Run SELinux warning controller

selinux-warning-controller is an optional controller in KCM that emits
metrics + events about SELinux usage of persistent volumes in the cluster.

Since most Kubernetes distros don't care about SELinux, this controller
needs explicit opt-in on KCM cmdline.
OCP needs the controller:
- to explain to users why their pods may not be running.
- to collect metrics about such promebatic pods, to emit alerts and
  telemetry.

The controller is disabled by default in Kubernetes 1.32
(under SELinuxChangePolicy feature gate).

Enhancement: https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1710-selinux-relabeling

Author: jsafrane

bindata/assets/config/defaultconfig.yaml

@@ -26,6 +26,9 @@ extendedArguments:
   - "-ttl" # TODO: this is excluded in kube-core, but not in #21092
   - "-bootstrapsigner"
   - "-tokencleaner"
+  # Most upstream clusters don't care about SELinux, therefore this controller is opt-in. OCP cares.
+  # Owner: OCP storage team, @jsafrane.
+  - "selinux-warning-controller"
   cloud-provider:
     - "external"
   cluster-signing-duration:

pkg/cmd/render/render_test.go

@@ -189,6 +189,7 @@ func TestRenderCommand(t *testing.T) {
 						"--controllers=-bootstrapsigner",
 						"--controllers=-tokencleaner",
 						"--controllers=-ttl",
+						"--controllers=selinux-warning-controller",
 						"--enable-dynamic-provisioning=true",
 						"--feature-gates=Bar=false",
 						"--feature-gates=Foo=true",
@@ -268,6 +269,7 @@ func TestRenderCommand(t *testing.T) {
 						"--controllers=-bootstrapsigner",
 						"--controllers=-tokencleaner",
 						"--controllers=-ttl",
+						"--controllers=selinux-warning-controller",
 						"--enable-dynamic-provisioning=true",
 						"--feature-gates=Bar=false",
 						"--feature-gates=Foo=true",
@@ -333,6 +335,7 @@ func TestRenderCommand(t *testing.T) {
 						"--controllers=-bootstrapsigner",
 						"--controllers=-tokencleaner",
 						"--controllers=-ttl",
+						"--controllers=selinux-warning-controller",
 						"--enable-dynamic-provisioning=true",
 						"--feature-gates=AwesomeNewFeature=true",
 						"--feature-gates=BadFailingFeature=false",