fsGroup is not always permitted

[ebaron]

It seems that a fix beyond #244 is needed to solve #243 in all cluster configurations.

In OpenShift, SecurityContextConstraints can forbid the fsGroup value we added:

Error creating: pods "cryostat-sample-775b9b7d9d-" is forbidden: unable to validate against any security context constraint: [provider restricted: .spec.securityContext.fsGroup: Invalid value: []int64{18500}: 18500 is not an allowed group]

https://docs.openshift.com/container-platform/4.8/authentication/managing-security-context-constraints.html#security-context-constraints-pre-allocated-values_configuring-internal-oauth

There are also PodSecurityPolicies, where a range of GIDs can be specified for allowable fsGroup values:
https://kubernetes.io/docs/concepts/policy/pod-security-policy/

[ebaron]

From testing on two OpenShift clusters, it seems that the issue only comes up in namespaces other than default. It sounds similar to #180 (comment).