Azure / Azure/azure-workload-identity
Cannot override runAsUser on azwi-proxy
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 338
- Forks
- 122
- Avg merge
- 1h 7m
- Merged PRs (30d)
- 3
Description
**Describe the bug**
The admission webhook injects `azwi-proxy` as a sidecar container. The injected container defines a `securityContext` that defines that the container will run as non-root.
```
securityContext:
capabilities:
drop:
- ALL
privileged: false
runAsNonRoot: true
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
```
However, in some scenarios this may violate the existing non-root policy defined by the pod causing the sidecar container not being able to progress.
```
containerStatuses:
- name: azwi-proxy
state:
waiting:
reason: CreateContainerConfigError
message: >-
container's runAsUser breaks non-root policy (pod:
"[redacted]([redacted])",
container: azwi-proxy)
```
Version `0.15` (that we were using prior to the release of `1.10`) didn't have the `securityContext` defined
**Steps To Reproduce**
[edited to add repro steps that doesn't depends on any third party chart]
1. Install version `1.1.0` of the admission webhook
2. Create a Pod and a Service Account with the following config:
```
apiVersion: v1
kind: Pod
metadata:
name: static-web
namespace: test-wi-proxy
labels:
azure.workload.identity/use: 'true'
annotations:
azure.workload.identity/inject-proxy-sidecar: 'true'
spec:
containers:
- name: web
image: nginx
securityContext:
runAsUser: 0
fsGroup: 65534
serviceAccountName: my-app-kubesa
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-app-kubesa
namespace: test-wi-proxy
labels:
azure.workload.identity/use: 'true'
annotations:
azure.workload.identity/client-id: [redacted]
```
**Expected behavior**
The admission webhook chart should allow configuring if the sidecar proxy will run as root or not.
**Logs**
N/A, the container won't be able to progress
**Environment**
- Kubernetes version (use `kubectl version`): 1.25.6
- Cloud provider or hardware configuration: AKS
- OS (e.g: `cat /etc/os-release`): Ubuntu 22.04.2 LTS
- Kernel (e.g. `uname -a`): 5.15.0-1039-azure
- Install tools: N/A
- Network plugin and version (if this is a network-related bug): Azure CNI
- Others: N/A
**Additional context**
N/A
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the admission webhook and its chart configuration for the injected azwi-proxy sidecar, then reproduce the issue using the provided Pod and ServiceAccount manifests. The work is done when the chart allows selecting whether the proxy runs as root or non-root and the resulting pod progresses under the demonstrated security policy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100