Add SCC for clusterController on OpenShift

cost-analyzer/templates/cloud-controller-ocp-scc.yaml

@@ -0,0 +1,30 @@
+{{- if and (.Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints") (.Values.global.platforms.openshift.scc.clusterController) (.Values.clusterController.enabled) }}
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: {{ template "kubecost.clusterControllerName" . }}
+priority: 10
+allowPrivilegedContainer: true
+allowHostDirVolumePlugin: true
+allowHostNetwork: true
+allowHostPorts: true
+allowHostPID: false
+allowHostIPC: false
+readOnlyRootFilesystem: false
+runAsUser:
+  type: RunAsAny
+fsGroup:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+seccompProfiles:
+- runtime/default
+volumes:
+  - hostPath
+  - projected
+  - configMap
+users:
+  - system:serviceaccount:{{ .Release.Namespace }}:{{ template "kubecost.clusterControllerName" . }}
+{{- end }}

cost-analyzer/values-openshift.yaml

@@ -22,6 +22,7 @@ global:
       scc:
         nodeExporter: false  # Creates an SCC for Prometheus Node Exporter. This requires Node Exporter be enabled.
         networkCosts: false  # Creates an SCC for Kubecost network-costs. This requires network-costs be enabled.
+        clusterController: false  # Creates an SCC for Kubecost Cluster Controller. This requires clusterController be enabled.
       # When OpenShift is enabled, the following securityContext will be applied to all resources unless they define their own.
       securityContext:
         runAsNonRoot: true
@@ -33,3 +34,5 @@ global:
 # prometheus:
 #   nodeExporter:
 #     enabled: true  # Enable Prometheus Node Exporter.
+# clusterController:
+#   enabled: true  # Enable the Cluster Controller.