fix(manifests): set explicit runAsUser/runAsGroup on init container

Copilot's HIGH-severity review flagged two related concerns on the init
container's securityContext. OMNI verification (deep mode, embedded
diff only) confirmed:

- Claim 1 (change readOnlyRootFilesystem to false): REJECTED. OCI
  runtime creates mount-point directories before applying the
  readonly rootfs remount (runc mountToRootfs runs before the
  readonly remount). The emptyDir at /nvml-libs is a separate volume
  mounted on top of the rootfs; writes to it are unaffected by the
  rootfs read-only restriction. Weakening the securityContext here
  trades real protection for a non-issue.

- Claim 2 (add runAsUser/runAsGroup: 0): ACCEPTED. busybox:1.36.1 has
  no USER directive and runs as UID 0 today, but adding explicit
  runAsUser/runAsGroup makes the intent unambiguous and is robust to
  a future image change (e.g. if someone swaps busybox for a
  distroless image with USER 65534, root-owned 700 driver files
  would become unreadable). The existing kepler main container also
  uses runAsNonRoot: false without runAsUser, so this PR is just
  hardening the init container ahead of the curve.

Also dropped the redundant quotes around [ALL] in the Helm template
for consistency with the raw manifest (commit fedaef7 fixed the raw
manifest; the Helm template's drop: ["ALL"] was missed). The Helm
template is excluded from yamllint-strict in .pre-commit-config.yaml
so this didn't break CI, but consistency is better.

Signed-off-by: Himanshu Verma <himnshuverma10152006@gmail.com>

Author: bitflicker64

manifests/helm/kepler/templates/daemonset.yaml

@@ -47,13 +47,17 @@ spec:
           image: "{{ .Values.daemonset.nvidia.nvmlInitImage.repository }}:{{ .Values.daemonset.nvidia.nvmlInitImage.tag }}"
           imagePullPolicy: IfNotPresent
           securityContext:
-            # Runs as root (runAsNonRoot: false) because driver-dir files may be
-            # root-owned 700. All Linux capabilities are dropped; no setuid/setgid.
+            # Runs as root (UID 0, GID 0) to read driver-dir files that may be
+            # root-owned 700. Explicit runAsUser/runAsGroup so behavior does not
+            # depend on the image's USER directive. All Linux capabilities are
+            # dropped; no setuid/setgid.
             runAsNonRoot: false
+            runAsUser: 0
+            runAsGroup: 0
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false
             capabilities:
-              drop: ["ALL"]
+              drop: [ALL]
           command:
             - sh
             - -c

manifests/k8s/daemonset.yaml

@@ -31,9 +31,13 @@ spec:
           image: busybox:1.36.1
           imagePullPolicy: IfNotPresent
           securityContext:
-            # Runs as root (runAsNonRoot: false) because driver-dir files may be
-            # root-owned 700. All Linux capabilities are dropped; no setuid/setgid.
+            # Runs as root (UID 0, GID 0) to read driver-dir files that may be
+            # root-owned 700. Explicit runAsUser/runAsGroup so behavior does not
+            # depend on the image's USER directive. All Linux capabilities are
+            # dropped; no setuid/setgid.
             runAsNonRoot: false
+            runAsUser: 0
+            runAsGroup: 0
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false
             capabilities: