helm: Improve support for readOnlyRootFilesystem in with emptyDr on /tmp by YotamKorah · Pull Request #5079 · kubernetes-sigs/headlamp

YotamKorah · 2026-04-07T13:20:07Z

Summary

This PR fixes #4830 by dynamically mounting an emptyDir volume under /tmp if either securityContext.readOnlyRootFilesystem or podSecurityContext.readOnlyRootFilesystem are true

Related Issue

Fixes #4830

Changes

Added a new Helm template helper, headlamp.readOnlyRootFilesystem, to check if readOnlyRootFilesystem is enabled in either securityContext or podSecurityContext values.
Updated the deployment template to conditionally add a tmp volume and mount at /tmp when a read-only root filesystem is enabled, ensuring the application has a writable temporary directory.

Steps to Test

Deploy the chart with either securityContext.readOnlyRootFilesystem or podSecurityContext.readOnlyRootFilesystem set to true
verify headlamp start properly.

Notes

I opened this PR because this is the solution I think is the best however I did ask for comments in this slack message so I am waiting to hear opinions before marking this PR for review.

k8s-ci-robot · 2026-04-07T13:20:15Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: YotamKorah
Once this PR has been reviewed and has the lgtm label, please assign ashu8912 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

illume · 2026-04-08T10:43:56Z

Thanks for this.

Would you mind adjusting the the commit messages to follow our git commit guidelines?
(See git log for examples)

Format: <area>: <description of changes>
Examples:
- frontend: HomeButton: Fix so it navigates to home
- backend: config: Add enable-dynamic-clusters flag
Guidelines:
- Use atomic commits - keep each commit focused on a single change
- Keep commit titles under 72 characters (soft requirement)
- Commit messages should explain the intention and why something is done
- Commit titles should be meaningful and describe what the commit does
- Use git rebase to squash and order commits for easy review
- Do not write "Fixes #NN" issue number in the commit message

Copilot

Pull request overview

Improves the Helm chart’s ability to run Headlamp with a read-only root filesystem by conditionally adding writable emptyDir mounts (notably for /tmp) when readOnlyRootFilesystem is enabled.

Changes:

Added a Helm helper (headlamp.readOnlyRootFilesystem) to detect whether read-only root filesystem is enabled via values.
Updated the Deployment template to conditionally add /tmp volume mounts and corresponding emptyDir volumes (including for the plugins-manager sidecar).
Updated Helm chart expected test output for the security-context scenario.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
charts/headlamp/templates/_helpers.tpl	Introduces helper to detect `readOnlyRootFilesystem` enablement.
charts/headlamp/templates/deployment.yaml	Conditionally adds `/tmp` mounts/volumes when read-only root is enabled.
charts/headlamp/tests/expected_templates/security-context.yaml	Updates expected rendered manifests to include the new volumes/mounts.

Comments suppressed due to low confidence (1)

charts/headlamp/templates/deployment.yaml:352

With readOnlyRootFilesystem enabled, this change only mounts an emptyDir at /tmp. The chart still passes -plugins-dir={{ .Values.config.pluginsDir }} (default /headlamp/plugins), but that path is only mounted when pluginsManager.enabled is true. For the default case (pluginsManager disabled), Headlamp will likely still try to create/use the plugins dir on a read-only root filesystem and fail. Consider also mounting a writable volume at .Values.config.pluginsDir when readOnlyRootFilesystem is enabled.

          {{- if or .Values.pluginsManager.enabled .Values.volumeMounts (eq (include "headlamp.readOnlyRootFilesystem" .) "true") }}
          volumeMounts:
            {{- if .Values.pluginsManager.enabled }}
            - name: plugins-dir
              mountPath: {{ .Values.config.pluginsDir }}

illume · 2026-04-08T10:45:45Z

For anyone else wondering what is emptyDir?
https://kubernetes.io/docs/concepts/storage/volumes/#emptydir

linux-foundation-easycla · 2026-04-08T11:49:40Z

The committers listed above are authorized under a signed CLA.

✅ login: YotamKorah / name: Yotam Korah (2e56e75, 87fd6fa, c3ed1ae, f29ea28)

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

…/tmp Adds a writable /tmp emptyDir volume mount to containers configured with readOnlyRootFilesystem: true. The plugin manager inherits the main container's securityContext when its own is not set, so the detection logic mirrors the template's fallback behavior. Signed-off-by: Yotam Korah <git@korah.biz>

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Extract collision-detection logic into a headlamp.tmpVolumeContext helper that checks for an existing /tmp volumeMount or same-named volume before auto-adding the emptyDir. deployment.yaml calls the helper once per container and uses the returned addMount/addVolume booleans throughout, eliminating the scattered per-variable checks. Adds a test case covering readOnlyRootFilesystem: true with a user-supplied /tmp mount to ensure no duplicate entries are rendered. Signed-off-by: Yotam Korah <git@korah.biz>

