Add OpenShift Compatibility to Data Flywheel Helm Chart

[Hadar301]

Summary
This PR adds full OpenShift deployment support to the Data Flywheel Helm chart, enabling deployment on OpenShift clusters with the restricted-v2 Security Context Constraints (SCC). The implementation is controlled by a feature flag and maintains backward compatibility with standard Kubernetes deployments.

Changes Overview

1. OpenShift Configuration Framework (values.yaml)
   Added openshift.enabled flag to toggle OpenShift-specific features
   Implemented security context configurations compliant with OpenShift restricted-v2 SCC:
   Pod-level: runAsNonRoot, seccompProfile (RuntimeDefault)
   Container-level: allowPrivilegeEscalation: false, drop all capabilities
   Added OpenShift Route configuration for external access (API, MLflow, Kibana, Flower) with TLS support
   Configurable storage class override (gp3-csi default)
   UBI-based init container image for OpenShift compatibility
2. Helm Template Helpers (_helpers.tpl)
   data-flywheel.podSecurityContext: Generates OpenShift-compliant pod security context
   data-flywheel.containerSecurityContext: Generates OpenShift-compliant container security context
   data-flywheel.serviceType: Dynamically selects service type (ClusterIP for OpenShift, NodePort for K8s)
3. OpenShift Routes (New files)
   api-route.yaml
   mlflow-route.yaml
   kibana-route.yaml
   flower-route.yaml
   All routes support:
   Auto-generated or custom hostnames
   Edge TLS termination
   HTTP to HTTPS redirection
   Conditional deployment based on profile settings
4. Deployment Updates (All deployment templates updated)
   Modified all deployments (API, Celery workers, MongoDB, Redis, Elasticsearch, MLflow, Kibana, Flower) to include:
   Conditional security contexts when openshift.enabled: true
   Init containers for volume preparation using UBI minimal images
   Persistent volume mounts with emptyDir volumes for stateful services (MongoDB, Redis)
   Service type switching (ClusterIP vs NodePort)
5. Secret Management Enhancement (secrets.yaml)
   Fixed secret creation to only generate secrets when values are provided
   Prevents empty secret creation that could cause deployment issues
   Improves security posture by avoiding placeholder credentials

Technical Details

1. Security Context Strategy:
   Complies with OpenShift's restricted-v2 SCC without requiring cluster-admin privileges
   Allows dynamic UID/GID assignment by OpenShift
   Drops all container capabilities and disables privilege escalation
   Uses RuntimeDefault seccomp profile
2. Init Container Pattern:
   Uses Red Hat UBI minimal image (registry.access.redhat.com/ubi8/ubi-minimal) for OpenShift
   Falls back to busybox for standard Kubernetes
   Prepares volumes for MongoDB and Redis without requiring root permissions
3. Testing Recommendations

• Test deployment with openshift.enabled: false to verify backward compatibility
• Test deployment with openshift.enabled: true on OpenShift cluster with restricted SCC
• Verify all routes are accessible with TLS enabled
• Confirm all services start successfully with proper volume permissions

Breaking Changes
None - all changes are backward compatible and gated behind the openshift.enabled flag.