From 29d1b14715416a7763255fa039b4f1ec8e5fe537 Mon Sep 17 00:00:00 2001
From: Rob Pothier <Robert.Pothier@cyberark.com>
Date: Wed, 24 Aug 2022 10:46:57 -0400
Subject: [PATCH] Initial POC for adding security context values

---
 pkg/inject/constants.go                                   | 2 ++
 pkg/inject/secrets-provider.go                            | 8 ++++++++
 pkg/inject/server.go                                      | 5 +++++
 .../testdata/secrets-provider-init-mutated-pod.json       | 3 +++
 pkg/inject/testdata/secrets-provider-mutated-pod.json     | 3 +++
 5 files changed, 21 insertions(+)

diff --git a/pkg/inject/constants.go b/pkg/inject/constants.go
index 7f7403e..bf7d573 100644
--- a/pkg/inject/constants.go
+++ b/pkg/inject/constants.go
@@ -13,6 +13,7 @@ const (
 	annotationStatusKey               = "conjur.org/status"
 	annotationContainerImageKey       = "conjur.org/container-image"
 	annotationSecretsDestinationKey   = "conjur.org/secrets-destination"
+	annotationRunAsUser               = "conjur.org/run-as-user"
 )
 // These annotations are only used for sidecar injector and not passed on to the
 // injected container
@@ -26,4 +27,5 @@ var sidecarInjectorAnnot = []string {
 	annotationSecretlessConfigKey,
 	annotationSecretlessCRDSuffixKey,
 	annotationContainerImageKey,
+	annotationRunAsUser,
 }
\ No newline at end of file
diff --git a/pkg/inject/secrets-provider.go b/pkg/inject/secrets-provider.go
index 99d1a57..abda8cb 100644
--- a/pkg/inject/secrets-provider.go
+++ b/pkg/inject/secrets-provider.go
@@ -3,6 +3,7 @@ package inject
 import (
 	corev1 "k8s.io/api/core/v1"
 	"os"
+	"strconv"
 )
 
 type SecretsProviderSidecarConfig struct {
@@ -10,6 +11,7 @@ type SecretsProviderSidecarConfig struct {
 	containerName      string
 	sidecarImage       string
 	secretsDestination string
+	runAsUser          string
 }
 
 var conjurEnvVars = []string{
@@ -77,10 +79,16 @@ func generateSecretsProviderSidecarConfig(
 		}
 		volumeMounts = append(volumeMounts, volumeMount)
 	}
+	userID, err := strconv.ParseInt(cfg.runAsUser, 10, 64)
+	if err != nil {
+		userID = 777
+	}
+
 	container := corev1.Container{
 		Name:            cfg.containerName,
 		Image:           cfg.sidecarImage,
 		ImagePullPolicy: "Always",
+		SecurityContext: &corev1.SecurityContext{RunAsUser: &userID},
 		VolumeMounts:    volumeMounts,
 		Env: []corev1.EnvVar{
 			envVarFromFieldPath(
diff --git a/pkg/inject/server.go b/pkg/inject/server.go
index e6d94b9..8f08a6d 100644
--- a/pkg/inject/server.go
+++ b/pkg/inject/server.go
@@ -290,12 +290,17 @@ func HandleAdmissionRequest(
 			&pod.ObjectMeta,
 			annotationSecretsDestinationKey,
 		)
+		runAsUser, err := getAnnotation(
+			&pod.ObjectMeta,
+			annotationRunAsUser,
+		)
 		sidecarConfig = generateSecretsProviderSidecarConfig(
 			SecretsProviderSidecarConfig{
 				containerMode: containerMode,
 				containerName: containerName,
 				sidecarImage: containerImage,
 				secretsDestination: secretsDestination,
+				runAsUser: runAsUser,
 			},
 		)
 		containerVolumeMounts := ContainerVolumeMounts{}
diff --git a/pkg/inject/testdata/secrets-provider-init-mutated-pod.json b/pkg/inject/testdata/secrets-provider-init-mutated-pod.json
index f6bee86..eb12fe3 100644
--- a/pkg/inject/testdata/secrets-provider-init-mutated-pod.json
+++ b/pkg/inject/testdata/secrets-provider-init-mutated-pod.json
@@ -73,6 +73,9 @@
         "image": "secrets-provider-image",
         "resources": {},
         "imagePullPolicy": "Always",
+        "securityContext": {
+          "runAsUser": 1234
+        },
         "env": [
           {
             "name": "MY_POD_NAME",
diff --git a/pkg/inject/testdata/secrets-provider-mutated-pod.json b/pkg/inject/testdata/secrets-provider-mutated-pod.json
index 125f1b1..f94e7cb 100644
--- a/pkg/inject/testdata/secrets-provider-mutated-pod.json
+++ b/pkg/inject/testdata/secrets-provider-mutated-pod.json
@@ -71,6 +71,9 @@
         "image": "secrets-provider-image",
         "resources": {},
         "imagePullPolicy": "Always",
+        "securityContext": {
+          "runAsUser": 1234
+        },
         "env": [
           {
             "name": "MY_POD_NAME",