apache / apache/solr-operator

cp-solr-xml Init Container Does Not Set readOnlyRootFilesystem: true

Open
#801 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
283
Forks
148
PR merge metrics
No merged PRs in 30d

Description

The **cp-solr-xml** init container currently does not configure `readOnlyRootFilesystem: true`. However, this container does not appear to require a writable root filesystem for its functionality.

As a result, the container is not adhering to **Kubernetes** security best practices, which recommend setting `readOnlyRootFilesystem: true` for containers that do not need write access to their root filesystem. This helps to reduce the attack surface and improve overall security by preventing potential unauthorized write operations.

Contributor guide

No contributing guide indexed for this repository

Research direction

No file or test is named; search the operator's manifests or templates for the cp-solr-xml init container and inspect how its configuration is rendered. Update the container configuration so readOnlyRootFilesystem is true, then run the relevant Kubernetes rendering or integration tests. Done means the generated configuration includes the setting and existing tests pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
infrastructure, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.