Skip to content

[auto-instrumentation] Init containers image run as root prevents usage of auto-injection where OPA Policies enforce runAsNonRoot #2272

@santhotech

Description

@santhotech

Component(s)

instrumentation

What happened?

Description

With the recent release of operators, the init-containers takes the securityContext of the container where they are injecting the instrumentation libraries . However, several enterprises enforce runAsNonRoot to be true in the application containers through OPA policies. With this update, when the initContainers inherit runAsNonRoot, they are erroring out with the following error
"Error: container has runAsNonRoot and image will run as root (pod: xxx, container: opentelemetry-auto-instrumentation-java)

Steps to Reproduce

  1. Created a pod with a container running a basic java application
  2. Set the container securityContext to have runAsNonRoot: true
  3. Create an instrumentation object
  4. Add the auto-instrumentation annotation to the container where instrumentation is required - instrumentation.opentelemetry.io/inject-java: true

Expected Result

The initContainer should come up successfully and inject the instrumentation libraries

Actual Result

The initContainer fails to come up with the error mentioned above.

Kubernetes Version

1.23.0

Operator version

0.87.0

Collector version

0.87.0

Environment information

No response

Log output

No response

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions