857c6bc77-x5dbd         2/2     Running   1 (66s ago)   71s    10.233.87.134   instance-1   <none>           <none>",
        "kube-system    calico-kube-controllers-56fd7b8dc-8b7bt    1/1     Running   0             106s   172.30.113.42   instance-1   <none>           <none>",
        "kube-system    calico-node-zm8hp                          1/1     Running   0             2m7s   172.30.113.42   instance-1   <none>           <none>",
        "kube-system    coredns-74d6c5659f-69cz7                   1/1     Running   0             84s    10.233.87.132   instance-1   <none>           <none>",
        "kube-system    dns-autoscaler-6656dfd4c6-lbg2w            1/1     Running   0             80s    10.233.87.133   instance-1   <none>           <none>",
        "kube-system    etcd-instance-1                            1/1     Running   0             3m1s   172.30.113.42   instance-1   <none>           <none>",
        "kube-system    kube-apiserver-instance-1                  1/1     Running   1             3m1s   172.30.113.42   instance-1   <none>           <none>",
        "kube-system    kube-controller-manager-instance-1         1/1     Running   1             3m1s   172.30.113.42   instance-1   <none>           <none>",
        "kube-system    kube-proxy-dp7hz                           1/1     Running   0             2m7s   172.30.113.42   instance-1   <none>           <none>",
        "kube-system    kube-scheduler-instance-1                  1/1     Running   1             3m1s   172.30.113.42   instance-1   <none>           <none>"
    ]
}

[yankay]

/lgtm

[floryut]

@oomichi Neat 👍

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: floryut, oomichi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [floryut,oomichi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[floryut]

(had to close/reopen to resync ~~)