Change Openshift scc seLinuxContext to RunAsAny

[AlbertoPimpo]

When creating a securityContextContraint for Openshift, the helm chart currently set the selinux strategy to MustRunAs, but this might lead to permission errors if you are using selinux in the node and you want to mount an host folder with an HostPath.

I think there is no reason for disallowing selinux context to be changed for the fluentbit deployment. Also, this is the same behavior used by red hat for their cluster logging operator that deploys fluentd.
https://github.com/openshift/cluster-logging-operator/blob/master/internal/auth/securitycontextconstraint.go#L46

[AlbertoPimpo]

Sorry for all the pushes but I had to fix the verification of the commit 😅

[AlbertoPimpo]

@stevehipwell @naseemkullah @edsiper could you please take a look?

[stevehipwell]

@AlbertoPimpo I'm not familiar enough with OpenShift to make a call on this change.

FYI you need to rebase and bump your chart version.

[cosmo0920]

Maybe we need to ask to take a look this change @patrick-stephens ?
He sometimes do some stuffs of his technology interests of Openshift.

[AlbertoPimpo]

FYI you need to rebase and bump your chart version

@stevehipwell done 👍

[AlbertoPimpo]

If it can help, in the PodSecurityPolicy you indeed allow to change the selinux context https://github.com/fluent/helm-charts/blob/main/charts/fluent-bit/templates/psp.yaml#L28

[patrick-stephens]

I would not be a fan of changing it from one hardcoded value to another, let's make it configurable with a default.

[AlbertoPimpo]

I would not be a fan of changing it from one hardcoded value to another, let's make it configurable with a default.

@patrick-stephens I like the idea, maybe we should do the same for psp? I can take care of that.