Add Openshift SCC handling

[tkatila]

No description provided.

[Copilot]

Pull request overview

This PR adds OpenShift-specific support for running GPU Base Operator managed workloads under OpenShift SCC constraints, including creating SCC/RBAC resources and setting pod security context (SELinux spc_t) and ServiceAccounts where needed.

Changes:

• Add OpenShift SCC helper utilities (SCC builders + create/cleanup helpers) and wire them into DP, XPUM, DRA, and FW Update reconcilers.
• Extend RBAC to allow managing OpenShift SCCs and adjust controller/Helm operator resource requests/limits.
• Add/extend controller tests to cover SCC helpers, OpenShift reconciliation paths, and a few unrelated edge cases (log-level mapping, Prometheus reconciliation).

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/controller/xpumanager_controller.go	Ensures XPUM SCC/RBAC/SA on OpenShift and applies spc_t + SA to the DaemonSet.
internal/controller/xpumanager_controller_test.go	Adds tests for log level mapping used by XPUM OTel config.
internal/controller/suite_test.go	Adds an additional CRDDirectoryPaths entry intended for OpenShift SCC testing.
internal/controller/openshift.go	Introduces SCC builders and ensure/create/delete helpers (SCC, SA, ClusterRole, ClusterRoleBinding).
internal/controller/openshift_test.go	Adds envtest coverage for SCC helper functions.
internal/controller/misc_controller_test.go	Adds tests for nil ClusterPolicy and “already absent” Prometheus removal behavior.
internal/controller/gpufirmwareupdate_controller.go	Ensures FW-update SCC/RBAC/SA on OpenShift and sets Job SA; cleans up on finalizer.
internal/controller/dra_controller.go	Adds OpenShift SCC/RBAC creation and cleanup during DRA lifecycle; sets spc_t for SELinux.
internal/controller/dra_controller_test.go	Adds OpenShift reconciliation tests for DRA SCC resources and cleanup when switching modes.
internal/controller/deviceplugin_controller.go	Ensures DP SCC/RBAC/SA on OpenShift and sets DaemonSet ServiceAccountName; cleans up on removal.
internal/controller/deviceplugin_controller_test.go	Adds OpenShift reconciliation tests for DP + XPUM SCC resources and DaemonSet SA names.
internal/controller/clusterpolicy_controller.go	Adds OpenShift SCC RBAC markers; improves deletion finalizer update handling and status error trimming safety.
config/rbac/role.yaml	Grants SCC CRUD/use and expands clusterrole/clusterrolebinding verbs.
config/rbac/namespaced_role.yaml	Adds watch for ServiceAccounts.
config/manager/manager.yaml	Updates controller-manager resource requests/limits.
charts/gpu-base-operator/values.yaml	Updates default operator resource requests/limits in Helm values.
charts/gpu-base-operator/templates/role.yaml	Mirrors RBAC updates for Helm install.
charts/gpu-base-operator/templates/namespaced_role.yaml	Mirrors namespaced role watch update for Helm install.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.