chore: run BackupRepo precheck job with non-root user (#9713)

Author: zjx20

controllers/dataprotection/backuprepo_controller.go

@@ -759,7 +759,6 @@ func (r *BackupRepoReconciler) runPreCheckJobForMounting(reconCtx *reconcileCont
 	job.Name = reconCtx.preCheckResourceName()
 	job.Namespace = namespace
 	_, err = createObjectIfNotExist(reconCtx.Ctx, r.Client, job, func() error {
-		runAsUser := int64(0)
 		job.Spec = batchv1.JobSpec{
 			Template: corev1.PodTemplateSpec{
 				Spec: corev1.PodSpec{
@@ -777,7 +776,7 @@ func (r *BackupRepoReconciler) runPreCheckJobForMounting(reconCtx *reconcileCont
 						}},
 						SecurityContext: &corev1.SecurityContext{
 							AllowPrivilegeEscalation: boolptr.False(),
-							RunAsUser:                &runAsUser,
+							RunAsNonRoot:             boolptr.True(),
 						},
 					}},
 					Volumes: []corev1.Volume{{
@@ -838,7 +837,6 @@ func (r *BackupRepoReconciler) runPreCheckJobForTool(reconCtx *reconcileContext,
 	job.Name = reconCtx.preCheckResourceName()
 	job.Namespace = namespace
 	_, err = createObjectIfNotExist(reconCtx.Ctx, r.Client, job, func() error {
-		runAsUser := int64(0)
 		job.Spec = batchv1.JobSpec{
 			Template: corev1.PodTemplateSpec{
 				Spec: corev1.PodSpec{
@@ -858,7 +856,7 @@ datasafed rm %s`, precheckFilePath, precheckFilePath, precheckFilePath),
 						},
 						SecurityContext: &corev1.SecurityContext{
 							AllowPrivilegeEscalation: boolptr.False(),
-							RunAsUser:                &runAsUser,
+							RunAsNonRoot:             boolptr.True(),
 						},
 					}},
 					ServiceAccountName: saName,

pkg/dataprotection/utils/backuprepo.go

@@ -28,6 +28,7 @@ import (
 	"github.com/apecloud/kubeblocks/pkg/constant"
 	intctrlutil "github.com/apecloud/kubeblocks/pkg/controllerutil"
 	dptypes "github.com/apecloud/kubeblocks/pkg/dataprotection/types"
+	"github.com/apecloud/kubeblocks/pkg/dataprotection/utils/boolptr"
 	viper "github.com/apecloud/kubeblocks/pkg/viperx"
 )
 
@@ -152,6 +153,10 @@ func injectDatasafedInstaller(podSpec *corev1.PodSpec) {
 		ImagePullPolicy: corev1.PullPolicy(viper.GetString(constant.KBImagePullPolicy)),
 		Command:         []string{"/bin/sh", "-c", fmt.Sprintf("/scripts/install-datasafed.sh %s", datasafedBinMountPath)},
 		VolumeMounts:    []corev1.VolumeMount{sharedVolumeMount},
+		SecurityContext: &corev1.SecurityContext{
+			AllowPrivilegeEscalation: boolptr.False(),
+			RunAsNonRoot:             boolptr.True(),
+		},
 	}
 	intctrlutil.InjectZeroResourcesLimitsIfEmpty(&initContainer)
 	podSpec.InitContainers = append(podSpec.InitContainers, initContainer)