Skip to content

feat: Add support for running UI deployment in restrictive environments #722

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
qasmi wants to merge 9 commits into from
+103 −7
Closed

feat: Add support for running UI deployment in restrictive environments #722

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
88db603
feat: Add support for initContainer in UI deployment
Aug 8, 2025
fffa459
feat: Add support for running UI deployment in restrictive environments
Aug 8, 2025
1b058f7
feat: Add support for nodeSelector and tolerations (#719)
qasmi Aug 8, 2025
80d15c3
doc: fix values comments
Aug 8, 2025
14ab851
feat: extend securitycontext
Aug 8, 2025
95d27ea
fix(kagent-ui): write PID to /var/run/nginx and chown to non-root use…
Aug 13, 2025
2bafdbd
Update Dockerfile
qasmi Aug 13, 2025
b2b6b21
Merge branch 'main' into feature/718
qasmi Feb 27, 2026
0a39cf7
Apply suggestions from code review
EItanya Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 26 additions & 2 deletions helm/kagent/templates/ui-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- toYaml (.Values.ui.podSecurityContext | default .Values.podSecurityContext ) | nindent 8 }}
serviceAccountName: {{ include "kagent.fullname" . }}-ui
{{- with .Values.ui.nodeSelector }}
nodeSelector:
Expand All @@ -34,6 +34,20 @@ spec:
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.ui.initContainers }}
initContainers:
{{- tpl (toYaml .) $ | nindent 8 }}
{{- end }}
volumes:
- emptyDir: {}
name: tmp
- emptyDir: {}
name: lib-nginx
- emptyDir: {}
name: run-nginx
{{- with .Values.ui.volumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- name: ui
securityContext:
Expand Down Expand Up @@ -62,4 +76,14 @@ spec:
httpGet:
path: /health
port: http
periodSeconds: 30
periodSeconds: 30
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /var/lib/nginx
name: lib-nginx
- mountPath: /run/nginx
name: run-nginx
{{- with .Values.ui.volumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
41 changes: 40 additions & 1 deletion helm/kagent/tests/ui-deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,4 +102,43 @@ tests:
key: role
value: AI
effect: NoSchedule
operator: Equal
operator: Equal

- it: should include init-nginx container
set:
ui:
initContainers:
- name: init-nginx
image: busybox
command: []
asserts:
- equal:
path: spec.template.spec.initContainers[0].name
value: init-nginx
- equal:
path: spec.template.spec.initContainers[0].image
value: busybox
- equal:
path: spec.template.spec.initContainers[0].command
value: []

- it: should include extra volumes and volumeMounts
set:
ui:
volumeMounts:
- mountPath: /tmp
name: custom-volume
volumes:
- name: custom-volume
emptyDir: {}
asserts:
- contains:
path: spec.template.spec.containers[0].volumeMounts
content:
mountPath: /tmp
name: custom-volume
- contains:
path: spec.template.spec.volumes
content:
name: custom-volume
emptyDir: {}
29 changes: 29 additions & 0 deletions helm/kagent/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,35 @@ ui:
# -- Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
nodeSelector: {}

# -- Init containers to add to the UI pod if you require a custom configuration
initContainers: []
# - name: init-nginx
# image: busybox
# command: []

# -- Additional volumeMounts to the UI container
volumeMounts: []
# - mountPath: /tmp
# name: tmp

# -- Additional volumes to the UI pod
volumes: []
# - name: tmp
# emptyDir: {}

securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: false
seccompProfile:
type: RuntimeDefault

podSecurityContext:
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
fsGroup: 1001
# ==============================================================================
# LLM PROVIDERS CONFIGURATION
# ==============================================================================
Expand Down
12 changes: 8 additions & 4 deletions ui/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,12 +76,16 @@ RUN mkdir -p $BUN_INSTALL \
&& curl -fsSL https://bun.sh/install | bash -s "bun-v$TOOLS_BUN_VERSION" \
Copy link

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Docker build uses curl -fsSL https://bun.sh/install | bash -s "bun-v$TOOLS_BUN_VERSION" to download and execute a remote installer script without any checksum or signature verification. If bun.sh or its TLS channel is compromised, an attacker could execute arbitrary code during the image build and embed a backdoor or otherwise tamper with the resulting image. Consider switching to a distribution/package-manager-based install or at minimum downloading the installer and verifying it via a pinned checksum or signature before execution.

Copilot uses AI. Check for mistakes.
&& bun --version

RUN mkdir -p /app/ui/public /tmp/nginx/client_temp /tmp/nginx/proxy_temp /tmp/nginx/fastcgi_temp /tmp/nginx/uwsgi_temp /tmp/nginx/scgi_temp \
&& addgroup -g 1001 nginx \
RUN mkdir -p /app/ui/public /run/nginx/ /var/run/nginx/ /var/lib/nginx/tmp/ /var/lib/nginx/tmp/client_body /var/lib/nginx/logs/ \
&& addgroup -g 1001 nginx \
&& adduser -u 1001 -G nginx -s /bin/bash -D nextjs \
&& adduser -u 1002 -G nginx -s /bin/bash -D nginx \
&& chown -vR nextjs:nginx /app/ui \
&& chown -vR nextjs:nginx /tmp/nginx/
&& chown -vR nextjs:nginx /run/nginx \
&& chown -vR nextjs:nginx /var/run/nginx \
&& chown -vR nextjs:nginx /var/lib/nginx/ \

&& touch /var/lib/nginx/logs/error.log && printf '\n' >> /var/lib/nginx/logs/error.log

WORKDIR /app
COPY conf/nginx.conf /etc/nginx/nginx.conf
Expand All @@ -108,4 +112,4 @@ LABEL org.opencontainers.image.version="$VERSION"

USER nextjs

CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
Loading