core: fix openshift security context

The MKNOD capability was missing and due to recent addition some pod now
only require this cap as well as privileged.
The cap must be explicitly exposed so it can be requested by a pod.

Closes: #9234
Signed-off-by: Sébastien Han <seb@redhat.com>

cluster/examples/kubernetes/ceph/operator-openshift.yaml

@@ -18,7 +18,7 @@ allowHostNetwork: false
 # set to true if running rook with the provider as host
 allowHostPorts: false
 priority:
-allowedCapabilities: []
+allowedCapabilities: ["MKNOD"]
 allowHostIPC: true
 readOnlyRootFilesystem: false
 requiredDropCapabilities: []

pkg/apis/ceph.rook.io/v1/scc.go

@@ -42,6 +42,7 @@ func NewSecurityContextConstraints(name, namespace string) *secv1.SecurityContex
 		AllowHostIPC:             true,
 		AllowHostNetwork:         false,
 		AllowHostPorts:           false,
+		AllowedCapabilities:      []corev1.Capability{"MKNOD"},
 		RequiredDropCapabilities: []corev1.Capability{},
 		DefaultAddCapabilities:   []corev1.Capability{},
 		RunAsUser: secv1.RunAsUserStrategyOptions{