Extract collision detection into a headlamp.tmpVolumeContext helper that returns addMount/addVolume independently: - addMount is suppressed when the user already has a /tmp volumeMount - addVolume is suppressed when the user already has a /tmp mount (avoids orphaned volumes) or a volume with the same name (allows users to bring their own headlamp-tmp with custom emptyDir settings such as sizeLimit) deployment.yaml calls the helper once per container and uses the returned booleans throughout, replacing scattered per-variable checks. Adds two test cases: - readonly-root-filesystem-custom-tmp: user provides their own /tmp volumeMount — chart skips both auto mount and auto volume - readonly-root-filesystem-custom-tmp-volume: user provides headlamp-tmp with sizeLimit — chart adds the /tmp mount but skips creating the volume Signed-off-by: Yotam Korah <git@korah.biz>

…ith readOnlyRootFilesystem Signed-off-by: Yotam Korah <git@korah.biz>

Copilot

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated no new comments.

YotamKorah · 2026-04-09T14:42:35Z

Finally!
I did not think this PR would grow this large wow!
Copilot really tried to kill it lol.

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 7, 2026

k8s-ci-robot requested review from sniok and vyncent-t April 7, 2026 13:20

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 7, 2026

YotamKorah marked this pull request as ready for review April 8, 2026 09:55

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 8, 2026

k8s-ci-robot requested a review from illume April 8, 2026 09:55

illume requested a review from Copilot April 8, 2026 10:41

Copilot started reviewing on behalf of illume April 8, 2026 10:41 View session

illume added security charts labels Apr 8, 2026

Copilot AI reviewed Apr 8, 2026

View reviewed changes

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 8, 2026

YotamKorah marked this pull request as draft April 8, 2026 11:53

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 8, 2026

YotamKorah force-pushed the fix/ro-filesystem-tmp branch 2 times, most recently from 9d6fc0b to 1c01212 Compare April 8, 2026 12:03

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Apr 8, 2026

YotamKorah marked this pull request as ready for review April 8, 2026 12:08

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 8, 2026

YotamKorah requested a review from Copilot April 8, 2026 12:09

Copilot started reviewing on behalf of YotamKorah April 8, 2026 12:09 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Comment thread charts/headlamp/templates/_helpers.tpl Outdated

Comment thread charts/headlamp/templates/deployment.yaml Outdated

Comment thread charts/headlamp/templates/deployment.yaml Outdated

YotamKorah marked this pull request as draft April 8, 2026 12:18

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 8, 2026

YotamKorah requested a review from Copilot April 8, 2026 14:08

Copilot started reviewing on behalf of YotamKorah April 8, 2026 14:08 View session

YotamKorah force-pushed the fix/ro-filesystem-tmp branch from 18203af to 279d5aa Compare April 8, 2026 14:14

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Comment thread charts/headlamp/templates/deployment.yaml Outdated

Comment thread charts/headlamp/templates/deployment.yaml Outdated

YotamKorah requested a review from Copilot April 8, 2026 14:32

Copilot started reviewing on behalf of YotamKorah April 8, 2026 14:33 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Comment thread charts/headlamp/templates/deployment.yaml Outdated

Comment thread charts/headlamp/templates/deployment.yaml Outdated

YotamKorah force-pushed the fix/ro-filesystem-tmp branch from 38a6ff4 to 87fd6fa Compare April 8, 2026 15:09

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 8, 2026

YotamKorah requested a review from Copilot April 8, 2026 15:09

Copilot started reviewing on behalf of YotamKorah April 8, 2026 15:10 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Comment thread charts/headlamp/templates/deployment.yaml Outdated

Comment thread charts/headlamp/templates/deployment.yaml

YotamKorah added 3 commits April 9, 2026 17:03

docs: update README and values.yaml to clarify /tmp volume handling w…

2e56e75

…ith readOnlyRootFilesystem Signed-off-by: Yotam Korah <git@korah.biz>

YotamKorah requested a review from Copilot April 9, 2026 14:33

Copilot started reviewing on behalf of YotamKorah April 9, 2026 14:33 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

YotamKorah marked this pull request as ready for review April 9, 2026 14:42

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 9, 2026

k8s-ci-robot requested a review from ashu8912 April 9, 2026 14:42

YotamKorah changed the title ~~fix: helm: Improve support for readOnlyRootFilesystem in with emptyDr on /tmp~~ helm: Improve support for readOnlyRootFilesystem in with emptyDr on /tmp Apr 17, 2026

Conversation

YotamKorah commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Steps to Test

Notes

Uh oh!

k8s-ci-robot commented Apr 7, 2026

Uh oh!

illume commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

illume commented Apr 8, 2026

Uh oh!

linux-foundation-easycla bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

YotamKorah commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

YotamKorah commented Apr 7, 2026 •

edited

Loading

linux-foundation-easycla bot commented Apr 8, 2026 •

edited

Loading