From f65051966cc7c8d6a137177ff4f428744bfa5e5b Mon Sep 17 00:00:00 2001
From: Andrey <Cjkjvfnby@gmail.com>
Date: Wed, 12 Feb 2025 16:58:33 +0100
Subject: [PATCH] feat: add run_as_non_root=True to Kubernetes Starter template
 (#16512)

This document sounds like `run_as_non_root=True` should be enabled for
workspaces.

https://coder.com/docs/install/kubernetes#kubernetes-security-reference
> All containers must run as non-root user
>  - Control plane - ...
> - Workspaces - Workspace pod UID is [set in the Terraform template
here](https://github.com/coder/coder/blob/f57ce97b5aadd825ddb9a9a129bb823a3725252b/examples/templates/kubernetes/main.tf#L274-L276),
and are not required to run as root.

Administrators of the Kubernetes of a cluster I am working on have added
a security check on it, and prevent creating pods, without
`run_as_non_root=True`. So, I need to set it every time I create a
template.

According to the docs used with `run_as_user=1000` it should not have
negative effects and could be safely added.
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/
---
 examples/templates/kubernetes/main.tf | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/examples/templates/kubernetes/main.tf b/examples/templates/kubernetes/main.tf
index 0ba6ba33b7..e1fdb12cbe 100644
--- a/examples/templates/kubernetes/main.tf
+++ b/examples/templates/kubernetes/main.tf
@@ -278,8 +278,9 @@ resource "kubernetes_deployment" "main" {
       }
       spec {
         security_context {
-          run_as_user = 1000
-          fs_group    = 1000
+          run_as_user     = 1000
+          fs_group        = 1000
+          run_as_non_root = true
         }
 
         container {