Problem

The SecurityPolicy custom resource definition (CRD) for policy-as-code is the first CRD introduced to the StackRox application (as opposed to Central and SecuredCluster CRDs, which are part of the ACS operator).

This introduces a new class of problems into the installation of StackRox, documented in this doc, and a CRD management strategy going forward should be carefully considered.

Solution

Given the poor UX of the current solution, a different solution is being proposed: Move the CRD from the crds directory to the template directory. This significantly improves the customer UX since the CRD will be both created and upgraded automatically by Helm.