feat: add readiness probe and read only root filesystem

[CarolinaRFerreira]

Summary by CodeRabbit

• Bug Fixes
  • Improved runtime security by enabling a read-only root filesystem across key chart containers.
  • Added a dedicated writable /tmp directory to preserve expected runtime behavior while keeping the rest of the filesystem protected.
  • Made both liveness and readiness probes configurable, rendering them only when explicitly enabled via chart values.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 01838ee0-d7e9-4c8e-8ea9-a7c380271c47

📥 Commits

Reviewing files that changed from the base of the PR and between c3345f6 and 139cd83.

📒 Files selected for processing (2)

• charts/network-observer/templates/deployment.yaml
• charts/network-observer/values.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• charts/network-observer/values.yaml

---

📝 Walkthrough

Walkthrough

Adds a proxy-tmp emptyDir volume mounted at /tmp in the proxy containers, enables readOnlyRootFilesystem in chart security contexts, and conditionally renders the network-observer liveness and readiness probes from values.

Changes

Read-only root filesystem hardening

Layer / File(s)	Summary
proxy-tmp volume and mounts charts/network-observer/templates/_deployment.yaml	Adds an emptyDir volume named proxy-tmp and mounts it at /tmp in the NGINX proxy and OpenShift OAuth proxy container volumeMounts sections.
readOnlyRootFilesystem settings in values.yaml charts/network-observer/values.yaml	Sets readOnlyRootFilesystem: true under the Prometheus, NGINX, OpenShift OAuth proxy, and main securityContext blocks.
conditional probe rendering charts/network-observer/templates/deployment.yaml	Renders the network-observer livenessProbe and readinessProbe only when their corresponding enabled flags are true.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main changes: adding a readiness probe and enabling read-only root filesystems.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

charts/network-observer/templates/_deployment.yaml (1)

25-26: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Consider bounding the proxy-tmp emptyDir size.

No sizeLimit is set, so this volume can grow unbounded and consume node ephemeral storage.

♻️ Proposed fix

 - name: proxy-tmp
-  emptyDir: {}
+  emptyDir:
+    sizeLimit: 64Mi

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 17615b9f-a6e7-4a6e-85fc-208b54bf44b4

📥 Commits

Reviewing files that changed from the base of the PR and between e0dd9ce and 430c60c.

📒 Files selected for processing (2)

• charts/network-observer/templates/_deployment.yaml
• charts/network-observer/values.yaml

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

charts/network-observer/templates/deployment.yaml (1)

50-50: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Trailing whitespace after the if tag.

Line 50 has trailing spaces after }}, inconsistent with the other conditional blocks in this file (e.g. Line 15's {{- if .Values.prometheus.persistence.enabled }} has no trailing whitespace). This introduces a stray whitespace-only line in rendered output and may trip YAML/lint checks.

Proposed fix

-          {{- if .Values.readinessProbe.enabled }}    
+          {{- if .Values.readinessProbe.enabled }}

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 34f4f26f-e3fa-4792-932c-4ba22e2e79de

📥 Commits

Reviewing files that changed from the base of the PR and between 430c60c and c2db960.

📒 Files selected for processing (1)

• charts/network-observer/templates/deployment.yaml

[c-kruse]

@CarolinaRFerreira thank you for the pull request. I am curious if you had a plan for these probes already or have been able to test this change with enabled: true. As it stands, I do not believe the commented example: GET :9191/healthz would not work.