Skip to content

feat: Add support for running UI deployment in restrictive environments#722

Open
qasmi wants to merge 9 commits intokagent-dev:mainfrom
qasmi:feature/718
Open

feat: Add support for running UI deployment in restrictive environments#722
qasmi wants to merge 9 commits intokagent-dev:mainfrom
qasmi:feature/718

Conversation

@qasmi
Copy link
Contributor

@qasmi qasmi commented Aug 8, 2025

@qasmi qasmi requested review from EItanya and ilackarms as code owners August 8, 2025 13:54
@qasmi qasmi changed the title feat: Add support for initContainer in UI deployment feat: Add support for initContainer in kagent deployments Aug 8, 2025
@qasmi qasmi changed the title feat: Add support for initContainer in kagent deployments feat: Add support for initContainer in ui deployment Aug 8, 2025
@EItanya
Copy link
Contributor

EItanya commented Aug 8, 2025

Please see the comment on the issue

@qasmi qasmi requested a review from peterj as a code owner August 8, 2025 17:41
@qasmi qasmi force-pushed the feature/718 branch 2 times, most recently from 68dce45 to f394db4 Compare August 8, 2025 17:49
@qasmi qasmi changed the title feat: Add support for initContainer in ui deployment feat: Add support for running UI deployment in restrictive environments Aug 8, 2025
@qasmi qasmi force-pushed the feature/718 branch 7 times, most recently from 66b6489 to 7db948c Compare August 13, 2025 13:21
Sara Qasmi and others added 7 commits August 13, 2025 15:25
Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
* feat: Add support for nodeSelector and tolerations

Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>

* feat: Add support for nodeSelector and tolerations in tools

Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>

---------

Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
Co-authored-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
…r to avoid permission error (kagent-dev#743)

Signed-off-by: Paul Yu <paul.d.yu@gmail.com>
Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
Signed-off-by: Sara Qasmi <saraqasmi@Saras-MacBook-Pro.local>
@qasmi
Copy link
Contributor Author

qasmi commented Aug 13, 2025

@EItanya I updated the PR following your feedback

@EItanya
Copy link
Contributor

EItanya commented Aug 13, 2025

Sounds good! I'll take a look today :)

@EItanya
Copy link
Contributor

EItanya commented Aug 13, 2025

Hey there, I got this when running locally:

/usr/lib/python3.13/site-packages/supervisor/options.py:13: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
2025-08-13 18:52:15,478 INFO Set uid to user 1001 succeeded
2025-08-13 18:52:15,478 INFO Set uid to user 1001 succeeded
2025-08-13 18:52:15,492 INFO supervisord started with pid 1
2025-08-13 18:52:15,492 INFO supervisord started with pid 1
2025-08-13 18:52:16,496 INFO spawned: 'nextjs' with pid 14
2025-08-13 18:52:16,496 INFO spawned: 'nextjs' with pid 14
2025-08-13 18:52:16,499 INFO spawned: 'nginx' with pid 15
2025-08-13 18:52:16,499 INFO spawned: 'nginx' with pid 15
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)
2025-08-13 18:52:16,506 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:16,506 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:16,506 INFO success: nextjs entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:16,506 INFO success: nextjs entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:16,506 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:16,506 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:16,509 DEBG 'nginx' stderr output:
2025/08/13 18:52:16 [emerg] 15#15: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025-08-13 18:52:16,509 DEBG 'nginx' stderr output:
2025/08/13 18:52:16 [emerg] 15#15: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025/08/13 18:52:16 [emerg] 15#15: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)
2025-08-13 18:52:16,509 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942250674640 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:16,509 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942250674640 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:16,509 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942249858624 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:16,509 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942249858624 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:16,510 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:16,510 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:16,510 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:16,510 DEBG received SIGCHLD indicating a child quit
   ▲ Next.js 15.3.4
   - Local:        http://localhost:8001
   - Network:      http://0.0.0.0:8001
2025-08-13 18:52:17,061 DEBG 'nextjs' stdout output:
   ▲ Next.js 15.3.4
   - Local:        http://localhost:8001
   - Network:      http://0.0.0.0:8001

2025-08-13 18:52:17,061 DEBG 'nextjs' stdout output:
   ▲ Next.js 15.3.4
   - Local:        http://localhost:8001
   - Network:      http://0.0.0.0:8001

2025-08-13 18:52:17,063 INFO spawned: 'nginx' with pid 27
2025-08-13 18:52:17,063 INFO spawned: 'nginx' with pid 27

 ✓ Starting...
2025-08-13 18:52:17,064 DEBG 'nextjs' stdout output:

 ✓ Starting...

2025-08-13 18:52:17,064 DEBG 'nextjs' stdout output:

 ✓ Starting...

