nginx-ingress controller: make runAsUser tunable (#8137)

* nginx-ingress controller: make runAsUser tunable

Allow user to specify a different UID for the nginx-ingress-controller.
This is required when using images that are not based on debian, hence
the nginx user has a different value.

By default the debian UID is going to be used. Regular users are not
going to be affected by this change.

Signed-off-by: Flavio Castelli <fcastelli@suse.com>

* Bump nginx-ingress controller version number

Signed-off-by: Flavio Castelli <fcastelli@suse.com>

stable/nginx-ingress/Chart.yaml

@@ -1,5 +1,5 @@
 name: nginx-ingress
-version: 0.29.2
+version: 0.30.0
 appVersion: 0.20.0
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.

stable/nginx-ingress/README.md

@@ -49,6 +49,7 @@ Parameter | Description | Default
 `controller.image.repository` | controller container image repository | `quay.io/kubernetes-ingress-controller/nginx-ingress-controller`
 `controller.image.tag` | controller container image tag | `0.20.0`
 `controller.image.pullPolicy` | controller container image pull policy | `IfNotPresent`
+`controller.image.runAsUser` | User ID of the controller process. Value depends on the Linux distribution used inside of the container image. By default uses debian one. | `33`
 `controller.config` | nginx ConfigMap entries | none
 `controller.hostNetwork` | If the nginx deployment / daemonset should run on the host's network namespace. Do not set this when `controller.service.externalIPs` is set and `kube-proxy` is used as there will be a port-conflict for port `80` | false
 `controller.defaultBackendService` | default 404 backend service; required only if `defaultBackend.enabled = false` | `""`

stable/nginx-ingress/templates/controller-daemonset.yaml

@@ -85,8 +85,7 @@ spec:
                 - ALL
                 add:
                 - NET_BIND_SERVICE
-            # www-data -> 33
-            runAsUser: 33
+            runAsUser: {{ .Values.controller.image.runAsUser }}
           {{- end }}
           env:
             - name: POD_NAME

stable/nginx-ingress/templates/controller-deployment.yaml

@@ -87,8 +87,7 @@ spec:
                 - ALL
                 add:
                 - NET_BIND_SERVICE
-            # www-data -> 33
-            runAsUser: 33
+            runAsUser: {{ .Values.controller.image.runAsUser }}
           {{- end }}
           env:
             - name: POD_NAME

stable/nginx-ingress/values.yaml

@@ -7,6 +7,8 @@ controller:
     repository: quay.io/kubernetes-ingress-controller/nginx-ingress-controller
     tag: "0.20.0"
     pullPolicy: IfNotPresent
+    # www-data -> uid 33
+    runAsUser: 33
 
   config: {}
   # Will add custom header to Nginx https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers