Restricted PodSecurity violation from deployments

[matzew]

Running with a restricted knative-eventing Namespace:

apiVersion: v1
kind: Namespace
metadata:
  name: knative-eventing
  labels:
    eventing.knative.dev/release: devel
    app.kubernetes.io/version: devel
    app.kubernetes.io/name: knative-eventing
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted 

Results in warnings, like (here for the eventing-controller):

Warning: would violate PodSecurity "restricted:latest": unrestricted capabilities (container "eventing-controller" must set securityContext.capabilities.drop=["ALL"]), seccompProfile (pod or container "eventing-controller" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

No deployments are being created

[matzew]

/assign matzew

[matzew]

Related is also that currently we have all in the capabilities section, but it must be ALL since this is the only acceptable string check here and here.

[matzew]

With ALL instead of all, the warning per deployment reduces to:

Warning: would violate PodSecurity "restricted:latest": seccompProfile (pod or container "eventing-webhook" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

[matzew]

Adding the following to the deployments.apps:

...
          seccompProfile:
            type: RuntimeDefault
...

lets the deployment succeed.