readOnlyRootFilesystem to true in Kubernetes

[albundy83]

Describe the solution you'd like
Hello,

it will be nice that files that are updated by entrypoint.sh file be written to a dedicated empty folder.
At least file /pgadmin4/config_distro.py.

For moment, we can't use an emptyDir or persistentVolumeClaim as there are many files in /pgadmin4 folder.

I will be a nice step to achieve a more secure pgadmin4 Deployment by being capable to set readOnlyRootFilesystem to true.

A clear and concise description of what you want to happen.

Describe alternatives you've considered
Generate my self the /pgadmin4/config_distro.py as ConfigMap or Secret and mount it but we should be able to disable generation.

Specify a custom path for /pgadmin4/config_distro.py with ENV var.

A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

[oldboys92]

also looking for a solution to this 👍

[balazsjdp]

Hey, is there any solution for this?

[pravesh-sharma]

Working fine.

[albundy83]

Hello,

will you release an image soon ?

[yogeshmahajan-1903]

@albundy83
Yes. We have release 8.14 planned for tomorrow.

[oldboys92]

@yogeshmahajan-1903 good to know, I'm going to try this out in the next days and provide feedback.

[albundy83]

Hello,
just try to export and use the new environment variable PGADMIN_CUSTOM_CONFIG_DISTRO_FILE.

I have set it to PGADMIN_CUSTOM_CONFIG_DISTRO_FILE=/var/lib/pgadmin/config_distro.py and started my container in Kubernetes but it does not work as the file need to be present due to wc -m "${CONFIG_DISTRO_FILE_PATH found in line here.

If you really need to not override the file each time we start pgadmin container (but maybe it's not a good idea anymore), we could convert the line to this:

if [ ! -e "${CONFIG_DISTRO_FILE_PATH}" ] || [ "$(wc -m "${CONFIG_DISTRO_FILE_PATH}" 2>/dev/null | awk '{ print $1 }')" = "0" ]; then

[khushboovashi]

@albundy83, The fix looks good to me. you can raise the PR for the same.

[albundy83]

Hello, @khushboovashi here the PR #8258