2025-08-13 18:52:17,064 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:17,064 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)
2025-08-13 18:52:17,071 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:17,071 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:17,074 DEBG 'nginx' stderr output:
2025/08/13 18:52:17 [emerg] 27#27: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025-08-13 18:52:17,074 DEBG 'nginx' stderr output:
2025/08/13 18:52:17 [emerg] 27#27: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025/08/13 18:52:17 [emerg] 27#27: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)
2025-08-13 18:52:17,074 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942250935744 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:17,074 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942250935744 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:17,074 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942249453840 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:17,074 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942249453840 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:17,074 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:17,074 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:17,074 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:17,074 DEBG received SIGCHLD indicating a child quit
 ✓ Ready in 183ms
2025-08-13 18:52:17,202 DEBG 'nextjs' stdout output:
 ✓ Ready in 183ms

2025-08-13 18:52:17,202 DEBG 'nextjs' stdout output:
 ✓ Ready in 183ms

2025-08-13 18:52:17,204 INFO spawned: 'nginx' with pid 31
2025-08-13 18:52:17,204 INFO spawned: 'nginx' with pid 31
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)
2025-08-13 18:52:17,212 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:17,212 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:17,212 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:17,212 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:17,215 DEBG 'nginx' stderr output:
2025/08/13 18:52:17 [emerg] 31#31: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025-08-13 18:52:17,215 DEBG 'nginx' stderr output:
2025/08/13 18:52:17 [emerg] 31#31: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)
2025/08/13 18:52:17 [emerg] 31#31: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025-08-13 18:52:17,215 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942248977808 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:17,215 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942248977808 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:17,215 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942248980528 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:17,215 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942248980528 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:17,215 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:17,215 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:17,215 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:17,215 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:18,219 INFO spawned: 'nginx' with pid 33
2025-08-13 18:52:18,219 INFO spawned: 'nginx' with pid 33
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)
2025-08-13 18:52:18,227 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:18,227 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:18,227 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025-08-13 18:52:18,227 INFO success: nginx entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
2025/08/13 18:52:18 [emerg] 33#33: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)
2025-08-13 18:52:18,229 DEBG 'nginx' stderr output:
2025/08/13 18:52:18 [emerg] 33#33: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025-08-13 18:52:18,229 DEBG 'nginx' stderr output:
2025/08/13 18:52:18 [emerg] 33#33: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025-08-13 18:52:18,230 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942250952528 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:18,230 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942250952528 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stdout)>
2025-08-13 18:52:18,230 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942250952272 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:18,230 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942250952272 for <Subprocess at 139942250671120 with name nginx in state RUNNING> (stderr)>
2025-08-13 18:52:18,230 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:18,230 WARN exited: nginx (exit status 1; not expected)
2025-08-13 18:52:18,230 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:18,230 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:19,234 INFO spawned: 'nginx' with pid 34
2025-08-13 18:52:19,234 INFO spawned: 'nginx' with pid 34
2025-08-13 18:52:19,234 WARN received SIGTERM indicating exit request
2025-08-13 18:52:19,234 WARN received SIGTERM indicating exit request
2025-08-13 18:52:19,235 DEBG killing nginx (pid 34) with signal SIGTERM
2025-08-13 18:52:19,235 DEBG killing nginx (pid 34) with signal SIGTERM
2025-08-13 18:52:19,235 INFO waiting for nextjs, nginx to die
2025-08-13 18:52:19,235 INFO waiting for nextjs, nginx to die
2025-08-13 18:52:19,241 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

2025-08-13 18:52:19,241 DEBG 'nginx' stderr output:
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)

nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (2: No such file or directory)
2025-08-13 18:52:19,244 DEBG 'nginx' stderr output:
2025/08/13 18:52:19 [emerg] 34#34: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025-08-13 18:52:19,244 DEBG 'nginx' stderr output:
2025/08/13 18:52:19 [emerg] 34#34: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)

