Executor securityContext.capabilities not overriding defaults

[rwong2888]

I have the below controller configmap on v3.4.7.

apiVersion: v1
kind: ConfigMap
metadata:
  name: workflow-controller-configmap
data:
  # https://blog.argoproj.io/practical-argo-workflows-hardening-dd8429acc1ce
  mainContainer: |
    securityContext:
      runAsNonRoot: true
      runAsUser: 8737
      runAsGroup: 8737
      privileged: false
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
  executor: |
    securityContext:
      runAsNonRoot: true
      runAsUser: 8737
      runAsGroup: 8737
      privileged: false
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
  workflowDefaults: |
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 8737
        runAsGroup: 8737

I am trying to remove securityContext.capabilities.drop from the main container in a containerset.

I've tried setting capabilities to null or {} on my main container.

I've tried setting drop to null or [] on my main container.

e.g.

            securityContext:
              runAsUser: 1000
              runAsGroup: 1000
              capabilities: null

            securityContext:
              runAsUser: 1000
              runAsGroup: 1000
              capabilities: {}

But when I check the yaml of my pod, the container's securityContext capabilities is still drop all.

Referencing @alexec 's blog post

• https://blog.argoproj.io/practical-argo-workflows-hardening-dd8429acc1ce

And helm's deleting a default key

• https://helm.sh/docs/chart_template_guide/values_files/#deleting-a-default-key

[terrytangyuan]

Seems like a bug. The logic here needs to be revisited: https://github.com/argoproj/argo-workflows/blob/master/workflow/controller/workflowpod.go#L607-L629

[agilgur5]

Looks like an issue was filed for this in #11130, so closing this discussion as superseded