oracle/weblogic-kubernetes-operator

ER - Enable using securityContext.readOnlyRootFilesystem set to true with for Weblogic domain PODs controlled by Weblogic Kubernetes Operator

Closed this issue · 2 comments

Michalski-Piotr commented

Hello,
there is followowing security related recommendation raised by one of customer using Weblogic Domain running in Kubernetes architecture and controlled by Oracle Weblogic Operator:

(HIGH): Container 'weblogic-server' of Pod 'osb-domain-adminserver' should set 'securityContext.readOnlyRootFilesystem' to true
 (HIGH): Container 'weblogic-server' of Pod 'osb-domain-osb-server1' should set 'securityContext.readOnlyRootFilesystem' to true
 (HIGH): Container 'weblogic-server' of Pod 'osb-domain-osb-server2' should set 'securityContext.readOnlyRootFilesystem' to true

It was attempted to add readOnlyRootFilesystem: true to the domain.yaml for Weblogic domain controlled by the WKO Operator:

        securityContext:
          readOnlyRootFilesystem: true

But after this operation WKO introspector POD is failing and is not able to introspect such domain:

After adding ‘securityContext.readOnlyRootFilesystem ‘ to OSB doman POD specification, the Weblogic Operator introspector job pod is failing:

kubectl get pods -n osb osb-domain-introspector-ldmct
NAME                            READY   STATUS   RESTARTS   AGE
osb-domain-introspector-ldmct   0/1     Error    0          98s

In the introspector pod log there is following error:

/weblogic-operator/scripts/utils.sh: line 446: cannot create temp file for here-document: Read-only file system
/weblogic-operator/scripts/utils.sh: line 447: cannot create temp file for here-document: Read-only file system

It seems WKO operator require to create temp file on the POD root filesystem.

Is there any option to use securityContext.readOnlyRootFilesystem set to true with Weblogic Operator and Weblogic Server domains running in Kubernetes architecture and controlled by the Operator, please?

If not we would like to raise for one of Oracle customers that use Weblogic Operator running in Oracle OCI Kubernetes OKE.

Topic was discussed internally with Oracle Weblogic Kubernetes Operator Product Management Team and we have agreed to raise the Enhancement Request in GitHub.

Kind regards,
Piotr Michalski
Oracle CSS

Michalski-Piotr commented

Customer is using currently Weblogic Kubernetes Operator 4.2.9 and below versions:

Image

rjeberhard commented

Implemented in 4.2.17.