fix(k8s): run CRD webhook helper as non-root

[sinorga]

fix(k8s): run CRD webhook helper as non-root

Summary

The CRD webhook validation fixture now sets an explicit non-root UID for the
webhook Deployment. This makes the runAsNonRoot contract deterministic for
images that do not declare a non-root user in their image metadata.

Why

The current agnhost:2.47 image defaults to UID 0, while the fixture requires
runAsNonRoot: true. Kubernetes therefore rejects the webhook container before
the CRD admission, mutation, and rejection behavior is exercised. The
Deployment remains unavailable and the check reports a timeout instead of
testing the intended functionality.

What changes

• Add runAsUser: 1000 to the webhook pod security context.
• Preserve the existing non-root security requirement and validation behavior.

Verification

• The Kubernetes CRD webhook validation path passed in the final GCP live run.
• The change is isolated to the shared test manifest.

Summary by CodeRabbit

• Bug Fixes
  • Improved webhook Deployment startup reliability by explicitly running the container as a non-root user.
  • Prevented deployment failures caused by security settings when the container image does not define a default user.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ae1e3081-6e2d-4a9a-b9fb-866d6bb24998

📥 Commits

Reviewing files that changed from the base of the PR and between 4d61b18 and 5311e89.

📒 Files selected for processing (1)

• isvtest/src/isvtest/validations/manifests/k8s/crd_webhook.yaml

---

📝 Walkthrough

Walkthrough

The webhook server Deployment now explicitly runs the agnhost-webhook container as user 1000 and documents the interaction between the image default user and Kubernetes non-root enforcement.

Changes

Webhook security context

Layer / File(s)	Summary
Explicit non-root runtime user isvtest/src/isvtest/validations/manifests/k8s/crd_webhook.yaml	The agnhost-webhook container adds runAsUser: 1000 and comments explaining the existing non-root configuration.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: running the CRD webhook helper as a non-root user.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[abegnoche]

/ok to test 5311e89

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-07-21 19:51:12 UTC | Commit: 5311e89}