fix: codecov non-root-v2 SCC, pod security (#268)

Add nonroot-v2 SCC and fix pod security for restricted-v2 compatibility

Codecov images require specific non-root UIDs to access their own
files.

* Grant nonroot-v2 SCC to the default service account and set
runAsUser per container (1001 for api/worker, 1000 for frontend).

* Add gateway initContainer to copy haproxy config to a writable
emptyDir.

Tested and validated on a public cluster with restricted-v2.

Assisted-by: Cursor

Author: psturc

components/codecov/base/rbac/kustomization.yaml

@@ -3,3 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - konflux-devprod-admins.yaml
+  - scc-nonroot-v2.yaml

components/codecov/base/rbac/scc-nonroot-v2.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: codecov-nonroot-v2
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:openshift:scc:nonroot-v2
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: codecov

components/codecov/internal-staging/codecov.yaml

@@ -21,6 +21,9 @@ spec:
         app: codecov
         component: api
     spec:
+      securityContext:
+        runAsUser: 1001
+        runAsNonRoot: true
       containers:
         - name: api
           image: codecov/self-hosted-api:latest-calver
@@ -33,8 +36,6 @@ spec:
             limits:
               cpu: 500m
               memory: 512Mi
-          securityContext:
-            runAsNonRoot: true
           volumeMounts:
             - name: codecov-config
               mountPath: /config
@@ -88,6 +89,9 @@ spec:
         app: codecov
         component: worker
     spec:
+      securityContext:
+        runAsUser: 1001
+        runAsNonRoot: true
       containers:
         - name: worker
           image: codecov/self-hosted-worker:latest-calver
@@ -101,8 +105,6 @@ spec:
             limits:
               cpu: 500m
               memory: 512Mi
-          securityContext:
-            runAsNonRoot: true
           volumeMounts:
             - name: codecov-config
               mountPath: /config
@@ -140,6 +142,9 @@ spec:
         app: codecov
         component: frontend
     spec:
+      securityContext:
+        runAsUser: 1000
+        runAsNonRoot: true
       containers:
         - name: frontend
           image: codecov/self-hosted-frontend:latest-calver
@@ -152,8 +157,6 @@ spec:
             limits:
               cpu: 200m
               memory: 256Mi
-          securityContext:
-            runAsNonRoot: true
           env:
             - name: CODECOV_BASE_HOST
               valueFrom:
@@ -232,6 +235,24 @@ spec:
         app: codecov
         component: gateway
     spec:
+      securityContext:
+        runAsNonRoot: true
+      initContainers:
+        - name: copy-haproxy-config
+          image: codecov/self-hosted-gateway:latest-calver
+          command: ["sh", "-c", "cp -a /etc/haproxy/. /haproxy-config/"]
+          securityContext:
+            runAsNonRoot: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: haproxy-config
+              mountPath: /haproxy-config
       containers:
         - name: gateway
           image: codecov/self-hosted-gateway:latest-calver
@@ -244,8 +265,6 @@ spec:
             limits:
               cpu: 200m
               memory: 128Mi
-          securityContext:
-            runAsNonRoot: true
           env:
             - name: CODECOV_GATEWAY_MINIO_ENABLED
               value: "true"
@@ -254,17 +273,29 @@ spec:
           volumeMounts:
             - name: codecov-config
               mountPath: /config
+            - name: haproxy-config
+              mountPath: /etc/haproxy
             - name: tmp
               mountPath: /tmp
+            - name: haproxy-run
+              mountPath: /var/run
+            - name: haproxy-lib
+              mountPath: /var/lib/haproxy
       volumes:
         - name: codecov-config
           secret:
             secretName: codecov-secrets
             items:
               - key: codecov-yml
                 path: codecov.yml
+        - name: haproxy-config
+          emptyDir: {}
         - name: tmp
           emptyDir: {}
+        - name: haproxy-run
+          emptyDir: {}
+        - name: haproxy-lib
+          emptyDir: {}
 ---
 apiVersion: v1
 kind: Service