Merge pull request #1208 from dusk125/rofs

OTA-1480: Add readonlyRootFilesystem

Author: openshift-merge-bot[bot]

bootstrap/bootstrap-pod.yaml

@@ -19,6 +19,7 @@ spec:
     - "--kubeconfig=/etc/kubernetes/kubeconfig"
     securityContext:
       privileged: true
+      readOnlyRootFilesystem: true
     terminationMessagePolicy: FallbackToLogsOnError
     volumeMounts:
     - mountPath: /etc/ssl/certs

install/0000_00_cluster-version-operator_03_deployment.yaml

@@ -44,6 +44,8 @@ spec:
             cpu: 20m
             memory: 50Mi
         terminationMessagePolicy: FallbackToLogsOnError
+        securityContext:
+          readOnlyRootFilesystem: true
         volumeMounts:
         - mountPath: /etc/ssl/certs
           name: etc-ssl-certs

pkg/cvo/updatepayload.go

@@ -208,7 +208,7 @@ func (r *payloadRetriever) fetchUpdatePayloadToDir(ctx context.Context, dir stri
 		}}
 		container.SecurityContext = &corev1.SecurityContext{
 			Privileged:             ptr.To(true),
-			ReadOnlyRootFilesystem: ptr.To(false),
+			ReadOnlyRootFilesystem: ptr.To(true),
 		}
 		container.Resources = corev1.ResourceRequirements{
 			Requests: corev1.ResourceList{
@@ -244,17 +244,19 @@ func (r *payloadRetriever) fetchUpdatePayloadToDir(ctx context.Context, dir stri
 					Command: []string{"mkdir", tmpDir},
 				}),
 				setContainerDefaults(corev1.Container{
-					Name: "move-operator-manifests-to-temporary-directory",
+					Name: "copy-operator-manifests-to-temporary-directory",
 					Command: []string{
-						"mv",
+						"cp",
+						"-r",
 						filepath.Join(payload.DefaultPayloadDir, payload.CVOManifestDir),
 						filepath.Join(tmpDir, payload.CVOManifestDir),
 					},
 				}),
 				setContainerDefaults(corev1.Container{
-					Name: "move-release-manifests-to-temporary-directory",
+					Name: "copy-release-manifests-to-temporary-directory",
 					Command: []string{
-						"mv",
+						"cp",
+						"-r",
 						filepath.Join(payload.DefaultPayloadDir, payload.ReleaseManifestDir),
 						filepath.Join(tmpDir, payload.ReleaseManifestDir),
 					},

pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml

@@ -44,6 +44,8 @@ spec:
             cpu: 20m
             memory: 50Mi
         terminationMessagePolicy: FallbackToLogsOnError
+        securityContext:
+          readOnlyRootFilesystem: true
         volumeMounts:
         - mountPath: /etc/ssl/certs
           name: etc-ssl-certs