[auto-instrumentation] Init containers image run as root prevents usage of auto-injection where OPA Policies enforce runAsNonRoot

[santhotech]

Component(s)

instrumentation

What happened?

Description

With the recent release of operators, the init-containers takes the securityContext of the container where they are injecting the instrumentation libraries . However, several enterprises enforce runAsNonRoot to be true in the application containers through OPA policies. With this update, when the initContainers inherit runAsNonRoot, they are erroring out with the following error
"Error: container has runAsNonRoot and image will run as root (pod: xxx, container: opentelemetry-auto-instrumentation-java)

Steps to Reproduce

1. Created a pod with a container running a basic java application
2. Set the container securityContext to have runAsNonRoot: true
3. Create an instrumentation object
4. Add the auto-instrumentation annotation to the container where instrumentation is required - instrumentation.opentelemetry.io/inject-java: true

Expected Result

The initContainer should come up successfully and inject the instrumentation libraries

Actual Result

The initContainer fails to come up with the error mentioned above.

Kubernetes Version

1.23.0

Operator version

0.87.0

Collector version

0.87.0

Environment information

No response

Log output

No response

Additional context

No response

[TylerHelmuth]

@santhotech I was not able to reproduce this problem locally yet. When I set runAsNonRoot: true on the application container the SecurityContext, including runAsNonRoot, is correctly copied to the initContainer which runs as expected.

[santhotech]

@TylerHelmuth I noticed I have not mentioned, I am using auto-instrumentation-java image version 1.31.0, I was able to replicate it again. Can you clarify if this is the same version you tried?

[TylerHelmuth]

@santhotech are you able to reproduce this issue in a local kind cluster

[vickas522]

@santhotech , Hey santosh , were you able to fix it ? I want to auto instrument open telemetry agent to pod having securitycontext set to runAsNonRoot: true.