OTA-2111: set readOnlyRootFilesystem on console plugin container

[jrangelramos]

Summary

• Adds readOnlyRootFilesystem: true to the console plugin container's securityContext
• Mounts emptyDir volumes for /tmp, /var/cache/nginx, and /run — the paths nginx needs at runtime
• Aligns with existing hardening in the CVO deployment and bootstrap pod, which already set this field

References

• Jira: https://redhat.atlassian.net/browse/OTA-2111

Test plan

• YAML validates without errors
• Volume names match between volumeMounts and volumes
• All 1114 unit tests pass (make test)
• Deploy to a test cluster and verify the console plugin pod starts and serves correctly

🤖 Generated with Claude Code

Summary by CodeRabbit

• Security & Reliability
  • Enhanced plugin container security by using a read-only root filesystem.
  • Added required temporary writable storage for reliable nginx operation.

[openshift-ci-robot]

@jrangelramos: This pull request references OTA-2111 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the weakness to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds readOnlyRootFilesystem: true to the console plugin container's securityContext
• Mounts emptyDir volumes for /tmp, /var/cache/nginx, and /run — the paths nginx needs at runtime
• Aligns with existing hardening in the CVO deployment and bootstrap pod, which already set this field

References

• Jira: https://redhat.atlassian.net/browse/OTA-2111

Test plan

• YAML validates without errors
• Volume names match between volumeMounts and volumes
• All 1114 unit tests pass (make test)
• Deploy to a test cluster and verify the console plugin pod starts and serves correctly

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: f1395ff1-b3f3-4c6c-bc85-d3aacc2fc366

📥 Commits

Reviewing files that changed from the base of the PR and between 97473b9 and b1f0d67.

📒 Files selected for processing (1)

• pkg/agenticrun/bindata/assets/deployment.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The plugin deployment now uses a read-only root filesystem. Four emptyDir volumes provide writable storage for temporary and nginx runtime paths.

Changes

Plugin filesystem hardening

Layer / File(s)	Summary
Read-only filesystem and writable mounts pkg/agenticrun/bindata/assets/deployment.yaml	The plugin container enables readOnlyRootFilesystem. The deployment mounts emptyDir volumes at /tmp, /var/cache/nginx, /var/lib/nginx/tmp, and /run.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to b1f0d

The change enables a read-only root filesystem while providing the writable runtime paths nginx needs; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling read-only root filesystem protection for the console plugin container.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The added lines configure readOnlyRootFilesystem and four emptyDir volume mounts. The diff adds no Ginkgo test declar…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml; it adds a container security setting and four emptyDir mounts. The diff contains no Ginkgo test code, It blocks…
Microshift Test Compatibility	✅ Passed	PASS — The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml (+17 lines). The diff adds container security and emptyDir volume configuration. It adds no Ginkgo e2e tests or t…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The diff adds a container security setting and emptyDir volume mounts; it adds no Ginkgo e2e tests or other test code. …
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The only pull-request changes add readOnlyRootFilesystem: true and four emptyDir volume mounts. They do not add or modify replicas, anti-affinity, topology spread constraints, node selector…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The 17 added lines set readOnlyRootFilesystem and add emptyDir volume mounts. No main(), init(), suite setu…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The diff adds a read-only root filesystem and emptyDir mounts; it adds no Ginkgo e2e tests, IPv4 assumptions, or extern…
No-Weak-Crypto	✅ Passed	PASS — The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The added lines set readOnlyRootFilesystem and add four emptyDir mounts. No added or modified line introduces …
Container-Privileges	✅ Passed	PASS: The pull request adds readOnlyRootFilesystem: true and four emptyDir mounts. It does not add privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, `allowPrivilegeEscalation: …
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only deployment.yaml. Added lines set readOnlyRootFilesystem and add emptyDir mounts. They add no logging configuration or sensitive data. The existing nginx `acce…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The added lines configure readOnlyRootFilesystem and four emptyDir volume mounts. The diff adds no Ginkgo test declarations or test titles, so it introduces no unstable or overly specific test name.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml; it adds a container security setting and four emptyDir mounts. The diff contains no Ginkgo test code, It blocks, setup/cleanup, waits, or assertions to review. Therefore none of the stated test-quality failure conditions applies.

Full details: Microshift Test Compatibility

Explanation

PASS — The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml (+17 lines). The diff adds container security and emptyDir volume configuration. It adds no Ginkgo e2e tests or test constructs such as It(), Describe(), Context(), or When(). Therefore, the MicroShift test compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The diff adds a container security setting and emptyDir volume mounts; it adds no Ginkgo e2e tests or other test code. Therefore, the SNO multi-node test compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS — The only pull-request changes add readOnlyRootFilesystem: true and four emptyDir volume mounts. They do not add or modify replicas, anti-affinity, topology spread constraints, node selectors, node affinity, tolerations, or PDBs. The existing kubernetes.io/os: linux selector and infra toleration are unchanged, and the existing rolling update has maxUnavailable: 1. No topology-aware scheduling failure condition is introduced.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The 17 added lines set readOnlyRootFilesystem and add emptyDir volume mounts. No main(), init(), suite setup, logging, or stdout-writing code changes are present. The OTE Binary Stdout Contract is therefore not violated.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The diff adds a read-only root filesystem and emptyDir mounts; it adds no Ginkgo e2e tests, IPv4 assumptions, or external connectivity. The custom check is therefore not applicable.

