janhoy opened a new pull request, #885: URL: https://github.com/apache/solr-operator/pull/885
🤖 AI Assisted 🤖 Fixes #884, fixes #801 Stacked on #875, only the last commit belongs to this PR. - Every init container the operator generates now runs with `readOnlyRootFilesystem: true`. They only write to mounted volumes, and `openssl` in the Solr image was verified to export a keystore on a read-only root. - New `podOptions.readOnlyRootFilesystem` for `SolrCloud` and `SolrPrometheusExporter` sets it on the main container and mounts `emptyDir` volumes at `/tmp` and, for Solr, `/var/solr/logs`. A user volume at one of those paths is used instead, and an explicit `containerSecurityContext.readOnlyRootFilesystem` wins. ### Testing Unit tests cover both parts, and the generated pods still pass the "restricted" profile check. Verified in Docker that Solr 9.11 refuses to start when `/var/solr/logs` is read-only, and serves with `emptyDir` volumes at both paths. Not yet run in a Kubernetes cluster. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
