Consider using nginx-unprivileged

[grieshaber]

Problem Statement

When deploying VMClarity with the current helm chart to a more restrictive Kubernetes environment, some components fail.
Especially the UI won't work, as the normal nginx image is used, which requires the usage of the root user or lots of adaptions (emptyDir Mount, high port, ...), which are currently not configurable via the helm chart.

Proposed Solution

I'd see two solutions:

1. Allow more flexibility in the helm chart, e.g. configuring the port of the UI Service, additional volume mounts for emptyDir etc.

2. Use a secure-by-default approach and use images like nginx-unprivileged and activate the podSecurityContext / containerSecurityContext for UI etc. per default (currently: enabled: false)

Alternatives Considered

There is no alternative to security ;)

Additional Context

n/a

[github-actions]

Thank you for your contribution! This issue has been automatically marked as stale because it has no recent activity in the last 60 days. It will be closed in 14 days, if no further activity occurs. If this issue is still relevant, please leave a comment to let us know, and the stale label will be automatically removed.