chore(deployment): enable readOnlyRootFilesystem (#190)

* chore(deployment): enable readOnlyRootFilesystem This resolves KSV014 from trivy. Is also required by guideline: https://eclipse-tractusx.github.io/docs/release/trg-4/trg-4-07/#why Refs: #189
eclipse-tractusx · Jul 31, 2024 · d3c6e5f · d3c6e5f
1 parent 5cf8bf6
commit d3c6e5f
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/charts/sdfactory/templates/deployment.yaml b/charts/sdfactory/templates/deployment.yaml
@@ -107,3 +107,9 @@ spec:
 
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp
+      volumes:
+      - emptyDir: {}
+        name: tmp
diff --git a/charts/sdfactory/values.yaml b/charts/sdfactory/values.yaml
@@ -56,7 +56,7 @@ securityContext:
     drop:
       - ALL
   allowPrivilegeEscalation: false
-  # readOnlyRootFilesystem: true
+  readOnlyRootFilesystem: true
   runAsNonRoot: true
   runAsUser: 1000
   runAsGroup: 1000