chore: fix wasm file cache directory permission

test/e2e/testdata/custom-container-security-contex-userid.yaml

@@ -0,0 +1,14 @@
+# This test is to verify that the basic http route works with EG having custom security context user id
+# The custom security context user id is set to 65534 in the test go code
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: custom-eg-security-context-userid
+  namespace: gateway-conformance-infra
+spec:
+  parentRefs:
+    - name: same-namespace
+  rules:
+    - backendRefs:
+        - name: infra-backend-v1
+          port: 8080

test/e2e/tests/httproute_with_custom_security_context_userid.go

@@ -0,0 +1,88 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+//go:build e2e
+
+package tests
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/gateway-api/conformance/utils/http"
+	"sigs.k8s.io/gateway-api/conformance/utils/kubernetes"
+	"sigs.k8s.io/gateway-api/conformance/utils/suite"
+)
+
+func init() {
+	ConformanceTests = append(ConformanceTests, EnvoyGatewayCustomSecurityContextUseridTest)
+}
+
+var EnvoyGatewayCustomSecurityContextUseridTest = suite.ConformanceTest{
+	ShortName:   "EnvoyGatewayCustomSecurityContextUserid",
+	Description: "Envoy Gateway container with custom security context user id",
+	Manifests: []string{
+		"testdata/custom-container-security-contex-userid.yaml",
+	},
+	Test: func(t *testing.T, suite *suite.ConformanceTestSuite) {
+		t.Run("route with custom security context user id", func(t *testing.T) {
+			// set envoy-gateway deployment security context user id to 65534 to test custom user has the necessary permissions
+			// to run the envoy-gateway container
+			setEGSecurityContextUserID(t, suite, 65534)
+
+			ns := "gateway-conformance-infra"
+			routeNN := types.NamespacedName{Name: "custom-eg-security-context-userid", Namespace: ns}
+			gwNN := types.NamespacedName{Name: "same-namespace", Namespace: ns}
+			gwAddr := kubernetes.GatewayAndHTTPRoutesMustBeAccepted(t, suite.Client, suite.TimeoutConfig, suite.ControllerName, kubernetes.NewGatewayRef(gwNN), routeNN)
+
+			expectedResponse := http.ExpectedResponse{
+				Request: http.Request{
+					Path: "/",
+				},
+				Response: http.Response{
+					StatusCode: 200,
+				},
+				Namespace: ns,
+			}
+
+			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, expectedResponse)
+
+			// we don't set the envoy-gateway deployment security context user id back to default because this will
+			// cause the envoy proxies failed to be deleted after the Gateway resources in the base are deleted.
+			// This is acceptable because this won't affect the later tests in the same suite.
+		})
+	},
+}
+
+func setEGSecurityContextUserID(t *testing.T, suite *suite.ConformanceTestSuite, uid int64) {
+	// update envoy-gateway deployment with custom security context user id
+	egDeployment := &appsv1.Deployment{}
+	err := suite.Client.Get(
+		context.Background(),
+		types.NamespacedName{Name: "envoy-gateway", Namespace: "envoy-gateway-system"},
+		egDeployment)
+	require.NoError(t, err)
+	egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser = ptr.To(uid)
+	egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsGroup = ptr.To(uid)
+	err = suite.Client.Update(context.Background(), egDeployment)
+	require.NoError(t, err)
+	// test that envoy-gateway pod is running with custom security context user id
+	WaitForPods(t, suite.Client, "envoy-gateway-system", map[string]string{"control-plane": "envoy-gateway"}, corev1.PodRunning, PodReady)
+
+	// test that envoy-gateway deployment is updated with custom security context user id
+	egDeployment = &appsv1.Deployment{}
+	err = suite.Client.Get(
+		context.Background(),
+		types.NamespacedName{Name: "envoy-gateway", Namespace: "envoy-gateway-system"},
+		egDeployment)
+	require.NoError(t, err)
+	require.Equal(t, uid, *egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsUser, "envoy-gateway deployment is not updated with custom security context user id")
+	require.Equal(t, uid, *egDeployment.Spec.Template.Spec.Containers[0].SecurityContext.RunAsGroup, "envoy-gateway deployment is not updated with custom security context group id")
+}

tools/docker/envoy-gateway/Dockerfile

@@ -1,13 +1,13 @@
 FROM busybox@sha256:37f7b378a29ceb4c551b1b5582e27747b855bbfaa73fa11914fe0df028dc581f AS source
 # Create the data directory for eg
-RUN mkdir -p /var/lib/eg
+RUN mkdir -p /var/lib/eg && chmod -R 0777 /var/lib/eg
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 FROM gcr.io/distroless/base-nossl:nonroot@sha256:ecbab76d6a504ddf7c58a9d786e70f1f1731fa546b1ac0b20dab35c6fc2f3138
 ARG TARGETPLATFORM
-COPY --chown=65532:65532 $TARGETPLATFORM/envoy-gateway /usr/local/bin/
-COPY --from=source --chown=65532:65532 /var/lib /var/lib
+COPY $TARGETPLATFORM/envoy-gateway /usr/local/bin/
+COPY --from=source /var/lib /var/lib
 
 USER 65532:65532