Refactor catsrc pod creation to use security package

Signed-off-by: perdasilva <[email protected]>

Author: perdasilva

Diff for: pkg/controller/registry/reconciler/reconciler.go

@@ -6,6 +6,7 @@ import (
 	"hash/fnv"
 	"strings"
 
+	"github.com/operator-framework/operator-lifecycle-manager/pkg/controller/security"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -113,14 +114,6 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name string, image string, saN
 		pullPolicy = corev1.PullAlways
 	}
 
-	// Security context
-	readOnlyRootFilesystem := false
-	allowPrivilegeEscalation := false
-	runAsNonRoot := true
-
-	// See: https://github.com/operator-framework/operator-registry/blob/master/Dockerfile#L27
-	runAsUser := int64(1001)
-
 	pod := &corev1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			GenerateName: source.GetName() + "-",
@@ -172,31 +165,20 @@ func Pod(source *operatorsv1alpha1.CatalogSource, name string, image string, saN
 							corev1.ResourceMemory: resource.MustParse("50Mi"),
 						},
 					},
-					SecurityContext: &corev1.SecurityContext{
-						ReadOnlyRootFilesystem:   &readOnlyRootFilesystem,
-						AllowPrivilegeEscalation: &allowPrivilegeEscalation,
-						Capabilities: &corev1.Capabilities{
-							Drop: []corev1.Capability{"ALL"},
-						},
-					},
 					ImagePullPolicy:          pullPolicy,
 					TerminationMessagePolicy: corev1.TerminationMessageFallbackToLogsOnError,
 				},
 			},
-			SecurityContext: &corev1.PodSecurityContext{
-				RunAsNonRoot: &runAsNonRoot,
-				RunAsUser:    &runAsUser,
-				SeccompProfile: &corev1.SeccompProfile{
-					Type: corev1.SeccompProfileTypeRuntimeDefault,
-				},
-			},
 			NodeSelector: map[string]string{
 				"kubernetes.io/os": "linux",
 			},
 			ServiceAccountName: saName,
 		},
 	}
 
+	// Update pod security
+	security.ApplyPodSpecSecurity(&pod.Spec)
+
 	// Override scheduling options if specified
 	if source.Spec.GrpcPodConfig != nil {
 		grpcPodConfig := source.Spec.GrpcPodConfig