Intel TDX DCAP Operator CSV doesn't declare SCC for QGS DaemonSet — permanent ClusterRoleBinding workaround in charts/all/intel-dcap

[butler54]

Summary

On a fresh install, the Intel TDX DCAP Operator's QGS (Quote Generation Service) DaemonSet pods are rejected by SCC admission (forbidden: unable to validate against any security context constraint) because the operator's CSV does not declare/request the SCC the QGS pods actually need. coco-pattern works around this with a manually-authored ClusterRoleBinding shipped in charts/all/intel-dcap.

Impact

This is a permanent, required workaround baked into charts/all/intel-dcap for every bare-metal TDX deployment (verified present through Stability Runs 1–6, the Phase 25 manual logged deploy, and Regression Test V8 against upstream main post-#105). Without it, the QGS DaemonSet never schedules and TDX quote generation cannot start.

Evidence

• RETROSPECTIVE-RUNS-1-3.md (root cause feat: cleanup some defaults #7): "Operator CSV doesn't declare SCC requirements." Fix: "Added ClusterRoleBinding in intel-dcap chart."
• Confirmed still required as of the most recent regression validation against upstream main (Intel TDX DCAP Operator v0.1.0-era CSV).

Ask

Requesting the Intel TDX DCAP Operator CSV declare the correct SCC (or ship its own ClusterRoleBinding/RBAC) so consuming patterns don't need to carry this workaround. If this needs to be routed to a different repo (Intel upstream vs. Red Hat operator packaging), please redirect and we'll cross-file — flagging here first since the workaround currently lives in coco-pattern's charts/all/intel-dcap.

Current Workaround (for reference / prior art)

A ClusterRoleBinding granting the QGS DaemonSet's ServiceAccount the necessary SCC, shipped alongside the DCAP operator subscription in charts/all/intel-dcap.