osm-healthcheck (v1.1.2) should not run as root

[lorenzo-biava]

Bug description:

Injected osm-healthcheck container runs as root (at least on v1.1.2 -- note that OSM is running v1.2.1, so there might also be some inconsistencies between the image versions). It should be run under a different user. The container image is built with "user: 0" and it's injected without specifying a different runAsUser.

This leads to the Pod being rejected by security policies in certain environments. E.g.

message: 'container has runAsNonRoot and image will run as root (pod: "xxxxxxxxx(fe265a59-4567-416d-8904-11e42899c815)", container: osm-healthcheck)'

Affected area (please mark with X where applicable):

• Install [ ]
• SMI Traffic Access Policy [ ]
• SMI Traffic Specs Policy [ ]
• SMI Traffic Split Policy [ ]
• Permissive Traffic Policy [ ]
• Ingress [ ]
• Egress [ ]
• Envoy Control Plane [ ]
• CLI Tool [ ]
• Metrics [ ]
• Certificate Management [ ]
• Sidecar Injection [x]
• Logging [ ]
• Debugging [ ]
• Tests [ ]
• Demo [ ]
• CI System [ ]

Expected behavior:

The osm-healthcheck container should not be run as root.

https://github.com/openservicemesh/osm/blob/v1.2.1/pkg/injector/patch.go#L124 should set: securityContext.runAsUser: something other than 0

Steps to reproduce the bug (as precisely as possible):

Create a deployment with:

• A container that has TCP health probes
• Pod with securityContext.runAsNonRoot: true

How was OSM installed?:

AKS Add-on

Anything else we need to know?:

Bug report archive:

Environment:

• OSM version (use osm version): v1.2.1
• Kubernetes version (use kubectl version): v1.24.6
• Size of cluster (number of worker nodes in the cluster):
• Others:

[github-actions[bot]]

This issue will be closed due to a long period of inactivity. If you would like this issue to remain open then please comment or update.

[lorenzo-biava]

still valid

[github-actions[bot]]

This issue will be closed due to a long period of inactivity. If you would like this issue to remain open then please comment or update.

[github-actions[bot]]

Issue closed due to inactivity.