From b6dd136af209c599ecfb902840181d7a3a89bdd6 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 8 Mar 2023 14:21:45 -0800 Subject: [PATCH] Add tmp mount so that server can run locked down (#105) This pr adds a tmp mount to the spire server pod so that it can run with read only root. Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/templates/statefulset.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index bf20868..38215b8 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -132,6 +132,9 @@ spec: mountPath: /controller-manager-config.yaml subPath: controller-manager-config.yaml readOnly: true + - name: spire-controller-manager-tmp + mountPath: /tmp + readOnly: false {{- end }} {{- if gt (len .Values.extraContainers) 0 }} {{- toYaml .Values.extraContainers | nindent 8 }} @@ -158,6 +161,8 @@ spec: name: {{ include "spire-server.fullname" . }} - name: spire-server-socket emptyDir: {} + - name: spire-controller-manager-tmp + emptyDir: {} {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} - name: upstream-ca secret: