chore(deployment): enable readOnlyRootFilesystem

This resolves KSV014 from trivy. Is also required by guideline: https://eclipse-tractusx.github.io/docs/release/trg-4/trg-4-07/#why Refs: eclipse-tractusx#189
Cofinity-X · Jul 9, 2024 · 9155fdb · 9155fdb
1 parent a5f77cb
commit 9155fdb
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/charts/sdfactory/templates/deployment.yaml b/charts/sdfactory/templates/deployment.yaml
@@ -107,3 +107,9 @@ spec:
 
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp
+      volumes:
+      - emptyDir: {}
+        name: tmp
diff --git a/charts/sdfactory/values.yaml b/charts/sdfactory/values.yaml
@@ -56,7 +56,7 @@ securityContext:
     drop:
       - ALL
   allowPrivilegeEscalation: false
-  # readOnlyRootFilesystem: true
+  readOnlyRootFilesystem: true
   runAsNonRoot: true
   runAsUser: 1000
   runAsGroup: 1000