feat: multiple improvements for REANA 0.9.4

reana_workflow_controller/config.py

@@ -11,7 +11,11 @@
 import os
 import json
 
-from reana_commons.config import REANA_COMPONENT_PREFIX, SHARED_VOLUME_PATH
+from reana_commons.config import (
+    MQ_CONNECTION_STRING,
+    REANA_COMPONENT_PREFIX,
+    SHARED_VOLUME_PATH,
+)
 from reana_db.models import JobStatus, RunStatus
 
 from reana_workflow_controller.version import __version__
@@ -22,6 +26,9 @@ def _env_vars_dict_to_k8s_list(env_vars):
     return [{"name": name, "value": str(value)} for name, value in env_vars.items()]
 
 
+SECRET_KEY = os.getenv("REANA_SECRET_KEY", "CHANGE_ME")
+"""Secret key used for the application user sessions."""
+
 SQLALCHEMY_TRACK_MODIFICATIONS = False
 """Track modifications flag."""
 
@@ -119,7 +126,8 @@ def _env_vars_dict_to_k8s_list(env_vars):
 """
 
 WORKFLOW_ENGINE_COMMON_ENV_VARS = [
-    {"name": "SHARED_VOLUME_PATH", "value": SHARED_VOLUME_PATH}
+    {"name": "SHARED_VOLUME_PATH", "value": SHARED_VOLUME_PATH},
+    {"name": "RABBIT_MQ", "value": MQ_CONNECTION_STRING},
 ]
 """Common to all workflow engines environment variables."""
 

reana_workflow_controller/factory.py

@@ -50,7 +50,6 @@ def create_app(config_mapping=None):
     if config_mapping:
         app.config.from_mapping(config_mapping)
 
-    app.secret_key = "super secret key"
     # Register API routes
     from reana_workflow_controller.rest import (
         workflows_session,

reana_workflow_controller/k8s.py

@@ -221,7 +221,9 @@ def add_environment_variable(self, name, value):
 
     def add_run_with_root_permissions(self):
         """Run interactive session with root."""
-        security_context = client.V1SecurityContext(run_as_user=0)
+        security_context = client.V1SecurityContext(
+            run_as_user=0, allow_privilege_escalation=False
+        )
         self._session_container.security_context = security_context
 
     def add_user_secrets(self):

reana_workflow_controller/workflow_run_manager.py

@@ -557,6 +557,7 @@ def _create_job_spec(
         workflow_engine_container.security_context = client.V1SecurityContext(
             run_as_group=WORKFLOW_RUNTIME_USER_GID,
             run_as_user=WORKFLOW_RUNTIME_USER_UID,
+            allow_privilege_escalation=False,
         )
         workflow_engine_container.volume_mounts = [workspace_mount]