Azure / Azure/azure-workload-identity

Cannot override runAsUser on azwi-proxy

Open
#1,009 5 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
338
Forks
122
Avg merge
1h 7m
Merged PRs (30d)
3

Description

**Describe the bug**
The admission webhook injects `azwi-proxy` as a sidecar container. The injected container defines a `securityContext` that defines that the container will run as non-root.

```
securityContext:
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
```

However, in some scenarios this may violate the existing non-root policy defined by the pod causing the sidecar container not being able to progress.

```
containerStatuses:
- name: azwi-proxy
state:
waiting:
reason: CreateContainerConfigError
message: >-
container's runAsUser breaks non-root policy (pod:
"[redacted]([redacted])",
container: azwi-proxy)
```

Version `0.15` (that we were using prior to the release of `1.10`) didn't have the `securityContext` defined

**Steps To Reproduce**
[edited to add repro steps that doesn't depends on any third party chart]

1. Install version `1.1.0` of the admission webhook
2. Create a Pod and a Service Account with the following config:

```
apiVersion: v1
kind: Pod
metadata:
name: static-web
namespace: test-wi-proxy
labels:
azure.workload.identity/use: 'true'
annotations:
azure.workload.identity/inject-proxy-sidecar: 'true'
spec:
containers:
- name: web
image: nginx
securityContext:
runAsUser: 0
fsGroup: 65534
serviceAccountName: my-app-kubesa

---

apiVersion: v1
kind: ServiceAccount
metadata:
name: my-app-kubesa
namespace: test-wi-proxy
labels:
azure.workload.identity/use: 'true'
annotations:
azure.workload.identity/client-id: [redacted]
```

**Expected behavior**
The admission webhook chart should allow configuring if the sidecar proxy will run as root or not.

**Logs**
N/A, the container won't be able to progress

**Environment**

- Kubernetes version (use `kubectl version`): 1.25.6
- Cloud provider or hardware configuration: AKS
- OS (e.g: `cat /etc/os-release`): Ubuntu 22.04.2 LTS
- Kernel (e.g. `uname -a`): 5.15.0-1039-azure
- Install tools: N/A
- Network plugin and version (if this is a network-related bug): Azure CNI
- Others: N/A

**Additional context**
N/A

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the admission webhook and its chart configuration for the injected azwi-proxy sidecar, then reproduce the issue using the provided Pod and ServiceAccount manifests. The work is done when the chart allows selecting whether the proxy runs as root or non-root and the resulting pod progresses under the demonstrated security policy.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
infrastructure, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.