Skip to content

Set readOnlyRootFilesystem to true #382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Set readOnlyRootFilesystem to true #382

wants to merge 3 commits into from
+3 −0

Conversation

@razo7
Copy link
Member

@razo7 razo7 commented Sep 10, 2025 •
edited
Loading

An immutable root file system prevents applications from writing to their local disk

Why we need this PR

Limit access to the pod's root file system. An immutable root file system prevents applications from writing to their local disk

Changes made

  • Set readOnlyRootFilesystem to true in the manager config of nhc pod
  • Set readOnlyRootFilesystem to true in the node-remediation-console-plugin config of nhc pod

Which issue(s) this PR fixes

Test plan

Similar fix to medik8s/node-maintenance-operator#136

@razo7
Set readOnlyRootFilesystem to true
63b1795 
An immutable root file system prevents applications from writing to their local disk
@razo7
Run make bundle and apply changes to the bundle container
f1f6ce1 
Update bundle's CSV
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 10, 2025

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 10, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: razo7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai
Copy link

coderabbitai bot commented Sep 10, 2025

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing Touches
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@razo7
Copy link
Member Author

razo7 commented Sep 10, 2025

/test 4.20-openshift-e2e

@razo7
Set readOnlyRootFilesystem to true for the console plugin
79c3a25 
An immutable root file system prevents applications from writing to their local disk
@razo7
Copy link
Member Author

razo7 commented Sep 10, 2025

/test 4.20-openshift-e2e

1 similar comment
@razo7
Copy link
Member Author

razo7 commented Sep 10, 2025

/test 4.20-openshift-e2e

@razo7
Copy link
Member Author

razo7 commented Sep 10, 2025

nhc installation was pending.
/retest

@razo7
Copy link
Member Author

razo7 commented Sep 10, 2025

say /retest to rerun all failed tests

I thought only 4.20 would be triggered, but it triggered all the jobs... 🤷🏻

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 10, 2025

@razo7: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/4.18-openshift-e2e 79c3a25 link true /test 4.18-openshift-e2e
ci/prow/4.20-openshift-e2e 79c3a25 link true /test 4.20-openshift-e2e
ci/prow/4.19-openshift-e2e 79c3a25 link true /test 4.19-openshift-e2e
ci/prow/4.16-openshift-e2e 79c3a25 link true /test 4.16-openshift-e2e
ci/prow/4.17-openshift-e2e 79c3a25 link true /test 4.17-openshift-e2e

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

approved do-not-merge/work-in-progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@razo7