Allow for SPIRE Agent to run as non root user (#209)

Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>

charts/spire/charts/spire-agent/values.yaml

@@ -109,6 +109,23 @@ waitForIt:
     tag: latest-20230517
   resources: {}
 
+# When running as non root, needed to ensure the socket path has the correct permissions.
+# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
+fsGroupFix:
+  image:
+    # -- The OCI registry to pull the image from
+    registry: cgr.dev
+    # -- The repository within the registry
+    repository: chainguard/bash
+    # -- The image pull policy
+    pullPolicy: Always
+    # -- This value is deprecated in favor of tag. (Will be removed in a future release)
+    version: ""
+    # -- Overrides the image tag
+    tag: latest-20230517
+  # -- Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+  resources: {}
+
 # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
 workloadAttestors:
   # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.