TRT-2776: Fix nginx PID file permission denied under restricted SCC

[jhadvig]

Summary

Add /run to the chgrp/chmod block so nginx can write its PID file when running as non-root under OpenShift's restricted SCC.

Why

nginx writes to /run/nginx.pid at startup. The container runs as UID 1001 under the restricted SCC, so /run/ must be group-writable. PR #14 fixed the nginx binary issue but missed this directory, causing:

nginx: [emerg] open() "/run/nginx.pid" failed (13: Permission denied)

This results in the console plugin pod crash-looping on every TechPreview cluster, triggering CVO ClusterOperatorDegraded alerts and blocking CVO PR #1423 (the un-revert of #1398).

Test plan

• CI image build passes
• Container starts without PID file permission errors

🤖 Generated with Claude Code

[openshift-ci-robot]

@jhadvig: This pull request references TRT-2776 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Add /run to the chgrp/chmod block so nginx can write its PID file when running as non-root under OpenShift's restricted SCC.

Why

nginx writes to /run/nginx.pid at startup. The container runs as UID 1001 under the restricted SCC, so /run/ must be group-writable. PR #14 fixed the nginx binary issue but missed this directory, causing:

nginx: [emerg] open() "/run/nginx.pid" failed (13: Permission denied)

This results in the console plugin pod crash-looping on every TechPreview cluster, triggering CVO ClusterOperatorDegraded alerts and blocking CVO PR #1423 (the un-revert of #1398).

Test plan

• CI image build passes
• Container starts without PID file permission errors

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhadvig

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jhadvig]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jhadvig: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jhadvig]

Closing in favor of #17