webhook: set securityContext

To follow the least privilege principle, the conversion and admission webhooks
are run with a non-root user (uid = 2000).

Longhorn 3701

Signed-off-by: Derek Su <derek.su@suse.com>

chart/templates/deployment-webhook.yaml

@@ -31,6 +31,8 @@ spec:
       - name: longhorn-conversion-webhook
         image: {{ template "registry_url" . }}{{ .Values.image.longhorn.manager.repository }}:{{ .Values.image.longhorn.manager.tag }}
         imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsUser: 2000
         command:
         - longhorn-manager
         - conversion-webhook
@@ -97,10 +99,15 @@ spec:
       - name: wait-longhorn-conversion-webhook
         image: {{ template "registry_url" . }}{{ .Values.image.longhorn.manager.repository }}:{{ .Values.image.longhorn.manager.tag }}
         command: ['sh', '-c', 'while [ $(curl -m 1 -s -o /dev/null -w "%{http_code}" -k https://longhorn-conversion-webhook:9443/v1/healthz) != "200" ]; do echo waiting; sleep 2; done']
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsUser: 2000
       containers:
       - name: longhorn-admission-webhook
         image: {{ template "registry_url" . }}{{ .Values.image.longhorn.manager.repository }}:{{ .Values.image.longhorn.manager.tag }}
         imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsUser: 2000
         command:
         - longhorn-manager
         - admission-webhook