Read only file system

README.md

@@ -169,6 +169,9 @@ diff-suppressed. Dex configuration is stored by the official chart in a Kubernet
 **Secret**, never in the theme ConfigMap. Helm stores release values, including
 inline credentials, in its release Secrets: protect these with RBAC, encryption
 at rest and encrypted backups. This role does not generate or rotate passwords.
+The root filesystem stays read-only; a 16 MiB memory-backed `emptyDir` mounted
+at `/tmp` provides Dex's required temporary config-file writes without making
+the container filesystem writable.
 
 Client `secretEnv` can refer to a key in `dex_env_secret_name`. LDAP connectors
 support `$ENV_NAME` references, such as `bindPW: $DEX_LDAP_BIND_PASSWORD`. The

templates/values.yml.j2

@@ -83,7 +83,11 @@ config:
 {% for connector in dex_additional_connectors %}
     - {{ connector | to_json }}
 {% endfor %}
-volumes:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volumes %} []{% endif %}
+volumes:
+  - name: dex-tmp
+    emptyDir:
+      medium: Memory
+      sizeLimit: 16Mi
 
 {% if dex_theme_enabled %}
   - name: theme
@@ -98,7 +102,9 @@ volumes:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra
 {% for volume in dex_extra_volumes %}
   - {{ volume | to_json }}
 {% endfor %}
-volumeMounts:{% if not dex_theme_enabled and not dex_ca_secret_name and not dex_extra_volume_mounts %} []{% endif %}
+volumeMounts:
+  - name: dex-tmp
+    mountPath: /tmp
 
 {% if dex_theme_enabled %}
   - name: theme