Full details: No-Weak-Crypto

Explanation

PASS — The pull request changes only pkg/agenticrun/bindata/assets/deployment.yaml. The added lines set readOnlyRootFilesystem and add four emptyDir mounts. No added or modified line introduces MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom cryptography, or secret/token comparisons. The check's failure conditions are not present.

Full details: Container-Privileges

Explanation

PASS: The pull request adds readOnlyRootFilesystem: true and four emptyDir mounts. It does not add privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation: true, or root execution. The manifest retains allowPrivilegeEscalation: false, drops all capabilities, and sets pod-level runAsNonRoot: true.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS. The pull request changes only deployment.yaml. Added lines set readOnlyRootFilesystem and add emptyDir mounts. They add no logging configuration or sensitive data. The existing nginx access_log /dev/stdout and error_log /dev/stderr settings are unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[ankitathomas]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-agnostic-operator
/test e2e-agnostic-ovn
/test e2e-agnostic-ovn-techpreview-serial-1of3
/test e2e-agnostic-ovn-techpreview-serial-2of3
/test e2e-agnostic-ovn-techpreview-serial-3of3
/test e2e-agnostic-ovn-upgrade-into-change
/test e2e-agnostic-ovn-upgrade-out-of-change
/test e2e-aws-ovn-techpreview
/test e2e-hypershift
/test e2e-hypershift-conformance

[wking]

/lgtm
/retest-required

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ankitathomas, jrangelramos, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jrangelramos: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-agnostic-ovn-techpreview-serial-3of3	2a9c1f2	link	true	/test e2e-agnostic-ovn-techpreview-serial-3of3
ci/prow/e2e-hypershift-conformance	2a9c1f2	link	true	/test e2e-hypershift-conformance
ci/prow/e2e-agnostic-operator	2a9c1f2	link	true	/test e2e-agnostic-operator

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jrangelramos]

/hold

[openshift-ci]

New changes are detected. LGTM label has been removed.

[jrangelramos]

/verified by @jrangelramos

Verification: pod runs properly (no error), with mounted emptyDirs serving content.

$ oc get deployment -n openshift-cluster-update-console-plugin cluster-update-console-plugin -o jsonpath='{.spec.template.spec.volumes[?(@.emptyDir)].name}'
tmp cache-nginx lib-nginx-tmp run
$ oc get pod                                                                                              
NAME                                             READY   STATUS    RESTARTS      AGE
cluster-update-console-plugin-7c88cb8fdd-mfl42   1/1     Running   0             16h
$ oc logs -n openshift-cluster-update-console-plugin cluster-update-console-plugin-7c88cb8fdd-mfl42 | grep -iE 'emerg|alert|crit|error|warn|denied|readonly|read-only|permission|failed' | wc -l
0
$ oc logs -n openshift-cluster-update-console-plugin cluster-update-console-plugin-7c88cb8fdd-mfl42 | tail -5
10.130.0.114 - - [27/Aug/2026:11:19:55 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:19:59 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:19:59 +0000] "GET /plugin-entry.d64e136edd53ccdaeb2d.min.js HTTP/1.1" 200 17557 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:19:59 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:20:13 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"

[openshift-ci-robot]

@jrangelramos: This PR has been marked as verified by @jrangelramos.

Details

In response to this:

/verified by @jrangelramos

Verification: pod runs properly (no error), with mounted emptyDirs serving content.

$ oc get deployment -n openshift-cluster-update-console-plugin cluster-update-console-plugin -o jsonpath='{.spec.template.spec.volumes[?(@.emptyDir)].name}'
tmp cache-nginx lib-nginx-tmp run
$ oc get pod                                                                                              
NAME                                             READY   STATUS    RESTARTS      AGE
cluster-update-console-plugin-7c88cb8fdd-mfl42   1/1     Running   0             16h
$ oc logs -n openshift-cluster-update-console-plugin cluster-update-console-plugin-7c88cb8fdd-mfl42 | grep -iE 'emerg|alert|crit|error|warn|denied|readonly|read-only|permission|failed' | wc -l
0
$ oc logs -n openshift-cluster-update-console-plugin cluster-update-console-plugin-7c88cb8fdd-mfl42 | tail -5
10.130.0.114 - - [27/Aug/2026:11:19:55 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:19:59 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:19:59 +0000] "GET /plugin-entry.d64e136edd53ccdaeb2d.min.js HTTP/1.1" 200 17557 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:19:59 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"
10.130.0.114 - - [27/Aug/2026:11:20:13 +0000] "GET /plugin-manifest.json HTTP/1.1" 304 0 "https://console-openshift-console.apps.jeramos-1348.ci-psi.rhocf-dev.net/administration/cluster-update" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jrangelramos]

/unhold