helm: optional host mounts with ability to run pod as non-root

helm/ingress-azure/templates/deployment.yaml

@@ -32,8 +32,10 @@ spec:
         {{- end }}
     spec:
       serviceAccountName: {{ template "application-gateway-kubernetes-ingress.serviceaccountname" . }}
-      securityContext:        
-        runAsUser: 0
+      {{- with .Values.kubernetes.securityContext }}
+      securityContext:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: {{ .Chart.Name }}
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
@@ -116,4 +118,4 @@ spec:
       {{- if .Values.image.pullSecrets }}
       imagePullSecrets:
         - name: {{ .Values.image.pullSecrets }}
-      {{- end }}
+      {{- end }}

helm/ingress-azure/tests/fixtures/sample-config-empty.json

@@ -0,0 +1,20 @@
+{
+    "verbosityLevel": 3,
+    "appgw": {
+        "subscriptionId": "0000-0000-0000-0000-00000000",
+        "resourceGroup": "resgp",
+        "name": "gateway",
+        "usePrivateIP": false,
+        "shared": false
+    },
+    "armAuth": {
+        "type": "aadPodIdentity",
+        "identityResourceID": "/a/b/c",
+        "identityClientID": "0000-0000-0000-0000-00000000"
+    },
+    "rbac": {
+        "enabled": false
+    },
+    "kubernetes": {
+    }
+}

helm/ingress-azure/tests/fixtures/sample-config.json

@@ -17,6 +17,10 @@
     },
     "kubernetes": {
         "watchNamespace": "a,b,c",
+        "securityContext": {
+            "runAsUser": 3000,
+            "runAsGroup": 3000
+        },
         "nodeSelector": {
             "beta.kubernetes.io/os": "linux"
         },

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/aadpodidbinding.yaml

@@ -0,0 +1,10 @@
+---
+# Source: ingress-azure/templates/aadpodidbinding.yaml
+# Please see https://github.com/Azure/aad-pod-identity for more inromation
+apiVersion: "aadpodidentity.k8s.io/v1"
+kind: AzureIdentityBinding
+metadata:
+  name: RELEASE-NAME-azidbinding-ingress-azure
+spec: 
+  azureIdentity: RELEASE-NAME-azid-ingress-azure
+  selector: RELEASE-NAME-ingress-azure

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/aadpodidentity.yaml

@@ -0,0 +1,11 @@
+---
+# Source: ingress-azure/templates/aadpodidentity.yaml
+# Please see https://github.com/Azure/aad-pod-identity for more information
+apiVersion: "aadpodidentity.k8s.io/v1"
+kind: AzureIdentity
+metadata:
+  name: RELEASE-NAME-azid-ingress-azure
+spec:
+  type: 0
+  resourceID: /a/b/c
+  clientID: 0000-0000-0000-0000-00000000

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/configmap.yaml

@@ -0,0 +1,20 @@
+---
+# Source: ingress-azure/templates/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: RELEASE-NAME-cm-ingress-azure
+  labels:
+    app: ingress-azure
+    chart: ingress-azure-1.2.1
+    heritage: Helm
+    release: RELEASE-NAME
+data:
+  APPGW_VERBOSITY_LEVEL: "3"
+  HTTP_SERVICE_PORT:     "8123"
+  APPGW_SUBSCRIPTION_ID: "0000-0000-0000-0000-00000000"
+  APPGW_RESOURCE_GROUP:  "resgp"
+  APPGW_NAME:            "gateway"
+  APPGW_SUBNET_NAME: "gateway-subnet"
+  AZURE_CLIENT_ID: "0000-0000-0000-0000-00000000"
+  USE_MANAGED_IDENTITY_FOR_POD: "true"

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/deployment.yaml

@@ -0,0 +1,69 @@
+---
+# Source: ingress-azure/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: RELEASE-NAME-ingress-azure
+  labels:
+    app: ingress-azure
+    chart: ingress-azure-1.2.1
+    heritage: Helm
+    release: RELEASE-NAME
+spec:
+  replicas: 1 # TODO: Make configurable when leader election is supported.
+  selector:
+    matchLabels:
+      app: ingress-azure
+      release: RELEASE-NAME
+  template:
+    metadata:
+      labels:
+        app: ingress-azure
+        release: RELEASE-NAME
+        aadpodidbinding: RELEASE-NAME-ingress-azure
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8123"
+    spec:
+      serviceAccountName: RELEASE-NAME-sa-ingress-azure
+      securityContext:
+        runAsUser: 0
+      containers:
+      - name: ingress-azure
+        image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.2.0
+        imagePullPolicy: Always
+        readinessProbe:
+          httpGet:
+            path: /health/ready
+            port: 8123
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /health/alive
+            port: 8123
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        env:
+        - name: AZURE_CLOUD_PROVIDER_LOCATION
+          value: /etc/appgw/azure.json
+        - name: AGIC_POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: AGIC_POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        envFrom:
+        - configMapRef:
+            name: RELEASE-NAME-cm-ingress-azure
+        volumeMounts:
+        - name: azure
+          mountPath: /etc/appgw/
+          readOnly: true
+      volumes:
+      - name: azure
+        hostPath:
+          path: /etc/kubernetes/
+          type: Directory

helm/ingress-azure/tests/snapshots/sample-config-empty/ingress-azure/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+---
+# Source: ingress-azure/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: ingress-azure
+    chart: ingress-azure-1.2.1
+    heritage: Helm
+    release: RELEASE-NAME
+  name: RELEASE-NAME-sa-ingress-azure

helm/ingress-azure/tests/snapshots/sample-config/ingress-azure/templates/deployment.yaml

@@ -27,8 +27,9 @@ spec:
         custom-annotation: custom-value
     spec:
       serviceAccountName: RELEASE-NAME-sa-ingress-azure
-      securityContext:        
-        runAsUser: 0
+      securityContext:
+        runAsGroup: 3000
+        runAsUser: 3000
       containers:
       - name: ingress-azure
         image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.2.0

helm/ingress-azure/values.yaml

@@ -29,6 +29,9 @@ kubernetes:
     # disktype: dentro
   tolerations: []
   affinity: {}
+
+  securityContext:
+    runAsUser: 0
 
   # Add pod level annotations
   podAnnotations: {}
@@ -72,4 +75,4 @@ nodeSelector: {}
 ################################################################################
 # Specify if the cluster is RBAC enabled or not
 rbac:
-  enabled: false # true/false
+  enabled: false # true/false