helm: set hubble-ui securityContext

[alex1989hu]

The image hubble-ui no longer needs run as root user

Special notes for your reviewer:
Do not merge it until new hubble-ui image is released, see corresponding pull request: cilium/hubble-ui#31. Tested on k8s (v1.18) with enforced restricted PSP.

UPDATE:
Set it as optional to not to break hubble-ui <= 0.5.0 deployments.

Signed-off-by: Alex Szakaly alex.szakaly@gmail.com

Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Thanks for contributing!

Fixes:
N/A

[maintainer-s-little-helper]

Please set the appropriate release note label.

[alex1989hu]

/cc @gandro - I don't know what is wrong with the label: 1st: filled release not 2nd: removed section => same result.

[gandro]

Thanks a lot for the PR! As discussed on Slack, I believe the securityContext should be opt-in (via Helm values), to allow the chart to function with the existing v0.5 hubble-ui image.

I propose we add the following to the values.yaml of hubble-ui.

securityContext:
  enabled: false
  runAsUser: 1001

Once we have a new release of the hubble-ui container and we bump the default image tag, we can then update the securityContext.enabled=true by default to make it opt-out.

[coveralls]

Coverage increased (+0.01%) to 37.887% when pulling 5a55b66 on alex1989hu:helm/hubble-ui-security-context into e24ab5b on cilium:master.

[gandro]

test-me-please

[gandro]

test-me-please

[gandro]

retest-net-next

[alex1989hu]

Thanks a lot for the PR! As discussed on Slack, I believe the securityContext should be opt-in (via Helm values), to allow the chart to function with the existing v0.5 hubble-ui image.

I propose we add the following to the values.yaml of hubble-ui.

securityContext:
  enabled: false
  runAsUser: 1001

Once we have a new release of the hubble-ui container and we bump the default image tag, we can then update the securityContext.enabled=true by default to make it opt-out.

FYI: new hubble-ui has ben released: https://github.com/cilium/hubble-ui/releases/tag/v0.6.0