feat: Add support for running UI deployment in restrictive environments

Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>

Author: Sara Qasmi

helm/kagent/templates/ui-deployment.yaml

@@ -30,6 +30,16 @@ spec:
       initContainers:
         {{- tpl (toYaml .) $ | nindent 8 }}
       {{- end }}
+      volumes:
+        - emptyDir: {}
+          name: tmp
+        - emptyDir: {}
+          name: lib-nginx
+        - emptyDir: {}
+          name: run-nginx
+      {{- with .Values.ui.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: ui
           securityContext:
@@ -58,4 +68,14 @@ spec:
             httpGet:
               path: /health
               port: http
-            periodSeconds: 30
+            periodSeconds: 30
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp
+            - mountPath: /var/lib/nginx
+              name: lib-nginx
+            - mountPath: /run/nginx
+              name: run-nginx
+          {{- with .Values.ui.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}

helm/kagent/tests/ui-deployment_test.yaml

@@ -81,14 +81,7 @@ tests:
         initContainers:
           - name: init-nginx
             image: busybox
-            command:
-              - sh
-              - -c
-              - |
-                mkdir -p /var/lib/nginx/tmp/client_body
-            volumeMounts:
-              - name: nginx-writable
-                mountPath: /var/lib/nginx
+            command: []
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].name
@@ -97,5 +90,26 @@ tests:
           path: spec.template.spec.initContainers[0].image
           value: busybox
       - equal:
-          path: spec.template.spec.initContainers[0].volumeMounts[0].mountPath
-          value: /var/lib/nginx
+          path: spec.template.spec.initContainers[0].command
+          value: []
+
+  - it: should include extra volumes and volumeMounts
+    set:
+      ui:
+        volumeMounts:
+        - mountPath: /tmp
+          name: tmp
+        volumes:
+        - name: tmp
+          emptyDir: {}
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            mountPath: /tmp
+            name: tmp
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: tmp
+            emptyDir: {}

helm/kagent/values.yaml

@@ -117,15 +117,32 @@ ui:
   initContainers: []
   # - name: init-nginx
   #   image: busybox
-  #   command:
-  #     - sh
-  #     - -c
-  #     - |
-  #       mkdir -p /var/lib/nginx/tmp/client_body
-  #   volumeMounts:
-  #     - name: nginx-writable
-  #       mountPath: /var/lib/nginx
-
+  #   command: []
+
+  # -- Additional volumeMounts to the UI container
+  volumeMounts: []
+  #  - mountPath: /tmp
+  #    name: tmp
+
+  # -- Additional volumes to the UI pod
+  volumes: []
+  #  - name: tmp
+  #    emptyDir: {}
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    readOnlyRootFilesystem: false
+    seccompProfile:
+      type: RuntimeDefault
+
+  podSecurityContext:
+    runAsUser: 1001
+    runAsGroup: 1001
+    runAsNonRoot: true
+    fsGroup: 1001 
+    
 # ==============================================================================
 # LLM PROVIDERS CONFIGURATION
 # ==============================================================================

ui/Dockerfile

@@ -76,14 +76,15 @@ RUN mkdir -p $BUN_INSTALL  \
     && curl -fsSL https://bun.sh/install | bash -s "bun-v$TOOLS_BUN_VERSION" \
     && bun --version
 
-RUN mkdir -p /app/ui/public /run/nginx/ /var/lib/nginx/tmp/ /var/lib/nginx/logs/  \
+RUN mkdir -p /app/ui/public /run/nginx/ /var/lib/nginx/tmp/ /var/lib/nginx/tmp/client_body /var/lib/nginx/logs/  \
     && addgroup -g 1001    nginx                        \
     && adduser  -u 1001 -G nginx -s /bin/bash -D nextjs \
     && adduser  -u 1002 -G nginx -s /bin/bash -D nginx  \
     && chown    -vR nextjs:nginx /app/ui                \
     && chown    -vR nextjs:nginx /run/nginx             \
-    && chown    -vR nextjs:nginx /var/lib/nginx/
-
+    && chown    -vR nextjs:nginx /var/lib/nginx/        \
+    && touch /var/lib/nginx/logs/error.log              
+    
 WORKDIR /app
 COPY conf/nginx.conf /etc/nginx/nginx.conf
 COPY conf/supervisord.conf /etc/supervisor/conf.d/supervisord.conf