Enable read-only root filesystem. (#830)

* Enable read-only root filesystem. * Fix linting --------- Co-authored-by: Jacob Tomlinson <jtomlinson@nvidia.com>
dask · Oct 13, 2023 · fa7255b · fa7255b
1 parent cb209c9
commit fa7255b
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/README.md b/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/README.md
@@ -28,6 +28,7 @@ The following table lists the configurable parameters of the Dask-kubernetes-ope
 | `securityContext.runAsNonRoot` |  | `true` |
 | `securityContext.runAsUser` |  | `1000` |
 | `securityContext.allowPrivilegeEscalation` |  | `false` |
+| `securityContext.readOnlyRootFilesystem` |  | `true` |
 | `resources` | Resources for the operator pod | `{}` |
 | `volumes` | Volumes for the operator pod | `[]` |
 | `volumeMounts` | Volume mounts for the operator container | `[]` |

diff --git a/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/values.yaml b/dask_kubernetes/operator/deployment/helm/dask-kubernetes-operator/values.yaml
@@ -28,7 +28,7 @@ securityContext:  # Security context for the operator container
   runAsNonRoot: true
   runAsUser: 1000
   allowPrivilegeEscalation: false
-  # readOnlyRootFilesystem: true
+  readOnlyRootFilesystem: true
 
 resources: {}  # Resources for the operator pod
   # We usually recommend not to specify default resources and to leave this as a conscious