CNTRLPLANE-1544: Enable user namespace for the operator

[tchap]

The operator now uses hostUsers: false in the associated deployment.
All relevant user and group IDs are set to 1000.

[openshift-ci-robot]

@tchap: This pull request references CNTRLPLANE-1544 which is a valid jira issue.

In response to this:

The operator now uses hostUsers: false in the associated deployment.
All relevant user and group IDs are set to 1000.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

Updates the kube-apiserver-operator Deployment manifest to include an OpenShift SCC annotation, disable host users, and adjust pod-level securityContext to run as UID/GID 1000 with fsGroup 1000, retaining non-root and seccomp settings. No logic changes; declarative security configuration updates only.

Changes

Cohort / File(s)	Summary of changes
Deployment security hardening manifests/0000_20_kube-apiserver-operator_06_deployment.yaml	Added annotation openshift.io/required-scc: restricted-v3; added hostUsers: false; updated securityContext.runAsUser 65534 → 1000; added runAsGroup: 1000 and fsGroup: 1000; retained runAsNonRoot: true, seccompProfile: RuntimeDefault, and automountServiceAccountToken: false.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The title succinctly conveys the primary change—enabling user namespaces for the operator—and directly corresponds to the deployment updates in the pull request, making it clear and specific.
Description Check	✅ Passed	The description directly references the configuration adjustments made in the deployment, namely setting hostUsers to false and updating user/group IDs, which aligns precisely with the changes in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 23fcbc3 and 74425de.

📒 Files selected for processing (1)

• manifests/0000_20_kube-apiserver-operator_06_deployment.yaml (2 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tchap
Once this PR has been reviewed and has the lgtm label, please assign tkashem for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tchap]

/retest

[ingvagabund]

/test okd-scos-e2e-aws-ovn

[openshift-ci]

@tchap: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-operator-single-node	74425de	link	false	/test e2e-gcp-operator-single-node
ci/prow/e2e-aws-ovn-single-node	74425de	link	false	/test e2e-aws-ovn-single-node

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.