control-service: Allow job builder run as non-root

[doks5]

Currently, the data job builder requires root priviledges to
run, which is not ideal in situations, where users may have access
to kubernetes clusters which allow pods to run only under SecurityContext.

This change allows the job builder pods to run under security context, by assigning
the ownership of the working directories to UID 1000, which is the first "normal" user
Linux machines create without root priviledges.

Testing Done: Manually tested the change by updating the KubernetesService class
to set security context to the data job builder pod. The change was made to the
createJob() method by adding the following lines and replacing the V1PodTemplateSpecBuilder

List<String> addedCapabilities = Arrays.asList(
               "AUDIT_WRITE",
               "CHOWN",
               "DAC_OVERRIDE",
               "FOWNER",
               "FSETID",
               "KILL",
               "MKNOD",
               "NET_BIND_SERVICE",
               "NET_RAW",
               "SETFCAP",
               "SETGID",
               "SETPCAP",
               "SETUID",
               "SYS_CHROOT"
       );
       List<String> droppedCapabilities = Arrays.asList(
               "AUDIT_CONTROL",
               "BLOCK_SUSPEND",
               "DAC_READ_SEARCH",
               "IPC_OWNER",
               "LEASE",
               "LINUX_IMMUTABLE",
               "MAC_ADMIN",
               "MAC_OVERRIDE",
               "NET_ADMIN",
               "NET_BROADCAST",
               "SYSLOG",
               "SYS_ADMIN",
               "SYS_BOOT",
               "SYS_MODULE",
               "SYS_NICE",
               "SYS_PACCT",
               "SYS_PTRACE",
               "SYS_RAWIO",
               "SYS_RESOURCE",
               "SYS_TIME",
               "SYS_TTY_CONFIG",
               "WAKE_ALARM"
       );
       long fsGroup = 2000;
       long runAsGroup = 2000;
       long runAsUser = 1000;
       long supGroup = 1;
       List<Long> supplementalGroups = Arrays.asList(supGroup);

        log.debug("Creating k8s job name:{}, image:{}", name, image);
        var template = new V1PodTemplateSpecBuilder()
                .withSpec(new V1PodSpecBuilder()
                        .withRestartPolicy("Never")
                        .withContainers(container(name, image, privileged,
                                envs, args, volumeMounts, imagePullPolicy,
                                request, limit, null)
                                .securityContext(new V1SecurityContext()
                                        .allowPrivilegeEscalation(false)
                                        .capabilities(new V1Capabilities()
                                                .add(addedCapabilities)
                                                .drop(droppedCapabilities)
                                        )
                                        .privileged(false)
                                ))
                        .withVolumes(volumes)
                        .withSecurityContext(
                                new V1PodSecurityContext()
                                        .fsGroup(fsGroup)
                                        .runAsGroup(runAsGroup)
                                        .runAsUser(runAsUser)
                                        .supplementalGroups(supplementalGroups)
                        )
                        .build())
                .build();

After the change was made, a local instance of the Control Service was run, and it was
verified that the builder job is able to successfully run under SecurityContext.

Signed-off-by: Andon Andonov [email protected]

[mivanov1988]

LGTM