init container RunAsNonRoot + securityContext

.github/workflows/e2e.yaml

@@ -38,7 +38,7 @@ jobs:
         ./get_helm.sh
 
         #Install k3s
-        curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" sh -s - --docker
+        curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" INSTALL_K3S_VERSION="v1.24.4+k3s1" sh -s - --docker
 
         mkdir ~/.kube || echo "~/.kube already existed"
         sudo chmod 777 /etc/rancher/k3s/k3s.yaml

controllers/patch_funcs.go

@@ -129,6 +129,18 @@ func (r *LightrunJavaAgentReconciler) addInitContainer(deploymentApplyConfig *ap
 						corev1.ResourceMemory: *resource.NewScaledQuantity(int64(64), resource.Scale(6)),
 					},
 				),
+			).
+			WithSecurityContext(
+				corev1ac.SecurityContext().
+					WithCapabilities(
+						corev1ac.Capabilities().WithDrop(corev1.Capability("ALL")),
+					).
+					WithAllowPrivilegeEscalation(false).
+					WithRunAsNonRoot(true).
+					WithSeccompProfile(
+						corev1ac.SeccompProfile().
+							WithType(corev1.SeccompProfileTypeRuntimeDefault),
+					),
 			),
 	)
 }

examples/deployment.yaml

@@ -20,8 +20,22 @@ spec:
             - name: JAVA_TOOL_OPTIONS
               value: -Djava.net.preferIPv4Stack=true
           image: lightruncom/operator-demo-app
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
         # Second container will be not patched, as not mentioned in the custom resource
         - name: busybox
           image: busybox
           command: ["/bin/sh", "-c", "--"]
           args: ["while true; do sleep 30; done;"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault

lightrun-init-agent/Dockerfile

@@ -4,7 +4,6 @@ ARG GITHUB_TOKEN
 ARG VERSION 
 ARG FILE 
 
-
 RUN apk --no-cache add jq \
                        wget
 RUN export REPO="lightrun-platform/athena"; \
@@ -17,7 +16,11 @@ RUN export REPO="lightrun-platform/athena"; \
     rm -rf /tmp/agent.zip && \
     # Erase default values
     sed -i.bak "s|com.lightrun.secret=.*|com.lightrun.secret=|" /agent/agent.config && rm /agent/agent.config.bak && \
-    sed -i.bak "s|pinned_certs=.*|pinned_certs=|" /agent/agent.config && rm /agent/agent.config.bak
+    sed -i.bak "s|pinned_certs=.*|pinned_certs=|" /agent/agent.config && rm /agent/agent.config.bak && \
+    # In openshift UID will be dynamic per project, hence chmo and not chown
+    chmod -R 777 /agent 
+
+USER 1000
 
 COPY lightrun-init-agent/update_config.sh /update_config.sh
 

lightrun-init-agent/update_config.sh

@@ -24,5 +24,5 @@ echo "Set server and secrets"
 sed -i.bak "s|com.lightrun.server=.*|com.lightrun.server=https://$LIGHTRUN_SERVER|" /agent/agent.config && rm /agent/agent.config.bak
 sed -i.bak "s|com.lightrun.secret=.*|com.lightrun.secret=$LIGHTRUN_KEY|" /agent/agent.config && rm /agent/agent.config.bak
 sed -i.bak "s|pinned_certs=.*|pinned_certs=$PINNED_CERT|" /agent/agent.config && rm /agent/agent.config.bak
-mv /agent /tmp/agent
+cp -R /agent /tmp/agent
 echo "Finished"