K8S securityContext / runAsNonRoot

[m4r1u2]

We have a policy of not running any containers as root.
By default it looks like all awx and redis containers is starting as root and will fail/not start in our cluster do to default PSP in cluster.

If i manually update deployment manifest with SecurityContext for container is looks like its working...

containers:
  - name: redis
    securityContext:
      runAsUser: 999
...
  - name: awx-ee
    securityContext:
      runAsUser: 1000
...
  - name: awx-web
    securityContext:
      runAsUser: 1000
      runAsGroup: 0
...
  - name: awx-task
    securityContext:
      runAsUser: 1000
      runAsGroup: 0

Running as root is general not a recommended practice.

I also had to manually create file in container awx-task.:

bash-4.4$ touch /var/lib/awx/rsyslog/rsyslog.conf

log-output before fix.
Somehow this file was not generated.

rsyslogd: could not open config file '/var/lib/awx/rsyslog/rsyslog.conf': No such file or directory [v8.1911.0-7.el8 try https://www.rsyslog.com/e/2104 ]
rsyslogd: run failed with error -2104 (see rsyslog.h or try https://www.rsyslog.com/e/2104 to learn what that number means)

What about adding a SecurityContext or a general Spec in the crds to override this?
Or sync dockerimage + deployment with correct non-root user to allow read-write where its needed.

[ebarped]

Im using the 0.10.0 tag, and my containers run like this:

• redis: uid=0(root) gid=0(root) groups=0(root)
• web: uid=1000(awx) gid=0(root) groups=0(root)
• task: uid=1000(awx) gid=0(root) groups=0(root)
• ee: uid=1000(runner) gid=0(root) groups=0(root)

So the only one that has to be changed is the redis one.

BTW, im having the same problem with the rsyslog file.. Also tested 0.9.0 and same error. Maybe we should rise a different issue.

[cnukwas]

Any idea if this would be part of a future release, to avoid manual changes to the deployment YAML?
OpenShift wouldn't allow pods to run as root by default, ideal to know or set up SCC as part of the AWX instance or pre-requisite step.

[toby181]

I'm using the postgres and redis image from bitnami as a workaround since they run as non-root.
https://hub.docker.com/r/bitnami/redis/
https://hub.docker.com/r/bitnami/postgresql/

From my awx-demo.yaml file:

spec:
postgres_image: bitnami/postgresql
# postgres_image_version: 12
redis_image: bitnami/redis
# redis_image_version: latest