Update to match sample app user (dotnet#5313)

* Update to match sample app

* PR Feedback

* Fix aks deployment tutorial

* Fixup kubernetes.md

Author: wiktork

documentation/kubernetes.md

@@ -7,6 +7,10 @@ In addition to its availability as a .NET CLI tool, the `dotnet monitor` tool is
 
 For Dockerfiles and repository information, see [Running in Docker](./docker.md)
 
+## Non-root considerations
+
+Starting with .NET 8.0, both the sample ASP.NET application and dotnet-monitor run as non-root. If both the application and dotnet-monitor are 8+, no additional configuration is required. Otherwise, a [security context](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) configuration may need to be added to the application, dotnet-monitor, or both.
+
 ## Example Deployment
 
 The following examples demonstrate a deployment of the dotnet-monitor container image monitoring an application container within the same pod.
@@ -37,7 +41,7 @@ spec:
         imagePullPolicy: Always
         env:
         - name: ASPNETCORE_URLS
-          value: http://+:80
+          value: http://+:8080
         - name: DOTNET_DiagnosticPorts
           value: /diag/dotnet-monitor.sock
         volumeMounts:
@@ -49,6 +53,11 @@ spec:
             memory: 512Mi
       - name: monitor
         image: mcr.microsoft.com/dotnet/monitor:6
+        securityContext:
+          # Default APP_UID for non-root dotnet application images
+          runAsUser: 1654
+          runAsGroup: 1654
+          runAsNonRoot: true
         # DO NOT use the --no-auth argument for deployments in production; this argument is used for demonstration
         # purposes only in this example. Please continue reading after this example for further details.
         args: [ "--no-auth" ]
@@ -82,7 +91,7 @@ spec:
 </details>
 
 <details>
-  <summary>.NET Monitor 7+</summary>
+  <summary>.NET Monitor 7</summary>
 
 ```yaml
 # Tell us about your experience using dotnet monitor: https://aka.ms/dotnet-monitor-survey
@@ -107,7 +116,7 @@ spec:
         imagePullPolicy: Always
         env:
         - name: ASPNETCORE_URLS
-          value: http://+:80
+          value: http://+:8080
         - name: DOTNET_DiagnosticPorts
           value: /diag/dotnet-monitor.sock
         volumeMounts:
@@ -118,7 +127,12 @@ spec:
             cpu: 250m
             memory: 512Mi
       - name: monitor
-        image: mcr.microsoft.com/dotnet/monitor
+        image: mcr.microsoft.com/dotnet/monitor:7
+        securityContext:
+          # Default APP_UID for non-root dotnet application images
+          runAsUser: 1654
+          runAsGroup: 1654
+          runAsNonRoot: true
         # DO NOT use the --no-auth argument for deployments in production; this argument is used for demonstration
         # purposes only in this example. Please continue reading after this example for further details.
         args: [ "collect", "--no-auth" ]
@@ -152,6 +166,75 @@ spec:
 
 </details>
 
+<details>
+  <summary>.NET Monitor 8+</summary>
+
+```yaml
+# Tell us about your experience using dotnet monitor: https://aka.ms/dotnet-monitor-survey
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deploy-exampleapp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: exampleapp
+  template:
+    metadata:
+      labels:
+        app: exampleapp
+    spec:
+      restartPolicy: Always
+      containers:
+      - name: app
+        image: mcr.microsoft.com/dotnet/samples:aspnetapp
+        imagePullPolicy: Always
+        env:
+        - name: ASPNETCORE_URLS
+          value: http://+:8080
+        - name: DOTNET_DiagnosticPorts
+          value: /diag/dotnet-monitor.sock
+        volumeMounts:
+        - mountPath: /diag
+          name: diagvol
+        resources:
+          limits:
+            cpu: 250m
+            memory: 512Mi
+      - name: monitor
+        image: mcr.microsoft.com/dotnet/monitor:8
+        # DO NOT use the --no-auth argument for deployments in production; this argument is used for demonstration
+        # purposes only in this example. Please continue reading after this example for further details.
+        args: [ "collect", "--no-auth" ]
+        imagePullPolicy: Always
+        env:
+        - name: DOTNETMONITOR_DiagnosticPort__ConnectionMode
+          value: Listen
+        - name: DOTNETMONITOR_Storage__DefaultSharedPath
+          value: /diag
+        # ALWAYS use the HTTPS form of the URL for deployments in production; the removal of HTTPS is done for
+        # demonstration purposes only in this example. Please continue reading after this example for further details.
+        - name: DOTNETMONITOR_Urls
+          value: http://localhost:52323
+        # The metrics URL is set in the CMD instruction of the image by default. However, this deployment overrides that with the args setting; manually set the URL to the same value using configuration.
+        - name: DOTNETMONITOR_Metrics__Endpoints
+          value: http://+:52325
+        volumeMounts:
+        - mountPath: /diag
+          name: diagvol
+        resources:
+          requests:
+            cpu: 50m
+            memory: 32Mi
+          limits:
+            cpu: 250m
+            memory: 256Mi
+      volumes:
+      - name: diagvol
+        emptyDir: {}
+```
+
 ## Example Details
 
 * __Listen Mode__: The `dotnet monitor` tool is configured to run in `listen` mode. The tool establishes a diagnostic communication channel at the specified Unix Domain Socket path by the `DOTNETMONITOR_DiagnosticPort__EndpointName` environment variable. The application container has a `DOTNET_DiagnosticPorts` environment variable specified so that the application's runtime will communicate with the `dotnet monitor` instance at the specified Unix Domain Socket path. The application runtime will be suspended (e.g. no managed code execution) until it establishes communication with `dotnet monitor`. Application startup time will depend on how long it takes for the `dotnet monitor` container to run, but this should be quick.

samples/AKS_Tutorial/deploy.yaml

@@ -13,13 +13,15 @@ spec:
         app: akstest
     spec:
       restartPolicy: Always
+      securityContext:
+        fsGroup: 1654 # Default APP_ID for the aspnetapp image
       containers:
       - name: publishedapp
         image: mcr.microsoft.com/dotnet/samples:aspnetapp
         imagePullPolicy: Always
         env:
         - name: ASPNETCORE_URLS
-          value: http://+:80
+          value: http://+:8080
         - name: DOTNET_DiagnosticPorts
           value: /diag/port.sock
         volumeMounts:
@@ -30,7 +32,7 @@ spec:
             cpu: 250m
             memory: 512Mi
       - name: monitor
-        image: mcr.microsoft.com/dotnet/monitor:6
+        image: mcr.microsoft.com/dotnet/monitor:8
         imagePullPolicy: Always
         env:
         - name: DotnetMonitor_DiagnosticPort__ConnectionMode