janhoy opened a new issue, #884: URL: https://github.com/apache/solr-operator/issues/884
#875 makes the generated pods satisfy the Pod Security Standards "restricted" profile by default. `readOnlyRootFilesystem` is outside that profile, so the PR leaves it as it was: only the `setup-zk` init container has it, with an emptyDir at `/tmp` so the Solr CLI has somewhere to write. #801 asks for it on the `cp-solr-xml` init container, which #874 renamed to `volume-prep`. This issue covers both the init containers and the Solr pods themselves. ### Always set it on the busybox init containers `volume-prep`, `initdb` and `create-tls-wrapper-script` are busybox `sh -c` one-liners whose only writes go to mounted volumes, so `readOnlyRootFilesystem: true` is free for them. The `operatorContainers` map in `controllers/util/security_context_util.go` already has a per-container `readOnlyRootFilesystem` flag, so this is a one-line change per container, and the existing unit tests guard it. `gen-pkcs12-keystore` runs `openssl` in the Solr image and writes to a mounted emptyDir; it probably qualifies too, but should be verified against the Solr image's OpenSSL version before it is turned on. This part closes #801. ### Opt-in for the Solr pods The Solr container cannot be made read-only without preparation: only `/var/solr/data` is a volume, so Solr writes its logs to `/var/solr/logs` on the root filesystem, and the JVM and Jetty need a temp directory. Custom images and init scripts may write elsewhere under `/opt/solr` or `/var/solr`, so this has to be an opt-in rather than a default. Proposed: a new option in the SolrCloud CRD, e.g. `podOptions.readOnlyRootFilesystem: true`, exposed as a value in the `solr` Helm chart. When set, the operator - sets `readOnlyRootFilesystem: true` on the Solr container, and - adds emptyDir volumes for the directories Solr writes to outside the data volume, at least `/var/solr/logs`, `/tmp` and whatever Jetty uses for its temp directory, to be determined by running Solr with a read-only root and watching what fails. The same option should cover the `SolrPrometheusExporter`, whose container is a JVM with the same `/tmp` need. Setting `containerSecurityContext.readOnlyRootFilesystem: true` by hand already works today for users who mount those directories themselves; the option exists so the operator does that for them, and so the combination is tested. Related: #801, #873, #875. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
