Loading...

XML

Word

Printable

Type: Bug
Resolution: Unresolved
Priority: Major
Fix Version/s: None
Affects Version/s: 4.21
Component/s: Bare Metal Hardware Provisioning / cluster-baremetal-operator
Labels:
- triaged

Activity Type:
None
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Story Points:
2
Severity:
None
Regression:
None
Epic Link:
METAL-1350

Target Backport Versions:
None
Target Version:

4.21.0
Release Blocker:
Rejected
Sprint:
Metal Platform 280
sprint_count:
1

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

PX Impact Score:

Release Note Status:
None
Release Note Type:
None
Release Note Text:
None

Escape Reason:
None
Escape Impact:
None
Corrective Measures:
None
SDLC stage when should've been found:
None

Description of problem:

Currently, we don't have the readOnlyRootFilesystem flag enabled for machine-os-images container due to the issue being fixed in this pr - https://github.com/openshift/machine-os-images/pull/72.
Additionally, we want to remove the "/certs/ca/ironic" writable mount and reduce the exposed surface from a security standpoint. This depends on the the fix from this pr - https://github.com/openshift/ironic-image/pull/728.

is blocked by

OCPBUGS-65969 Set the tls cacert path to writable mount when the IRONIC_CACERT_FILE is unset

POST

OCPBUGS-65971 The machine-os-images container writes to /coreos during runtime which will fail for readOnlyRootFS

MODIFIED

links to

openshift/cluster-baremetal-operator#533: OCPBUGS-66144: Enable readOnlyRootFS flag for machine-os-images container

Assignee:: Himanshu Roy

Reporter:: Himanshu Roy

Need Info From:: None

Contributors:: None

QA Contact:: Jad Haj Yahya

Doc Contact:: None

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 2025/11/28 9:30 AM

Updated:: 2025/11/28 5:17 PM

Details

Description

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates