Set SCC's RunAsUser as MustRunAsRange

[sigv]

Proposed changes

Upstream Helm Chart is removing explicit runAsUser value from the Deployment and DaemonSet resources. This practically means the UID will be inherited from image's Dockerfile.

Users on vanilla Kubernetes clusters will not observe a change in behavior, unless they have exotic configurations.

However, OpenShift does have additional security measures. It suggests using randomized UIDs/GIDs for workloads. To enable this, the custom Security Context Constraint resources are being updated. The MustRunAsRange policy is utilized with pre-allocated values (no explicit range min/max), which effectively allows OpenShift to pick its own ranges.

Relates to nginx/kubernetes-ingress#5422.

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto master
• I will ensure my PR is targeting the master branch and pulling from my branch from my own fork

[sigv]

My test was very basic local run.

Just deployed a fresh OpenShift cluster (v4.15.0) in AWS, and then essentially

kubectl apply -f resources/scc.yaml
make install
make run

# for some reason had to manually create the ClusterRole
# should I be worried about this? but not seeing how my change can be related.
kubectl apply -f bundle/manifests/nginx-ingress-operator-nginx-ingress-admin_rbac.authorization.k8s.io_v1_clusterrole.yaml

kubectl apply -f config/samples/charts_v1alpha1_nginxingress.yaml

The Controller was spun up with runAsUser: 1001010000 (generated UID as would be expected).
Not seeing what could directly break here 🤔

Let me know what further experiments could be preferable.

[vepatel]

Hey @sigv, only scc yamls are exclusive to this operator repo, rest of the files are synced from https://github.com/nginxinc/kubernetes-ingress/tree/main/charts/nginx-ingress, so any change needed will have to go there initially

[sigv]

Understandable - this change is blocked on nginx/kubernetes-ingress#3665.

The chart must be updated for SCC to be updated. Without this, startup would fail as SCC requires dynamic range, but chart enforces specific UID.

[vepatel]

thanks @sigv, left a comment there in NIC pr

[vepatel]

@sigv you can remove the changes from helm directory as well, keep the scc ones as they're specific to operator

[sigv]

Reverted helm-charts to main branch state as requested. ✅

[vepatel]

Hey @sigv can you check min max values are required as per https://docs.openshift.com/container-platform/4.15/authentication/managing-security-context-constraints.html#authorization-SCC-strategies_configuring-internal-oauth

[github-actions]

This PR is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR was closed because it has been stalled for 10 days with no activity.