Buffering does not work with default security context

[ncsibra]

Hi,

I recently updated to the 8.1.3 chart version but keep Traefik image version at 2.1.2.
After that, I started to get errors like these:

time="2020-05-11T05:43:37Z" level=error msg="open /tmp/temp-multibuf-419673259: read-only file system"                                                                                         
time="2020-05-11T05:48:25Z" level=error msg="vulcand/oxy/buffer: error when reading request body, err: open /tmp/temp-multibuf-063517198: read-only file system" 

It's because the /tmp directory is read-only by default:

securityContext:
  capabilities:
    drop: [ALL]
  readOnlyRootFilesystem: true
  runAsGroup: 65532
  runAsNonRoot: true
  runAsUser: 65532

I opened a related issue here: containous/traefik-library-image#79, but I'm not sure that would solve the problem, don't know that a docker volume count as part of the root filesystem or not.
I think the helm chart should have an option to mount the tmp dir as an emptydir at least.
Or add the ability to mount any volume from values, not just Secrets and Configmaps.

[steven-sheehy]

Yes, a tmp dir should be added to chart as an emptydir to address this. For now you can set readOnlyRootFilesystem=false.