fix(executor): Allow PNS to runAsNonRoot with injected sidecar. Fixes #6030

cmd/argoexec/commands/root.go

@@ -77,7 +77,14 @@ func NewRootCommand() *cobra.Command {
 func initExecutor() *executor.WorkflowExecutor {
 	version := argo.GetVersion()
 	executorType := os.Getenv(common.EnvVarContainerRuntimeExecutor)
-	log.WithFields(log.Fields{"version": version.Version, "executorType": executorType}).Info("Starting Workflow Executor")
+	groups, _ := os.Getgroups()
+	log.WithField("version", version.Version).
+		WithField("executorType", executorType).
+		WithField("groups", groups).
+		WithField("gid", os.Getgid()).
+		WithField("uid", os.Getuid()).
+		WithField("pid", os.Getpid()).
+		Info("Starting Workflow Executor")
 	config, err := clientConfig.ClientConfig()
 	checkErr(err)
 	config = restclient.AddUserAgent(config, fmt.Sprintf("argo-workflows/%s argo-executor/%s", version.Version, executorType))

test/e2e/run_as_not_root_test.go

@@ -23,6 +23,15 @@ func (s *RunAsNonRootSuite) TestRunAsNonRootWorkflow() {
 		WaitForWorkflow(fixtures.ToBeSucceeded)
 }
 
+func (s *RunAsNonRootSuite) TestRunAsNonRootSidecarInjectedWorkflow() {
+	s.Need(fixtures.None(fixtures.Docker))
+	s.Given().
+		Workflow("@testdata/runasnonroot-sidecar-injected-workflow.yaml").
+		When().
+		SubmitWorkflow().
+		WaitForWorkflow(fixtures.ToBeSucceeded)
+}
+
 func (s *RunAsNonRootSuite) TestRunAsNonRootWithOutputParams() {
 	s.Need(fixtures.None(fixtures.Docker, fixtures.K8SAPI, fixtures.Kubelet))
 	s.Given().

test/e2e/testdata/runasnonroot-sidecar-injected-workflow.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: runasnonroot-sidecar-injected-
+spec:
+  entrypoint: main
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 8737
+  podSpecPatch: |
+    terminationGracePeriodSeconds: 3
+    containers:
+      - name: wait
+      - name: main
+      - name: sidecar
+        image: argoproj/argosay:v1
+        command:
+         - sh
+         - -c
+        args:
+          - "sleep 999"
+  templates:
+    - name: main
+      container:
+        image: argoproj/argosay:v1

workflow/executor/pns/pns.go

@@ -289,8 +289,11 @@ func (p *PNSExecutor) getContainerPID(containerName string) int {
 }
 
 func containerNameForPID(pid int) (string, error) {
+	anonymousName := fmt.Sprintf("%s%d", anonymousPIDPrefix, pid) // we give all a "container name", including a fake name for injected sidecars
 	data, err := ioutil.ReadFile(fmt.Sprintf("/proc/%d/environ", pid))
-	if err != nil {
+	if os.IsPermission(err) {
+		return anonymousName, nil
+	} else if err != nil {
 		return "", err
 	}
 	prefix := common.EnvVarContainerName + "="
@@ -299,7 +302,7 @@ func containerNameForPID(pid int) (string, error) {
 			return strings.TrimPrefix(l, prefix), nil
 		}
 	}
-	return fmt.Sprintf("%s%d", anonymousPIDPrefix, pid), nil // we give all a "container name", including a fake name for injected sidecars
+	return anonymousName, nil
 }
 
 func (p *PNSExecutor) secureRootFiles() error {