Helm chart and include a securityContext that includes runAsUser: 0 about minibroker HOT 9 CLOSED

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

from minibroker.

/remove-lifecycle stale

from minibroker.

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

from minibroker.

/remove-lifecycle stale

from minibroker.

Adding the following in the spec: block of templates/deployment.yaml fixes the issue for me:

    securityContext:
      runAsUser: 0

from minibroker.

... but maybe the real fix is to use MustRunAsNonRoot and uncomment these two lines in the Dockerfile:

https://github.com/kubernetes-sigs/minibroker/blob/master/image/Dockerfile#L29

from minibroker.

... but maybe the real fix is to use MustRunAsNonRoot and uncomment these two lines in the Dockerfile:

https://github.com/kubernetes-sigs/minibroker/blob/master/image/Dockerfile#L29

The permanent link to the referred lines:
https://github.com/kubernetes-sigs/minibroker/blob/2800c6b4dab59c6bba3a5daa316f981d4dbb6e35/image/Dockerfile#L64-L65

from minibroker.

Since we want to keep avoiding any Docker RUN instructions on the final image (because of being able to build from scratch), we should add a file to the repository and just COPY it to the final image layer under /etc/passwd. Something like:

root:x:0:0:root:/root:/bin/bash
minibroker:x:1000:1000::/home/minibroker:/bin/bash

The /home/minibroker will need to be an ephemeral volume (or perhaps just /home/minibroker/.cache. This is because we want to also make the root filesystem read-only.

from minibroker.

/kind bug

from minibroker.