From b5c8ee2ab93b9f8d010e9200b871a1c771997a81 Mon Sep 17 00:00:00 2001
From: Christian Ihle <christian.ihle@drift.oslo.kommune.no>
Date: Thu, 6 Jun 2019 11:59:42 +0200
Subject: [PATCH] Add optional support for readOnlyRootFilesystem

---
 .../chart/reloader/templates/deployment.yaml           | 10 ++++++++++
 deployments/kubernetes/chart/reloader/values.yaml      |  4 +++-
 .../kubernetes/templates/chart/values.yaml.tmpl        |  4 +++-
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
index fb40b3f0..58dd17d9 100644
--- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml
+++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml
@@ -70,6 +70,11 @@ spec:
         image: "{{ .Values.reloader.deployment.image.name }}:{{ .Values.reloader.deployment.image.tag }}"
         imagePullPolicy: {{ .Values.reloader.deployment.image.pullPolicy }}
         name: {{ template "reloader-name" . }}
+      {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
+        volumeMounts:
+          - mountPath: /tmp/
+            name: tmp-volume
+      {{- end }}
       {{- if .Values.reloader.custom_annotations }}
         args:
           {{- if .Values.reloader.custom_annotations.configmap }}
@@ -86,3 +91,8 @@ spec:
           {{- end }}
       {{- end }}
       serviceAccountName: {{ template "reloader-serviceAccountName" . }}
+    {{- if eq .Values.reloader.readOnlyRootFileSystem true }}
+      volumes:
+        - emptyDir: {}
+          name: tmp-volume
+    {{- end }}
diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml
index 4ff2d1d2..8550f9c6 100644
--- a/deployments/kubernetes/chart/reloader/values.yaml
+++ b/deployments/kubernetes/chart/reloader/values.yaml
@@ -5,6 +5,8 @@ kubernetes:
 
 reloader:
   watchGlobally: true
+  # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
+  readOnlyRootFileSystem: false
   matchLabels: {}
   deployment:
     annotations: {}
@@ -40,4 +42,4 @@ reloader:
   #   custom_annotations:
   #     configmap: "my.company.com/configmap"
   #     secret: "my.company.com/secret"
-  custom_annotations: {} 
\ No newline at end of file
+  custom_annotations: {}
diff --git a/deployments/kubernetes/templates/chart/values.yaml.tmpl b/deployments/kubernetes/templates/chart/values.yaml.tmpl
index 0ebcdd33..ce51889a 100644
--- a/deployments/kubernetes/templates/chart/values.yaml.tmpl
+++ b/deployments/kubernetes/templates/chart/values.yaml.tmpl
@@ -5,6 +5,8 @@ kubernetes:
 
 reloader:
   watchGlobally: true
+  # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
+  readOnlyRootFileSystem: false
   matchLabels: {}
   deployment:
     annotations: {}
@@ -40,4 +42,4 @@ reloader:
   #   custom_annotations:
   #     configmap: "my.company.com/configmap"
   #     secret: "my.company.com/secret"
-  custom_annotations: {} 
\ No newline at end of file
+  custom_annotations: {}