Feature Request: Non-Privilege-Escalation Support for Certificate Rotation & Backups

Feature request: Support certificate rotation & backups without privilege escalation.

According to this documentation, enabling spilo_allow_privilege_escalation is required for certificate rotation & backups to work. However, this breaks those features when running under the Restricted policy of Pod Security Standards where privilege escalation must not be enabled. Therefore I request those features to work without privilege escalation.

Workaround

Currently the following (more insecure) workaround is required in every namespace where a PostgreSQL cluster is deployed (the non-namespaced ClusterRole is of course only needed once).

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: psp-baseline
rules:
  - apiGroups: [policy]
    resources: [podsecuritypolicies]
    verbs: [use]
    resourceNames: [baseline]

---
# Workaround for https://github.com/zalando/postgres-operator/issues/1730
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: psp-baseline
roleRef:
  kind: ClusterRole
  name: psp-baseline
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: Group
    # Match all ServiceAccounts in this namespace. ServiceAccounts in other
    # namespaces are not affected, because this is a (namespaced) RoleBinding.
    name: system:serviceaccounts
    apiGroup: rbac.authorization.k8s.io

Start with docs/reference/operator_parameters.md, especially the Kubernetes resources section, and review the linked Kubernetes Pod Security Standards documentation. Then trace how certificate rotation and backups depend on spilo_allow_privilege_escalation; done means both features work under the Restricted policy without requiring privilege escalation.