Switch to non root nginx (#89)

charts/spire/charts/spiffe-oidc-discovery-provider/README.md

@@ -36,7 +36,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | insecureScheme.enabled | bool | `false` |  |
 | insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` |  |
 | insecureScheme.nginx.image.registry | string | `"docker.io"` |  |
-| insecureScheme.nginx.image.repository | string | `"nginx"` |  |
+| insecureScheme.nginx.image.repository | string | `"nginxinc/nginx-unprivileged"` |  |
 | insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` |  |
 | insecureScheme.nginx.resources | object | `{}` |  |
 | nameOverride | string | `""` |  |

charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml

@@ -40,14 +40,14 @@ data:
       live_path = "/live"
     }
   {{- if .Values.insecureScheme.enabled }}
-  default.conf.template: |
+  default.conf: |
     upstream oidc {
       server unix:{{ $oidcSocket }};
     }
 
     server {
-      listen            80;
+      listen            8080;
-      listen       [::]:80;
+      listen       [::]:8080;
 
       location / {
         proxy_pass http://oidc;

charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml

@@ -77,16 +77,19 @@ spec:
           image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
           imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               name: http
           volumeMounts:
             - name: spire-oidc-sockets
               mountPath: /run/spire/oidc-sockets
               readOnly: true
             - name: spire-oidc-config
-              mountPath: /etc/nginx/templates/default.conf.template
+              mountPath: /etc/nginx/conf.d/default.conf
-              subPath: default.conf.template
+              subPath: default.conf
               readOnly: true
+            - name: nginx-tmp
+              mountPath: /tmp
+              readOnly: false
           resources:
             {{- toYaml .Values.insecureScheme.nginx.resources | nindent 12 }}
         {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
@@ -96,7 +99,7 @@ spec:
           image: {{ template "spiffe-oidc-discovery-provider.image" .Values.telemetry.prometheus.nginxExporter }}
           imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
           args:
-          - -nginx.scrape-uri=http://127.0.0.1/stub_status
+          - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status
           resources:
             {{- toYaml .Values.telemetry.prometheus.nginxExporter.resources | nindent 12 }}
           ports:
@@ -114,6 +117,8 @@ spec:
         - name: spire-oidc-config
           configMap:
             name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
+        - name: nginx-tmp
+          emptyDir: {}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml

@@ -49,7 +49,7 @@ insecureScheme:
   nginx:
     image:
       registry: docker.io
-      repository: nginx
+      repository: nginxinc/nginx-unprivileged
       pullPolicy: IfNotPresent
       version: 1.23.2-alpine
       # chainguard image does not support the templates feature