feat(executor): set seccomp profile to runtimedefault

[lukashankeln]

Motivation

We are using Kyverno Policies to enforce different security settings within our cluster. For example running containers as non Root.

But also to explicitly have set the SeccompProfile to RuntimeDefault. See the official Documentation

Currently the artifact GC is beeing blocked by our Kyverno policy. On my search for values to change the default (e.g. via Helm) i found the code I changed in this PR.

Modifications

Explicitly Setting the Seccomp Profile to RuntimeDefault when creating the artifact GC Pod.

Verification

The E2E tests should catch any issues, if you want me to test this locally let me know

[agilgur5]

You might notice podSpecPatch a few lines below -- you can set that to change anything on the Pod

[agilgur5]

have some naming suggestions below

[agilgur5]

1 change needed to the resource container, otherwise LGTM

[agilgur5]

Oh and the other remaining test failure needs a change in TestExecutorPluginsSuite/TestTemplateExecutor to handle the now set SC fields (it was expecting them to be nil before):

executor_plugins_test.go:41: 
        	Error Trace:	/home/runner/work/argo-workflows/argo-workflows/test/e2e/executor_plugins_test.go:41
        	            				/home/runner/work/argo-workflows/argo-workflows/test/e2e/fixtures/then.go:262
        	            				/home/runner/work/argo-workflows/argo-workflows/test/e2e/executor_plugins_test.go:36
        	Error:      	Not equal: 
        	            	expected: &v1.PodSecurityContext{SELinuxOptions:(*v1.SELinuxOptions)(nil), WindowsOptions:(*v1.WindowsSecurityContextOptions)(nil), RunAsUser:(*int64)(0xc000107280), RunAsGroup:(*int64)(nil), RunAsNonRoot:(*bool)(0xc000107288), SupplementalGroups:[]int64(nil), FSGroup:(*int64)(nil), Sysctls:[]v1.Sysctl(nil), FSGroupChangePolicy:(*v1.PodFSGroupChangePolicy)(nil), SeccompProfile:(*v1.SeccompProfile)(nil)}
        	            	actual  : &v1.PodSecurityContext{SELinuxOptions:(*v1.SELinuxOptions)(nil), WindowsOptions:(*v1.WindowsSecurityContextOptions)(nil), RunAsUser:(*int64)(0xc000106f58), RunAsGroup:(*int64)(nil), RunAsNonRoot:(*bool)(0xc000106fe4), SupplementalGroups:[]int64(nil), FSGroup:(*int64)(nil), Sysctls:[]v1.Sysctl(nil), FSGroupChangePolicy:(*v1.PodFSGroupChangePolicy)(nil), SeccompProfile:(*v1.SeccompProfile)(0xc00050d290)}
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -10,3 +10,6 @@
        	            	  FSGroupChangePolicy: (*v1.PodFSGroupChangePolicy)(<nil>),
        	            	- SeccompProfile: (*v1.SeccompProfile)(<nil>)
        	            	+ SeccompProfile: (*v1.SeccompProfile)({
        	            	+  Type: (v1.SeccompProfileType) (len=14) "RuntimeDefault",
        	            	+  LocalhostProfile: (*string)(<nil>)
        	            	+ })
        	            	 })
        	Test:       	TestExecutorPluginsSuite/TestTemplateExecutor
    executor_plugins_test.go:69: 
        	Error Trace:	/home/runner/work/argo-workflows/argo-workflows/test/e2e/executor_plugins_test.go:69
        	            				/home/runner/work/argo-workflows/argo-workflows/test/e2e/fixtures/then.go:262
        	            				/home/runner/work/argo-workflows/argo-workflows/test/e2e/executor_plugins_test.go:[36](https://github.com/argoproj/argo-workflows/actions/runs/9028328717/job/24808748392?pr=12984#step:18:37)
        	Error:      	Not equal: 
        	            	expected: &v1.SecurityContext{Capabilities:(*v1.Capabilities)(0xc0005a6360), Privileged:(*bool)(nil), SELinuxOptions:(*v1.SELinuxOptions)(nil), WindowsOptions:(*v1.WindowsSecurityContextOptions)(nil), RunAsUser:(*int64)(0xc000728e18), RunAsGroup:(*int64)(nil), RunAsNonRoot:(*bool)(0xc000728e20), ReadOnlyRootFilesystem:(*bool)(0xc000728e22), AllowPrivilegeEscalation:(*bool)(0xc000728e21), ProcMount:(*v1.ProcMountType)(nil), SeccompProfile:(*v1.SeccompProfile)(nil)}
        	            	actual  : &v1.SecurityContext{Capabilities:(*v1.Capabilities)(0xc0001271a0), Privileged:(*bool)(0xc000106dbf), SELinuxOptions:(*v1.SELinuxOptions)(nil), WindowsOptions:(*v1.WindowsSecurityContextOptions)(nil), RunAsUser:(*int64)(0xc000106dc0), RunAsGroup:(*int64)(nil), RunAsNonRoot:(*bool)(0xc000106dcc), ReadOnlyRootFilesystem:(*bool)(0xc000106dcd), AllowPrivilegeEscalation:(*bool)(0xc000106dce), ProcMount:(*v1.ProcMountType)(nil), SeccompProfile:(*v1.SeccompProfile)(0xc000[50](https://github.com/argoproj/argo-workflows/actions/runs/9028328717/job/24808748392?pr=12984#step:18:51)d278)}
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -7,3 +7,3 @@
        	            	  }),
        	            	- Privileged: (*bool)(<nil>),
        	            	+ Privileged: (*bool)(false),
        	            	  SELinuxOptions: (*v1.SELinuxOptions)(<nil>),
        	            	@@ -16,3 +16,6 @@
        	            	  ProcMount: (*v1.ProcMountType)(<nil>),
        	            	- SeccompProfile: (*v1.SeccompProfile)(<nil>)
        	            	+ SeccompProfile: (*v1.SeccompProfile)({
        	            	+  Type: (v1.SeccompProfileType) (len=14) "RuntimeDefault",
        	            	+  LocalhostProfile: (*string)(<nil>)
        	            	+ })
        	            	 })
        	Test:       	TestExecutorPluginsSuite/TestTemplateExecutor
=== FAIL: ExecutorPluginsSuite/TestTemplateExecutor

[agilgur5]

LGTM, thanks for iterating on this and improving the default security contexts!

[lukashankeln]

LGTM, thanks for iterating on this and improving the default security contexts!

Thank you for helping me out. One test was still failing, that should pass now.