fix(shield): gate cluster OpenShift SCC privileged fields on run mode

[EdwardArchive]

Fixes #2620

Summary

The cluster SecurityContextConstraints template unconditionally granted:

allowPrivilegeEscalation: true
allowPrivilegedContainer: true

…but the cluster-shield container only requests privileged execution when not in single-process mode (see templates/cluster/deployment.yaml):

{{- if not (include "cluster.is_single_process_mode" .) }}
securityContext:
  privileged: true
  ...
  allowPrivilegeEscalation: true
{{- end }}

cluster.is_single_process_mode is true when .Values.cluster.run_mode == "single-process" or when running on GKE Autopilot. In both cases the workload no longer needs privileged or privilege escalation, but the SCC still granted them — over-permissive against least-privilege guidance and a recurring finding in OpenShift security/compliance scans.

Changes

• templates/cluster/openshift-securitycontextconstraint.yaml — compute $clusterPrivileged from not (cluster.is_single_process_mode .) and use it for both allowPrivilegeEscalation and allowPrivilegedContainer. The SCC now matches the workload's actual security context.
• tests/cluster/openshift-securitycontextconstraint_test.yaml — three new helm-unittest cases:
  • Default (multi-process) → true (unchanged behavior)
  • cluster.run_mode: single-process → false
  • GKE Autopilot (cluster_type: gke-autopilot) → false
• Chart.yaml — bump to 1.37.2.

Behavioral compatibility

The previous behavior is preserved for the default run mode (the common case). Single-process / GKE Autopilot users get a tighter SCC that still satisfies their workload — they would not have been able to use a more permissive SCC for any practical reason.

Test plan

• helm unittest --strict -f tests/cluster/openshift-securitycontextconstraint_test.yaml charts/shield → 8 passed
• helm template against tests/values/base.yaml (default / single-process / gke-autopilot) — confirmed expected boolean values.

Checklist

• Title starts with type and scope (fix(shield):)
• Chart version bumped (1.37.1 → 1.37.2)
• Tests added in tests/ with _test suffix
• No documentation change required (internal template behavior)

🤖 Generated with Claude Code

[github-actions]

Hi @EdwardArchive. Thanks for your PR.

After inspecting your changes someone with write access to this repo needs
to approve and run the workflow.