Add optional support for readOnlyRootFilesystem

deployments/kubernetes/chart/reloader/templates/deployment.yaml

@@ -70,6 +70,11 @@ spec:
         image: "{{ .Values.reloader.deployment.image.name }}:{{ .Values.reloader.deployment.image.tag }}"
         imagePullPolicy: {{ .Values.reloader.deployment.image.pullPolicy }}
         name: {{ template "reloader-name" . }}
+      {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
+        volumeMounts:
+          - mountPath: /tmp/
+            name: tmp-volume
+      {{- end }}
       {{- if .Values.reloader.custom_annotations }}
         args:
           {{- if .Values.reloader.custom_annotations.configmap }}
@@ -86,3 +91,8 @@ spec:
           {{- end }}
       {{- end }}
       serviceAccountName: {{ template "reloader-serviceAccountName" . }}
+    {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
+      volumes:
+        - emptyDir: {}
+          name: tmp-volume
+    {{- end }}

deployments/kubernetes/chart/reloader/values.yaml

@@ -5,6 +5,8 @@ kubernetes:
 
 reloader:
   watchGlobally: true
+  # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
+  readOnlyRootFileSystem: false
   matchLabels: {}
   deployment:
     annotations: {}
@@ -40,4 +42,4 @@ reloader:
   #   custom_annotations:
   #     configmap: "my.company.com/configmap"
   #     secret: "my.company.com/secret"
-  custom_annotations: {} 
+  custom_annotations: {}

deployments/kubernetes/templates/chart/values.yaml.tmpl

@@ -5,6 +5,8 @@ kubernetes:
 
 reloader:
   watchGlobally: true
+  # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
+  readOnlyRootFileSystem: false
   matchLabels: {}
   deployment:
     annotations: {}
@@ -40,4 +42,4 @@ reloader:
   #   custom_annotations:
   #     configmap: "my.company.com/configmap"
   #     secret: "my.company.com/secret"
-  custom_annotations: {} 
+  custom_annotations: {}