Set readOnlyRootFilesystem to true

[razo7]

An immutable root file system prevents applications from writing to their local disk

Why we need this PR

Limit access to the pod's root file system. An immutable root file system prevents applications from writing to their local disk

Changes made

• Set readOnlyRootFilesystem to true in the manager config of nhc pod
• Set readOnlyRootFilesystem to true in the node-remediation-console-plugin config of nhc pod

Which issue(s) this PR fixes

Test plan

Similar fix to https://github.com/medik8s/node-maintenance-operator/pull/136

[openshift-ci[bot]]

Skipping CI for Draft Pull Request. If you want CI signal for your change, please convert it to an actual PR. You can still manually trigger a test run with /test all

[openshift-ci[bot]]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: razo7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• ~~OWNERS~~ [razo7]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai[bot]]

[!IMPORTANT]

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing Touches

🧪 Generate unit tests

• [ ] Create PR with unit tests
• [ ] Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[razo7]

/test 4.20-openshift-e2e

[razo7]

/test 4.20-openshift-e2e

[razo7]

/test 4.20-openshift-e2e

[razo7]

nhc installation was pending. /retest

[razo7]

say /retest to rerun all failed tests

I thought only 4.20 would be triggered, but it triggered all the jobs... 🤷🏻

[openshift-ci[bot]]

@razo7: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.18-openshift-e2e	79c3a253e5e6844e8acbaf34531c4163f1bee56f	link	true	/test 4.18-openshift-e2e
ci/prow/4.20-openshift-e2e	79c3a253e5e6844e8acbaf34531c4163f1bee56f	link	true	/test 4.20-openshift-e2e
ci/prow/4.19-openshift-e2e	79c3a253e5e6844e8acbaf34531c4163f1bee56f	link	true	/test 4.19-openshift-e2e
ci/prow/4.16-openshift-e2e	79c3a253e5e6844e8acbaf34531c4163f1bee56f	link	true	/test 4.16-openshift-e2e
ci/prow/4.17-openshift-e2e	79c3a253e5e6844e8acbaf34531c4163f1bee56f	link	true	/test 4.17-openshift-e2e

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.