fix: Remove hardcoded UID from HCP webhook deployment

[xiaoyu74]

Summary

Hotfix to remove the hardcoded runAsUser: 1001 from the HCP validating-webhook deployment.

The fixed UID is outside the namespace UID range allowed by the restricted-v2 SCC, causing webhook pods to be rejected and the deployment to have 0 available replicas.

More context: https://redhat-internal.slack.com/archives/C0A8S4L99C2/p1784697684486109?thread_ts=1784697591.159769&cid=C0A8S4L99C2

Summary by CodeRabbit

• Security
  • Strengthened runtime security for the validation webhook by disabling privilege escalation, enforcing a read-only root filesystem, and requiring non-root execution.
  • Removed the fixed user ID requirement while retaining non-root enforcement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1789a550-1b92-45cd-909a-8fbd27314ae1

📥 Commits

Reviewing files that changed from the base of the PR and between 7c0db22 and 6969c19.

📒 Files selected for processing (2)

• build/resources.go
• config/package/resources.yaml.gotmpl

💤 Files with no reviewable changes (2)

• config/package/resources.yaml.gotmpl
• build/resources.go

---

Walkthrough

The webhook deployment security contexts remove the explicit UID and enforce non-root execution, disabled privilege escalation, and a read-only root filesystem in the packaged deployment configuration.

Changes

Webhook container security

Layer / File(s)	Summary
Update webhook security contexts build/resources.go, config/package/resources.yaml.gotmpl	The packaged and templated webhook deployments remove the fixed user ID while retaining non-root execution and tightening container runtime settings.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing the hardcoded UID from the HCP webhook deployment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only removes a hardcoded runAsUser from deployment manifests; no Ginkgo test titles were added or changed.
Test Structure And Quality	✅ Passed	No Ginkgo test code was changed; the PR only updates deployment/template resources, so the test-structure/quality check is not applicable.
Microshift Test Compatibility	✅ Passed	PR only removes runAsUser from deployment manifests; no new Ginkgo tests or MicroShift-unsafe APIs/features were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only edits deployment securityContext in generated resources; no Ginkgo It/Describe/Context/When tests were added or modified.
Topology-Aware Scheduling Compatibility	✅ Passed	Patch only removes runAsUser and keeps existing scheduling; no new node selectors, spread constraints, or replica logic were added.
Ote Binary Stdout Contract	✅ Passed	PASS: The diff only removes a hardcoded runAsUser from deployment securityContext; it doesn't add or change any main/init/TestMain stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added or modified; the PR only removes runAsUser from deployment manifests.
No-Weak-Crypto	✅ Passed	Touched files only adjust pod securityContext; no weak-crypto algorithms, custom crypto, or secret/token comparisons appear in the diff.
Container-Privileges	✅ Passed	The patch only removes runAsUser:1001; it adds no privileged/host* settings and keeps allowPrivilegeEscalation false with runAsNonRoot true.
No-Sensitive-Data-In-Logs	✅ Passed	The diff only removes a hardcoded UID from securityContext; no log statements or sensitive data exposure were added in the touched files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@xiaoyu74: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bmeng]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bmeng, xiaoyu74

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bmeng,xiaoyu74]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment