feat: add readiness probe and read only root filesystem

[CarolinaRFerreira]

Summary by CodeRabbit

• Bug Fixes / Improvements
  • Hardened runtime security by enabling a read-only root filesystem and reducing privileges for the chart’s main containers.
  • Added a dedicated writable temporary directory (and an NGINX cache volume) to maintain expected runtime behavior.
  • Made health checks more flexible: liveness/readiness/startup probes are now conditionally rendered for both the NGINX/proxy and monitoring containers when enabled via chart settings.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 57e2343b-b841-4f61-9140-30dc92c89c36

📥 Commits

Reviewing files that changed from the base of the PR and between 139cd83 and a5e593a.

📒 Files selected for processing (3)

• charts/network-observer/templates/_deployment.yaml
• charts/network-observer/templates/deployment.yaml
• charts/network-observer/values.yaml

---

📝 Walkthrough

Walkthrough

Adds read-only filesystem settings, temporary emptyDir mounts for proxy containers, configurable health probes, and conditional probe rendering across the network-observer Helm chart.

Changes

Network-observer chart hardening and probes

Layer / File(s)	Summary
Security and probe values charts/network-observer/values.yaml	Enables read-only root filesystems for Prometheus, NGINX, OpenShift OAuth proxy, and pod security contexts, and defines container and controller probe settings.
Conditional container probe rendering charts/network-observer/templates/deployment.yaml, charts/network-observer/templates/_deployment.yaml	Conditionally renders configured liveness, readiness, and startup probes while omitting the values-only enabled field.
Proxy and cache temporary volumes charts/network-observer/templates/deployment.yaml, charts/network-observer/templates/_deployment.yaml	Adds proxy-tmp and nginx-cache emptyDir volumes and mounts /tmp for the NGINX and OpenShift OAuth proxy containers.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: added readiness probes and read-only root filesystem hardening.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

charts/network-observer/templates/_deployment.yaml (1)

25-26: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Consider bounding the proxy-tmp emptyDir size.

No sizeLimit is set, so this volume can grow unbounded and consume node ephemeral storage.

♻️ Proposed fix

 - name: proxy-tmp
-  emptyDir: {}
+  emptyDir:
+    sizeLimit: 64Mi

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 17615b9f-a6e7-4a6e-85fc-208b54bf44b4

📥 Commits

Reviewing files that changed from the base of the PR and between e0dd9ce and 430c60c.

📒 Files selected for processing (2)

• charts/network-observer/templates/_deployment.yaml
• charts/network-observer/values.yaml

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

charts/network-observer/templates/deployment.yaml (1)

50-50: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Trailing whitespace after the if tag.

Line 50 has trailing spaces after }}, inconsistent with the other conditional blocks in this file (e.g. Line 15's {{- if .Values.prometheus.persistence.enabled }} has no trailing whitespace). This introduces a stray whitespace-only line in rendered output and may trip YAML/lint checks.

Proposed fix

-          {{- if .Values.readinessProbe.enabled }}    
+          {{- if .Values.readinessProbe.enabled }}

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 34f4f26f-e3fa-4792-932c-4ba22e2e79de

📥 Commits

Reviewing files that changed from the base of the PR and between 430c60c and c2db960.

📒 Files selected for processing (1)

• charts/network-observer/templates/deployment.yaml

[c-kruse]

@CarolinaRFerreira thank you for the pull request. I am curious if you had a plan for these probes already or have been able to test this change with enabled: true. As it stands, I do not believe the commented example: GET :9191/healthz would not work.

[CarolinaRFerreira]

I've made some changes to the values. I already tested them and they seem to be correct, both the probes and the readOnlyFilesystem.

[c-kruse]

Thank you for the contribution! Looks good to me.

[JPadovano1483]

LGTM