How to run terragon operator deployment as user.. not as root

[chaithraPadmar]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem?

Hi,
We would like to know, How to run terragon operator deployment as user.. not as root

Describe the feature you would like

Want to know how to install tetragon as user not as root

Describe your proposed solution

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[kkourt]

I don't believe the tetragon operator runs as root:

tetragon/install/kubernetes/tetragon/values.yaml

Lines 259 to 266 in 0d9b619

	# -- securityContext for the Tetragon Operator Deployment Pods.
	securityContext: {}
	# -- securityContext for the Tetragon Operator Deployment Pod container.
	podSecurityContext:
	allowPrivilegeEscalation: false
	capabilities:
	drop:
	- "ALL"

.

[mtardy]

So even if we drop all capabilities it does technically run as root (because Kubernetes and thus the container runtime will start all process as root by default). I think it would be wise to add runAsUser: <someID> to the security context if we can so that we don't even run as root with no capabilities but as a user with no capabilities.

We could even in theory ship this directly in the Dockerfiles manifest so that the runtime starts this by default as non-root.

In the meantime @chaithraPadmar, you can use the securityContext in the helm chart for the tetragon operator deployment to add runAsUser. The name is misleading as the podSecurityContext is the containerSecurityContext and the securityContext is the podSecurityContext it seems from the template:

tetragon/install/kubernetes/tetragon/templates/operator_deployment.yaml

Lines 52 to 81 in 0d9b619

	{{- with .Values.tetragonOperator.podSecurityContext }}
	securityContext:
	{{- toYaml . | nindent 10 }}
	{{- end }}
	{{- if .Values.tetragonOperator.prometheus.enabled }}
	ports:
	- name: metrics
	containerPort: {{ .Values.tetragonOperator.prometheus.port }}
	protocol: TCP
	{{- end }}
	livenessProbe:
	httpGet:
	path: /healthz
	port: 8081
	initialDelaySeconds: 15
	periodSeconds: 20
	readinessProbe:
	httpGet:
	path: /readyz
	port: 8081
	initialDelaySeconds: 5
	periodSeconds: 10
	{{- with .Values.tetragonOperator.resources }}
	resources:
	{{- toYaml . | trim | nindent 10 }}
	{{- end }}
	{{- with .Values.tetragonOperator.securityContext }}
	securityContext:
	{{- toYaml . | nindent 8 }}
	{{- end }}

We should also maybe fix this naming mistake.