This is an automated email from the ASF dual-hosted git repository.
dongjoon-hyun pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/spark-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new d7151c0 [SPARK-57940] Enable `readOnlyRootFilesystem` for operator
container in Helm chart
d7151c0 is described below
commit d7151c0d5965f7102b153064b72b73c6e12b4fb2
Author: Dongjoon Hyun <[email protected]>
AuthorDate: Sun Jul 5 17:55:11 2026 -0700
[SPARK-57940] Enable `readOnlyRootFilesystem` for operator container in
Helm chart
### What changes were proposed in this pull request?
This PR aims to enable `readOnlyRootFilesystem` for the operator container
in the Helm chart.
Since the operator writes temporary files under `java.io.tmpdir`
(SPARK-57918), an `emptyDir`
volume is mounted at `/tmp`, following the existing `logs-volume` pattern.
### Why are the changes needed?
A read-only root filesystem prevents tampering with the container image at
runtime and
completes the CIS Benchmark hardening on top of the existing restricted Pod
Security
Standard compliance.
### Does this PR introduce _any_ user-facing change?
Yes. The operator container root filesystem becomes read-only by default;
writable paths are
provided via `emptyDir` volumes (`/tmp`, `/opt/spark-operator/logs`). Users
can override
`operatorDeployment.operatorPod.operatorContainer.securityContext` if
needed.
### How was this patch tested?
Pass the CIs. Also manually verified with `helm lint --strict` and `helm
template`.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Fable 5
Closes #743 from dongjoon-hyun/SPARK-57940.
Authored-by: Dongjoon Hyun <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
---
.../helm/spark-kubernetes-operator/templates/spark-operator.yaml | 4 ++++
build-tools/helm/spark-kubernetes-operator/values.yaml | 1 +
2 files changed, 5 insertions(+)
diff --git
a/build-tools/helm/spark-kubernetes-operator/templates/spark-operator.yaml
b/build-tools/helm/spark-kubernetes-operator/templates/spark-operator.yaml
index 1cf189d..8016275 100644
--- a/build-tools/helm/spark-kubernetes-operator/templates/spark-operator.yaml
+++ b/build-tools/helm/spark-kubernetes-operator/templates/spark-operator.yaml
@@ -148,6 +148,8 @@ spec:
mountPath: /opt/spark-operator/conf
- name: logs-volume
mountPath: /opt/spark-operator/logs
+ - name: tmp-volume
+ mountPath: /tmp
{{- if and .Values.operatorConfiguration.dynamicConfig.enable (eq
.Values.operatorConfiguration.dynamicConfig.source "file") }}
- name: spark-operator-dynamic-config-volume
mountPath: /opt/spark-operator/dynamic-conf
@@ -175,6 +177,8 @@ spec:
name: spark-kubernetes-operator-configuration
- name: logs-volume
emptyDir: { }
+ - name: tmp-volume
+ emptyDir: { }
{{- if and .Values.operatorConfiguration.dynamicConfig.enable (eq
.Values.operatorConfiguration.dynamicConfig.source "file") }}
- name: spark-operator-dynamic-config-volume
configMap:
diff --git a/build-tools/helm/spark-kubernetes-operator/values.yaml
b/build-tools/helm/spark-kubernetes-operator/values.yaml
index 1fb1442..20d35a5 100644
--- a/build-tools/helm/spark-kubernetes-operator/values.yaml
+++ b/build-tools/helm/spark-kubernetes-operator/values.yaml
@@ -78,6 +78,7 @@ operatorDeployment:
capabilities:
drop:
- ALL
+ readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 185
seccompProfile:
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
