Read only file system

2026-10-27 16:42:21 -04:00
parent 0e62fb0962
commit 642c2ed818
2 changed files with 11 additions and 2 deletions
@@ -169,6 +169,9 @@ diff-suppressed. Dex configuration is stored by the official chart in a Kubernet
 **Secret**, never in the theme ConfigMap. Helm stores release values, including
 inline credentials, in its release Secrets: protect these with RBAC, encryption
 at rest and encrypted backups. This role does not generate or rotate passwords.
+The root filesystem stays read-only; a 16 MiB memory-backed `emptyDir` mounted
+at `/tmp` provides Dex's required temporary config-file writes without making
+the container filesystem writable.

 Client `secretEnv` can refer to a key in `dex_env_secret_name`. LDAP connectors
 support `$ENV_NAME` references, such as `bindPW: $DEX_LDAP_BIND_PASSWORD`. The