Deploying cluster operator as nonroot

[webadmininc]

How do you deploy the strimzi cluster operator as nonroot?

[scholzj]

Sorry, not sure I follow the question -> what do you need root for?

[sbrawner]

I think his concern is that the cluster operator deployment does not specifically preclude running as root/privilege escalation.
The following stanza should be in the yaml under container: to prevent these security vulnerabilities:

       securityContext:
          allowPrivilegeEscalation: false
          runAsNonRoot: true
          capabilities:
            drop:
              - all

[sbrawner]

Thanks!

[hafizmujadidKhalid]

Hello @scholzj!
What should we change in yaml file to make it happen? When I try to run the following command:
kubectl create -f 'https://strimzi.io/install/latest?namespace=kafka' -n kafka
It gives me an error:

policy Deployment/kafka/strimzi-cluster-operator for resource violations:

disallow-capabilities-strict:

autogen-require-drop-all: 'validation failure: Containers must drop ALL capabilities.'

restrict-seccomp-strict:
autogen-check-seccomp-strict: 'validation error: Use of custom Seccomp profiles
is disallowed. The fields spec.securityContext.seccompProfile.type, spec.containers[].securityContext.seccompProfile.type,
spec.initContainers[].securityContext.seccompProfile.type, and spec.ephemeralContainers[*].securityContext.seccompProfile.type
must be set to RuntimeDefault or Localhost. rule autogen-check-seccomp-strict[0]
failed at path /spec/template/spec/securityContext/seccompProfile/ rule autogen-check-seccomp-strict[1]
failed at path /spec/template/spec/containers/0/securityContext/seccompProfile/'
validate-seccomp-location:
autogen-validate-irsa-seccomp: preconditions not met

I already added above mentioned securityContext in the container specification.

[scholzj]

To make what happen? The operator does not run as root - so it is not really clear what do you want to happen. In general, how the pod should be configured depends on what policies is your cluster or whatever tools you are using enforcing. That is something you have to understand as it is your cluster.

[hafizmujadidKhalid]

@scholzj!
is there a way to add security context for containers in connect yaml file? I did add for pod but the error is for containers:

  template:
    pod:
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault

I tried replacing pod with container but did not work. Can you please guide? thanks

Here is the error:

policy Deployment/test1/cluster1-ingestion-connect for resource violations:
disallow-capabilities-strict:
autogen-require-drop-all: 'validation failure: Containers must drop ALL capabilities.'
disallow-privilege-escalation:
autogen-privilege-escalation: 'validation error: Privilege escalation is disallowed.
The fields spec.containers[].securityContext.allowPrivilegeEscalation, spec.initContainers[].securityContext.allowPrivilegeEscalation,
and spec.ephemeralContainers[*].securityContext.allowPrivilegeEscalation must
be set to false. rule autogen-privilege-escalation failed at path /spec/template/spec/containers/0/securityContext/'

[scholzj]

Container security context can be set in the container template. Please check the docs.