Rabbitmq fails in validation step as when security context set as readOnlyRootFileSystem - openshift

[Mdirfan6]

I am trying to install the latest version rabbitmq version 3.9.5 with image 3.9.5-debian-10-r10.
In openshift we have to setcurity context as readOnlyRootFileSystem to true. But when I keep this true.

I get the following error

ERROR ==> The variable RABBITMQ_COMBINED_CERT_PATH must be set to either an existant file or a non-existant file in a writable directory.
/opt/bitnami/scripts/libvalidations.sh: line 200: cannot create temp file for here-document: Read-only file system
/opt/bitnami/scripts/libvalidations.sh: line 202: ip_array[0]: unbound variable

I tried to set the variable "RABBITMQ_COMBINED_CERT_PATH" in statefullset.yaml to path /opt/bitnami. yet I get the same error.

I am not sure how this has to be done. As I noticed variable not being set even after we add it in yaml.
Any info on this will help.

[michaelklishin]

I will convert this issue to a GitHub discussion. Currently GitHub will automatically close and lock the issue even though your question will be transferred and responded to elsewhere. This is to let you know that we do not intend to ignore this but this is how the current GitHub conversion mechanism makes it seem for the users :(

[michaelklishin]

/opt/bitnami/scripts/libvalidations.sh

is not something the RabbitMQ core team maintains. Sounds like a Bintami image-specific validation to me.

[michaelklishin]

In general, we recommend avoiding the Bitnami RabbitMQ image. Use the standard community Docker image and if on Kubernetes, our cluster Operator which handles at least some OpenShift-specific security decisions.

The Bitnami image is full of decisions entirely specific to that image. This introduces entire classes of problems unknown to the rest of the community.

[mluds]

The /tmp directory and a few others need to be writeable. In Kubernetes this can be done by mounting an emptyDir volume.

If you're using the Bitnami Helm chart, you can put this in your values.yaml:

extraVolumes:
  - name: tmp
    emptyDir: {}
  - name: etc
    emptyDir: {}
  - name: var
    emptyDir: {}
  - name: home
    emptyDir: {}
  - name: rabbitmq
    emptyDir: {}
extraVolumeMounts:
  - name: tmp
    mountPath: /tmp
  - name: etc
    mountPath: /opt/bitnami/rabbitmq/etc/rabbitmq
  - name: var
    mountPath: /opt/bitnami/rabbitmq/var/lib/rabbitmq
  - name: home
    mountPath: /opt/bitnami/rabbitmq/.rabbitmq
  - name: rabbitmq
    mountPath: /bitnami/rabbitmq

[michaelklishin]

@mluds thank you but this is something that Bitnami image maintainers should document somewhere. RabbitMQ does not use the /tmp directory unless the node is explicitly configured to use it.