The DevWorkspaceOperatorConfig custom resource contains fields that can be used to configure a default pod and container securityContext. Currently these fields are used by the Dev Spaces Operator to configure a security context that allows for building containers within the cluster with the container-build SCC:

    containerSecurityContext: 
      allowPrivilegeEscalation: true
      capabilities: 
        add: 
          - SETGID
          - SETUID

However, in some cases, an admin may need to add additional configuration in order to run pods on their cluster, and so it would be helpful to expose these fields in the CheCluster to make this simpler.

In doing this, however, we would have to take care to handle the interaction between any setting on these fields and disableContainerBuildCapabilities. If container build is enabled, we would need to verify that any container/pod security context applied is compatible with the required context for container builds (e.g. an admin could not specify allowPrivilegeEscalation: false while container builds were enabled).

As a workaround, currently, the Dev Spaces Operator only sets the containerSecurityContext field, so it is possible to edit the DevWorkspaceOperatorConfig to include a default pod securityContext.