2025/08/13 18:52:19 [emerg] 34#34: mkdir() "/var/lib/nginx/tmp/client_body" failed (2: No such file or directory)
2025-08-13 18:52:19,245 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942269339360 for <Subprocess at 139942250671120 with name nginx in state STOPPING> (stdout)>
2025-08-13 18:52:19,245 DEBG fd 9 closed, stopped monitoring <POutputDispatcher at 139942269339360 for <Subprocess at 139942250671120 with name nginx in state STOPPING> (stdout)>
2025-08-13 18:52:19,245 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942249013296 for <Subprocess at 139942250671120 with name nginx in state STOPPING> (stderr)>
2025-08-13 18:52:19,245 DEBG fd 13 closed, stopped monitoring <POutputDispatcher at 139942249013296 for <Subprocess at 139942250671120 with name nginx in state STOPPING> (stderr)>
2025-08-13 18:52:19,245 WARN stopped: nginx (exit status 1)
2025-08-13 18:52:19,245 WARN stopped: nginx (exit status 1)
2025-08-13 18:52:19,245 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:19,245 DEBG received SIGCHLD indicating a child quit
2025-08-13 18:52:19,245 DEBG killing nextjs (pid 14) with signal SIGTERM
2025-08-13 18:52:19,245 DEBG killing nextjs (pid 14) with signal SIGTERM
2025-08-13 18:52:19,257 DEBG fd 6 closed, stopped monitoring <POutputDispatcher at 139942250639248 for <Subprocess at 139942250638912 with name nextjs in state STOPPING> (stdout)>
2025-08-13 18:52:19,257 DEBG fd 6 closed, stopped monitoring <POutputDispatcher at 139942250639248 for <Subprocess at 139942250638912 with name nextjs in state STOPPING> (stdout)>
2025-08-13 18:52:19,257 DEBG fd 8 closed, stopped monitoring <POutputDispatcher at 139942250673680 for <Subprocess at 139942250638912 with name nextjs in state STOPPING> (stderr)>
2025-08-13 18:52:19,257 DEBG fd 8 closed, stopped monitoring <POutputDispatcher at 139942250673680 for <Subprocess at 139942250638912 with name nextjs in state STOPPING> (stderr)>
2025-08-13 18:52:19,258 INFO stopped: nextjs (exit status 0)
2025-08-13 18:52:19,258 INFO stopped: nextjs (exit status 0)
2025-08-13 18:52:19,258 DEBG received SIGCHLD indicating a child qui

@EItanya
Copy link
Contributor

EItanya commented Feb 2, 2026

hey there, are you still interested in this?

Signed-off-by: sara  <qasmisara@gmail.com>
Copilot AI review requested due to automatic review settings February 27, 2026 09:00
@qasmi
Copy link
Contributor Author

qasmi commented Feb 27, 2026

Still needed

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds support for running the UI deployment in restrictive Kubernetes environments with strict pod security contexts. The changes address issue #718 where nginx fails to start due to missing writable directories when using restrictive securityContext settings.

Changes:

  • Added emptyDir volume mounts for writable directories (/tmp, /var/lib/nginx, /run/nginx) to support read-only root filesystems and restrictive security contexts
  • Added configuration options for init containers, custom volumes, and volume mounts to allow users to prepare requirements before the main container starts
  • Added UI-specific pod and container security contexts with secure defaults (non-root user, no privilege escalation, dropped capabilities)

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File Description
ui/Dockerfile Updated directory creation to include nginx runtime directories and set proper ownership for the nextjs user (uid 1001)
helm/kagent/values.yaml Added UI-specific security contexts, init containers, volumes, and volumeMounts configuration options
helm/kagent/templates/ui-deployment.yaml Implemented emptyDir volumes for writable paths, integrated init containers support, and applied UI-specific security contexts
helm/kagent/tests/ui-deployment_test.yaml Added test coverage for init containers and custom volumes/volumeMounts features
Comments suppressed due to low confidence (1)

helm/kagent/templates/ui-deployment.yaml:54

  • The container securityContext is using the global .Values.securityContext instead of the UI-specific .Values.ui.securityContext that was added in this PR. This is inconsistent with the controller deployment pattern which uses .Values.controller.securityContext. Change this line to use (.Values.ui.securityContext | default .Values.securityContext) to align with the established pattern and allow UI-specific security context configuration.
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +129 to +130
- mountPath: /tmp
name: tmp
Copy link

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test is using /tmp as an example for volumeMounts, but /tmp is already mounted by default in the deployment template (lines 81-82 of ui-deployment.yaml). This test would create a duplicate mount path which is invalid in Kubernetes. Use a different path like /custom-mount in the test example to avoid confusion and demonstrate that additional volumeMounts work alongside the default ones.

Copilot uses AI. Check for mistakes.
@@ -76,12 +76,16 @@ RUN mkdir -p $BUN_INSTALL \
&& curl -fsSL https://bun.sh/install | bash -s "bun-v$TOOLS_BUN_VERSION" \
Copy link

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Docker build uses curl -fsSL https://bun.sh/install | bash -s "bun-v$TOOLS_BUN_VERSION" to download and execute a remote installer script without any checksum or signature verification. If bun.sh or its TLS channel is compromised, an attacker could execute arbitrary code during the image build and embed a backdoor or otherwise tamper with the resulting image. Consider switching to a distribution/package-manager-based install or at minimum downloading the installer and verifying it via a pinned checksum or signature before execution.

Copilot uses AI. Check for mistakes.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
@github-actions
Copy link

This pull request has been marked as stale because of no activity in the last 15 days. It will be closed in the next 5 days unless it is tagged "no stalebot" or other activity occurs.

@github-actions github-actions bot added the stale This issue or PR has become stale label Mar 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

stale This issue or PR has become stale

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants