OBSINTA-1585: remove nonroot SCC to have PSA restricted

[tremes]

This is an attempt to "increase" PSA level of the COO namespace to restricted.

    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

[openshift-ci-robot]

@tremes: This pull request references OBSINTA-1585 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the weakness to target the "5.1.0" version, but no target version was set.

Details

In response to this:

This is an attempt to "increase" PSA level of the COO namespace to restricted.

   pod-security.kubernetes.io/audit: restricted
   pod-security.kubernetes.io/warn: restricted

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tremes
Once this PR has been reviewed and has the lgtm label, please assign peteryurkovich for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e2f5b15-7c6e-473f-8295-b11c64800932

📥 Commits

Reviewing files that changed from the base of the PR and between 70764c1 and 156698c.

📒 Files selected for processing (2)

• pkg/controllers/monitoring/monitoring-stack/controller.go
• pkg/controllers/uiplugin/controller.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The changes remove the legacy nonroot Security Context Constraint from ClusterRole permissions. Controller-generated roles, deployment manifests, the admission webhook role, and the bundle manifest now grant use access only to nonroot-v2.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 15669

No actionable merge-blocking risk remains; the change is merge-ready after normal checks and review.

Suggested reviewers: jgbernalp, peteryurkovich, simonpasquier

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains the intended increase of the COO namespace PSA level to restricted.
Title check	✅ Passed	The title identifies the removal of legacy nonroot SCC access to support restricted PSA settings.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}