From 10e0185e19d719e0107142afa7271847f1db6918 Mon Sep 17 00:00:00 2001
From: Eric Meehan <eric@eom.dev>
Date: Fri, 23 Oct 2026 18:47:41 -0400
Subject: [PATCH] error

---
 templates/values.yml.j2 | 13 +++++++++----
 tests/validate.py       | 10 +++++++---
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/templates/values.yml.j2 b/templates/values.yml.j2
index cad2ff1..ef5bf59 100755
--- a/templates/values.yml.j2
+++ b/templates/values.yml.j2
@@ -83,8 +83,12 @@ config:
 {% for connector in dex_additional_connectors %}
     - {{ connector | to_json }}
 {% endfor %}
-volumes:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volumes %} []{% endif %}
-
+volumes:
+  # The official entrypoint renders its config into /tmp before starting Dex.
+  - name: dex-tmp
+    emptyDir:
+      medium: Memory
+      sizeLimit: 16Mi
 {% if dex_theme_enabled %}
   - name: theme
     configMap:
@@ -98,8 +102,9 @@ volumes:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra
 {% for volume in dex_extra_volumes %}
   - {{ volume | to_json }}
 {% endfor %}
-volumeMounts:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volume_mounts %} []{% endif %}
-
+volumeMounts:
+  - name: dex-tmp
+    mountPath: /tmp
 {% if dex_theme_enabled %}
   - name: theme
     mountPath: /srv/dex/web/themes/light/styles.css
diff --git a/tests/validate.py b/tests/validate.py
index df85569..ed71276 100755
--- a/tests/validate.py
+++ b/tests/validate.py
@@ -48,8 +48,9 @@ assert ldap['config']['groupSearch']['userMatchers'][0]['userAttr'] == 'DN'
 assert config['staticClients'][0]['id'] == 'matrix-fixture'
 assert config['frontend']['logoURL'] == 'theme/logo.svg'
 assert config['frontend']['dir'] == '/srv/dex/web'
-assert len(values['volumeMounts']) == 2
-assert all(mount['readOnly'] for mount in values['volumeMounts'])
+assert len(values['volumeMounts']) == 3
+assert all(mount['readOnly'] for mount in values['volumeMounts'] if mount['name'] != 'dex-tmp')
+assert next(volume for volume in values['volumes'] if volume['name'] == 'dex-tmp')['emptyDir'] == {'medium': 'Memory', 'sizeLimit': '16Mi'}
 optional = yaml.safe_load(Path('/tmp/dex-values-optional.yml').read_text())
 assert 'frontend' not in optional['config']
 assert optional['config']['connectors'][0]['config']['startTLS'] is True
@@ -57,13 +58,16 @@ assert optional['config']['staticClients'][0]['secretEnv'] == 'WWW_DEX_CLIENT_SE
 assert optional['envFrom'][0]['secretRef']['name'] == 'dex-client-secrets'
 minimal = yaml.safe_load(Path('/tmp/dex-values-minimal.yml').read_text())
 assert minimal['config']['staticClients'] == []
-assert minimal['volumes'] == [] and minimal['volumeMounts'] == []
+assert minimal['volumes'] == [{'name': 'dex-tmp', 'emptyDir': {'medium': 'Memory', 'sizeLimit': '16Mi'}}]
+assert minimal['volumeMounts'] == [{'name': 'dex-tmp', 'mountPath': '/tmp'}]
 objects = [obj for obj in yaml.safe_load_all(Path('/tmp/dex-manifests.yml').read_text()) if obj]
 for obj in objects:
     validate(obj, desired_version='1.31.0', strict=True)
 deployment = next(obj for obj in objects if obj['kind'] == 'Deployment')
 assert deployment['metadata']['name'] == 'dex'
 mounts = deployment['spec']['template']['spec']['containers'][0]['volumeMounts']
+assert {'name': 'dex-tmp', 'mountPath': '/tmp'} in mounts
+assert deployment['spec']['template']['spec']['containers'][0]['securityContext']['readOnlyRootFilesystem'] is True
 assert any(mount['mountPath'].endswith('/light/styles.css') for mount in mounts)
 secret = next(obj for obj in objects if obj['kind'] == 'Secret')
 stored = yaml.safe_load(base64.b64decode(secret['data']['config.yaml']))