Merge "Make remaining volumeMounts readOnly"

glance/templates/job-bootstrap.yaml

@@ -56,9 +56,11 @@ spec:
             - name: glance-bin
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
+              readOnly: true
             - name: glance-etc
               mountPath: /etc/glance/glance-api.conf
               subPath: glance-api.conf
+              readOnly: true
       volumes:
         - name: imagedir
           emptyDir: {}

horizon/templates/deployment.yaml

@@ -68,12 +68,15 @@ spec:
             - name: startsh
               mountPath: /tmp/start.sh
               subPath: start.sh
+              readOnly: true
             - name: horizon-etc
               mountPath: /etc/apache2/sites-enabled/000-default.conf
               subPath: horizon.conf
+              readOnly: true
             - name: horizon-etc
               mountPath: /etc/openstack-dashboard/local_settings
               subPath: local_settings
+              readOnly: true
 {{ if $mounts_horizon.volumeMounts }}{{ toYaml $mounts_horizon.volumeMounts | indent 12 }}{{ end }}
           securityContext:
             runAsUser: 0

mariadb/templates/statefulset.yaml

@@ -85,21 +85,27 @@ spec:
             - name: mariadb-bin
               mountPath: /tmp/readiness.sh
               subPath: readiness.sh
+              readOnly: true
             - name: mariadb-bin
               mountPath: /tmp/start.sh
               subPath: start.sh
+              readOnly: true
             - name: mariadb-etc
               mountPath: /etc/mysql/my.cnf
+              readOnly: true
               subPath: my.cnf
             - name: mariadb-etc
               mountPath: /etc/mysql/conf.d/00-base.cnf
               subPath: 00-base.cnf
+              readOnly: true
             - name: mariadb-etc
               mountPath: /etc/mysql/conf.d/20-override.cnf
               subPath: 20-override.cnf
+              readOnly: true
             - name: mariadb-etc
               mountPath: /etc/mysql/conf.d/99-force.cnf
               subPath: 99-force.cnf
+              readOnly: true
             - name: mysql-data
               mountPath: /var/lib/mysql
       volumes:

mistral/templates/job-db-sync.yaml

@@ -56,6 +56,7 @@ spec:
             - name: mistral-bin
               mountPath: /tmp/db-sync.sh
               subPath: db-sync.sh
+              readOnly: true
       volumes:
         - name: pod-etc-mistral
           emptyDir: {}

rabbitmq/templates/deployment.yaml

@@ -108,12 +108,16 @@ spec:
             - name: rabbitmq-etc
               mountPath: /etc/rabbitmq/enabled_plugins
               subPath: enabled_plugins
+              readOnly: true
             - name: rabbitmq-etc
               mountPath: /etc/rabbitmq/erlang.cookie
               subPath: erlang.cookie
+              readOnly: true
             - name: rabbitmq-etc
               mountPath: /etc/rabbitmq/rabbitmq-env.conf
               subPath: rabbitmq-env.conf
+              readOnly: true
             - name: rabbitmq-etc
               mountPath: /etc/rabbitmq/rabbitmq.config
               subPath: rabbitmq.config
+              readOnly: true