Fix: stop rendering duplicate rossoctl-authbridge SCC (rossoctl#2354)

charts/operator/templates/rbac/authbridge-scc.yaml

@@ -1,62 +1,12 @@
 {{- if and .Values.rbac.enable (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
-# SCC for AuthBridge proxy-sidecar containers in agent namespaces.
-# Custom SCC needed because restricted-v2 does not permit CSI volumes
-# (csi.spiffe.io for SPIRE workload API).
-# groups is empty -- the operator creates per-namespace RoleBindings at runtime.
-apiVersion: security.openshift.io/v1
-kind: SecurityContextConstraints
-metadata:
-  name: rossoctl-authbridge
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-    app.kubernetes.io/component: authbridge
-groups: []
-allowHostDirVolumePlugin: false
-allowHostIPC: false
-allowHostNetwork: false
-allowHostPID: false
-allowHostPorts: false
-allowPrivilegedContainer: false
-allowPrivilegeEscalation: false
-allowedCapabilities: []
-defaultAddCapabilities: []
-requiredDropCapabilities:
-  - ALL
-fsGroup:
-  type: RunAsAny
-runAsUser:
-  type: MustRunAsNonRoot
-seLinuxContext:
-  type: MustRunAs
-supplementalGroups:
-  type: RunAsAny
-seccompProfiles:
-  - runtime/default
-volumes:
-  - configMap
-  - csi
-  - downwardAPI
-  - emptyDir
-  - ephemeral
-  - persistentVolumeClaim
-  - projected
-  - secret
----
-# ClusterRole granting "use" on the rossoctl-authbridge SCC.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: system:openshift:scc:rossoctl-authbridge
-  labels:
-    {{- include "chart.labels" . | nindent 4 }}
-    app.kubernetes.io/component: authbridge
-rules:
-  - apiGroups: ["security.openshift.io"]
-    resources: ["securitycontextconstraints"]
-    resourceNames: ["rossoctl-authbridge"]
-    verbs: ["use"]
----
-# Grants the operator SA "use" on the SCC so it can delegate via RoleBindings.
+# The AuthBridge SecurityContextConstraints and its "use" ClusterRole are owned by the
+# rossoctl platform chart (charts/rossoctl/templates/rossoctl-authbridge-scc.yaml), which
+# ships a permissive superset spec. Rendering them here too produced a second, conflicting
+# SCC in a combined install and blocked OpenShift install (rossoctl#2354). This chart keeps
+# only the binding that grants the operator SA "use" of that SCC, so the controller
+# (ensureNamespaceSCCBinding) can delegate via per-namespace RoleBindings without an RBAC
+# privilege-escalation error. The roleRef resolves to the platform-provided ClusterRole of
+# the same name.
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata: