Merge pull request #113 from PDOK/fix_readonly_gpkgs

Set GPKG's to read-only explicitly, instead of the base volume.

Author: Daimanta

internal/controller/blobdownload/blob_download.go

@@ -63,7 +63,7 @@ func GetBlobDownloadInitContainer[O pdoknlv3.WMSWFS](obj O, images types.Images)
 		},
 		Command: []string{"/bin/sh", "-c"},
 		VolumeMounts: []corev1.VolumeMount{
-			utils.GetBaseVolumeMount(false),
+			utils.GetBaseVolumeMount(),
 			utils.GetDataVolumeMount(),
 		},
 	}

internal/controller/blobdownload/gpkg_download.sh

@@ -103,6 +103,8 @@ function download() {
         echo "No hash found for $file in blob storage, skipping checksum."
     fi
 
+    # After successful download set the GPKG to readonly
+    chmod -wx $file
     echo "done"
 }
 

internal/controller/featureinfogenerator/featureinfo_generator.go

@@ -27,7 +27,7 @@ func GetFeatureinfoGeneratorInitContainer(images types.Images) (*corev1.Containe
 			"feature-info",
 		},
 		VolumeMounts: []corev1.VolumeMount{
-			utils.GetBaseVolumeMount(false),
+			utils.GetBaseVolumeMount(),
 			utils.GetConfigVolumeMount(constants.ConfigMapFeatureinfoGeneratorVolumeName),
 		},
 	}

internal/controller/legendgenerator/legend_generator.go

@@ -40,7 +40,7 @@ exit $exit_code;
 `,
 		},
 		VolumeMounts: []corev1.VolumeMount{
-			utils.GetBaseVolumeMount(false),
+			utils.GetBaseVolumeMount(),
 			utils.GetDataVolumeMount(),
 			{Name: constants.MapserverName, MountPath: "/srv/mapserver/config/default_mapserver.conf", SubPath: "default_mapserver.conf"},
 		},

internal/controller/mapfilegenerator/mapfile_generator.go

@@ -28,7 +28,7 @@ func GetMapfileGeneratorInitContainer[O pdoknlv3.WMSWFS](obj O, images types.Ima
 			"/srv/data/config/mapfile",
 		},
 		VolumeMounts: []corev1.VolumeMount{
-			utils.GetBaseVolumeMount(false),
+			utils.GetBaseVolumeMount(),
 			utils.GetConfigVolumeMount(constants.ConfigMapMapfileGeneratorVolumeName),
 		},
 	}

internal/controller/mapserver/deployment.go

@@ -63,7 +63,7 @@ func GetMapserverContainer[O pdoknlv3.WMSWFS](obj O, images types.Images) (*core
 
 func getVolumeMounts(customMapfile bool) []corev1.VolumeMount {
 	volumeMounts := []corev1.VolumeMount{
-		utils.GetBaseVolumeMount(true),
+		utils.GetBaseVolumeMount(),
 		utils.GetDataVolumeMount(),
 	}
 

internal/controller/mapserver/test_data/expected_volumemounts.yaml

@@ -1,7 +1,7 @@
 volumeMounts:
 - mountPath: /srv/data
   name: base
-  readOnly: true
+  readOnly: false
 - mountPath: /var/www
   name: data
 - mountPath: /srv/mapserver/config/include.conf

internal/controller/test_data/wfs/complete/expected/configmap-init-scripts.yaml

@@ -179,7 +179,7 @@ metadata:
     service-type: wfs
     service-version: v1_0
     theme: theme
-  name: complete-wfs-init-scripts-fft29bbtdd
+  name: complete-wfs-init-scripts-f8k8ffgmgh
   namespace: default
   ownerReferences:
     - apiVersion: pdok.nl/v3

internal/controller/test_data/wfs/complete/expected/deployment.yaml

@@ -126,7 +126,7 @@ spec:
           volumeMounts:
             - mountPath: /srv/data
               name: base
-              readOnly: true
+              readOnly: false
             - mountPath: /var/www
               name: data
               readOnly: false
@@ -258,7 +258,7 @@ spec:
           name: mapserver
         - configMap:
             defaultMode: 511
-            name: complete-wfs-init-scripts-fft29bbtdd
+            name: complete-wfs-init-scripts-f8k8ffgmgh
           name: init-scripts
         - configMap:
             name: complete-wfs-capabilities-generator-mfbh8cgh5c

internal/controller/test_data/wfs/minimal/expected/configmap-init-scripts.yaml

@@ -11,7 +11,7 @@ metadata:
     pdok.nl/inspire: 'false'
     service-type: wfs
     service-version: v1_0
-  name: minimal-wfs-init-scripts-fft29bbtdd
+  name: minimal-wfs-init-scripts-f8k8ffgmgh
   namespace: default
   ownerReferences:
     - apiVersion: pdok.nl/v3