• Type: Story
• Resolution: Done
• Priority: Normal
• Fix Version/s: None
• Affects Version/s: None
• Labels:

  None

[CCO-647] Enable readOnlyRootFilesystem on all pods

Collapse comment: Jeremiah Stuever added a comment - 2025/03/27 7:10 PM

Jeremiah Stuever added a comment - 2025/03/27 7:10 PM

mihuang@redhat.com  OCP-80542 lgtm

Expand comment: Jeremiah Stuever added a comment - 2025/03/27 7:10 PM

Jeremiah Stuever added a comment - 2025/03/27 7:10 PM mihuang@redhat.com  OCP-80542 lgtm

Collapse comment: Jeremiah Stuever added a comment - 2025/03/24 5:24 PM

Jeremiah Stuever added a comment - 2025/03/24 5:24 PM

mihuang@redhat.com  OCP-80542 mostly looks good, with exception of the step(s) to ensure the CA certificates are correctly mounted. As it is currently written, it only checks that the file exists. Because this file exists in the images themselves, it always exists. In order to accomplish this task, you would need to somehow show that the contents of the file match the contents of the file that was mounted.

Expand comment: Jeremiah Stuever added a comment - 2025/03/24 5:24 PM

Jeremiah Stuever added a comment - 2025/03/24 5:24 PM mihuang@redhat.com  OCP-80542 mostly looks good, with exception of the step(s) to ensure the CA certificates are correctly mounted. As it is currently written, it only checks that the file exists. Because this file exists in the images themselves, it always exists. In order to accomplish this task, you would need to somehow show that the contents of the file match the contents of the file that was mounted.

Collapse comment: Jeremiah Stuever added a comment - 2025/03/07 5:06 PM

Jeremiah Stuever added a comment - 2025/03/07 5:06 PM

My concerns about removing the CA bundle workaround have been resolved. In looking at the original bugs where it was introduced, it was said that the workaround could only be tested in a 4.1 to 4.2 upgrade (as opposed to a 4.2 to 4.3 upgrade). This indicates the workaround was specifically to resolve an issue with that particular upgrade.

Expand comment: Jeremiah Stuever added a comment - 2025/03/07 5:06 PM

Jeremiah Stuever added a comment - 2025/03/07 5:06 PM My concerns about removing the CA bundle workaround have been resolved. In looking at the original bugs where it was introduced, it was said that the workaround could only be tested in a 4.1 to 4.2 upgrade (as opposed to a 4.2 to 4.3 upgrade). This indicates the workaround was specifically to resolve an issue with that particular upgrade.