Added a security context to run as non-root user.

[NerdSec]

Hello Everyone,

As discussed on the forum with @manics, raising a PR for fixing the security context of the user-placeholder pods.

This is my first of many (hopefully) PR on an OSS project. Do let me know in case I missed something.

Regards,
Nachiket

[welcome]

Thanks for submitting your first pull request! You are awesome! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please make sure you followed the pull request template, as this will help us review your contribution more quickly.

You can meet the other Jovyans by joining our Discourse forum. There is also a intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[meeseeksmachine]

This pull request has been mentioned on Jupyter Community Forum. There might be relevant details there:

https://discourse.jupyter.org/t/restricted-psp-z2jh-fails-in-local-gitlab-oauth-workflow/6202/5

[consideRatio]

Welcome and thanks for being an active community member @NerdSec ! ❤️ 🎉

Could you help me review #1798 perhaps? I recently opened a PR that this duplicates in order to resolve this kind of issues for all the Helm chart's pods!

[consideRatio]

This is a podSecurityContext, which can influence sidecar containers for example from istio which I've seen can lead to issues before, so I think we should set it on the container level only influencing the containers we actually manage.

[NerdSec]

Yes, this does make sense. Adding it as a podSecurityContext seems better than for the entire deployment. Maybe we can add the runAsGroup parameter as well to ensure that any changes to the image does not affect us in the future?

The indentation in the code above seems to miss a tab, I think it should be as follows:

  image: {{ .Values.prePuller.pause.image.name }}:{{ .Values.prePuller.pause.image.tag }}
  resources:
    {{- include "jupyterhub.resources" . | nindent 12 }}
  securityContext:
    runAsGroup: 1000
    runAsUser: 1000

[consideRatio]

Thanks for thinking about this @NerdSec ! I've made it a container securityContext in #1798, and also added runAsGroup there, what do you think?