Allow for configuring the injected sidecar container's securityContext

[chgl]

Currently, the securityContext of the injected jaeger-agent container can not be configured, causing the agent container to fail with "container has runAsNonRoot and image will run as root" when running in a cluster with strict PSPs.

We could reuse the securityContext from the common jaeger spec (as in #1166) or add a a securityContext element to the Spec.Agent type.

In addition, a lot of headaches may be avoided by setting the the jaeger-agent container user to a non-root one by default. This should be realtively straight-forward as I don't think the jaeger-agent requires any privileges or disk access. I'd like to create a PR for this, but I can't find the jaeger-agent image's Dockerfile.

[jpkrohling]

If there's a security context for individual containers in a pod, the Jaeger Agent container should indeed use the security context from the Jaeger's CR. The fix would be somewhere around here:

jaeger-operator/pkg/inject/sidecar.go

Lines 230 to 279 in d941663

	return corev1.Container{
	Image: util.ImageName(jaeger.Spec.Agent.Image, "jaeger-agent-image"),
	Name: "jaeger-agent",
	Args: args,
	Env: []corev1.EnvVar{
	{
	Name: envVarPodName,
	ValueFrom: &corev1.EnvVarSource{
	FieldRef: &corev1.ObjectFieldSelector{
	FieldPath: "metadata.name",
	},
	},
	},
	{
	Name: envVarHostIP,
	ValueFrom: &corev1.EnvVarSource{
	FieldRef: &corev1.ObjectFieldSelector{
	FieldPath: "status.hostIP",
	},
	},
	},
	},
	Ports: []corev1.ContainerPort{
	{
	ContainerPort: zkCompactTrft,
	Name: "zk-compact-trft",
	Protocol: corev1.ProtocolUDP,
	},
	{
	ContainerPort: configRest,
	Name: "config-rest",
	},
	{
	ContainerPort: jgCompactTrft,
	Name: "jg-compact-trft",
	Protocol: corev1.ProtocolUDP,
	},
	{
	ContainerPort: jgBinaryTrft,
	Name: "jg-binary-trft",
	Protocol: corev1.ProtocolUDP,
	},
	{
	ContainerPort: adminPort,
	Name: "admin-http",
	},
	},
	Resources: commonSpec.Resources,
	VolumeMounts: volumesAndMountsSpec.VolumeMounts,
	}

And here's the Dockerfile for Jaeger Agent: https://github.com/jaegertracing/jaeger/blob/master/cmd/agent/Dockerfile

[chgl]

Sounds good! I'll create a PR to add the securityContext and will also propose to update the Dockerfile.