Harden bridge-marker SCC: restrict privileges, enforce non-root, allow projected volumes

[RamLavi]

What this PR does / why we need it:
This PR improves the security posture of the bridge-marker DaemonSet in OpenShift by hardening its SecurityContextConstraints (SCC) and enforcing best practices.

Special notes for your reviewer:
To anticipate reviewers request, commented on the PR why I did NOT remove other SCCs.

Release note:

reduce bridge-marker SCC

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign qinqon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[RamLavi]

/hold
want to check this on kcli

[RamLavi]

🔒 SCC Non-Default Capabilities Review

Capability	Set To	Default	Reason
allowHostNetwork	true	false	Required to inspect the host network namespace to discover bridges.
readOnlyRootFilesystem	true	false (or unset)	Harden container filesystem; application does not need write access.
runAsUser.type	MustRunAsNonRoot	RunAsAny	Enforce non-root user for least privilege; safer runtime isolation.
seLinuxContext.type	MustRunAs	RunAsAny	Enforce confined SELinux type to ensure MCS labeling and pod isolation.
volumes	configMap, emptyDir, projected	"*" (unrestricted)	Limit volume types; prevent access to host filesystems (hostPath not allowed). projected is required for ServiceAccount tokens.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[RamLavi]

checked on kcli and it runs smoothly:

[root@hades04 cluster-network-addons-operator]# oc get pod -n cluster-network-addons -owide | grep bridge-marker
bridge-marker-77n7k                                1/1     Running   0          11m   192.168.122.222   multi-homing-worker-0.yourname.corp   <none>           <none>
bridge-marker-bw4jp                                1/1     Running   0          11m   192.168.122.223   multi-homing-worker-1.yourname.corp   <none>           <none>
[root@hades04 cluster-network-addons-operator]# oc debug node/multi-homing-worker-0.yourname.corp -- chroot /host sudo ip link add br_test5 type bridge
Starting pod/multi-homing-worker-0yournamecorp-debug-cxf6s ...
To use host binaries, run `chroot /host`

Removing debug pod ...
[root@hades04 cluster-network-addons-operator]# oc debug node/multi-homing-worker-0.yourname.corp -- chroot /host sudo ip link set br_test5 up
Starting pod/multi-homing-worker-0yournamecorp-debug-hc56w ...
To use host binaries, run `chroot /host`

Removing debug pod ...
[root@hades04 cluster-network-addons-operator]# 
[root@hades04 cluster-network-addons-operator]# 
[root@hades04 cluster-network-addons-operator]# until oc get node multi-homing-worker-0.yourname.corp -o json | jq -e '.status.allocatable["bridge.network.kubevirt.io/br_test5"]' > /dev/null; do echo "Waiting for br_test5..."; sleep 5; done; echo "br_test5 is now available!"
Waiting for br_test5...
Waiting for br_test5...
br_test5 is now available!

[RamLavi]

/hold cancel