From 393e31a9d70f08ab58d8fa06cfde4dbbb85b44c0 Mon Sep 17 00:00:00 2001 From: CarolinaRFerreira Date: Wed, 1 Jul 2026 11:13:46 +0100 Subject: [PATCH 1/5] feat: add readinessProbe field --- charts/network-observer/values.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/charts/network-observer/values.yaml b/charts/network-observer/values.yaml index 2fd5b00ca..fd8f1555e 100644 --- a/charts/network-observer/values.yaml +++ b/charts/network-observer/values.yaml @@ -224,3 +224,17 @@ securityContext: - ALL skipManagementLabels: false + +## Controller containers' readiness probe. Evaluated as a template. +## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes +readinessProbe: + enabled: true + # httpGet: + # path: /healthz + # port: 11972 + # scheme: HTTP + # failureThreshold: 3 + # initialDelaySeconds: 60 + # periodSeconds: 30 + # successThreshold: 1 + # timeoutSeconds: 30 From 430c60c41d80bfb051a3522122c3eac1682b045a Mon Sep 17 00:00:00 2001 From: CarolinaRFerreira Date: Wed, 1 Jul 2026 13:28:31 +0100 Subject: [PATCH 2/5] feat: add readOnlyRootFilesystem field --- charts/network-observer/templates/_deployment.yaml | 6 ++++++ charts/network-observer/values.yaml | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/charts/network-observer/templates/_deployment.yaml b/charts/network-observer/templates/_deployment.yaml index aee4e1281..6a7541732 100644 --- a/charts/network-observer/templates/_deployment.yaml +++ b/charts/network-observer/templates/_deployment.yaml @@ -22,6 +22,8 @@ secretName: {{ include "network-observer.basicAuthSecretName" . }} {{- end }} {{- end }} +- name: proxy-tmp + emptyDir: {} {{- end -}} {{- define "network-observer.nginxProxySpec" -}} @@ -52,6 +54,8 @@ volumeMounts: name: {{ include "network-observer.tlsSecretName" . }} - mountPath: /etc/nginx name: nginx-config + - mountPath: /tmp + name: proxy-tmp {{- if eq .Values.auth.strategy "basic" }} - mountPath: /etc/httpusers name: nginx-htpasswd @@ -90,4 +94,6 @@ volumeMounts: name: {{ include "network-observer.tlsSecretName" . }} - mountPath: /etc/session-secrets/ name: session-cookie-secret + - mountPath: /tmp + name: proxy-tmp {{- end -}} diff --git a/charts/network-observer/values.yaml b/charts/network-observer/values.yaml index fd8f1555e..9d742a813 100644 --- a/charts/network-observer/values.yaml +++ b/charts/network-observer/values.yaml @@ -20,6 +20,7 @@ prometheus: pullPolicy: IfNotPresent tag: "v3.11.3" securityContext: + readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: drop: @@ -79,6 +80,7 @@ nginx: tag: "1.31.0-alpine" pullPolicy: IfNotPresent securityContext: + readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: drop: @@ -90,6 +92,7 @@ openshiftOauthProxy: tag: "4.22.0" pullPolicy: IfNotPresent securityContext: + readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: drop: @@ -218,6 +221,7 @@ podSecurityContext: # network-observer container securityContext securityContext: + readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: drop: From c2db960d84f0576b4292adf20f2b917ff4980414 Mon Sep 17 00:00:00 2001 From: CarolinaRFerreira Date: Thu, 2 Jul 2026 00:15:44 +0100 Subject: [PATCH 3/5] chore: add readinessProbe to deployment --- charts/network-observer/templates/deployment.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/charts/network-observer/templates/deployment.yaml b/charts/network-observer/templates/deployment.yaml index 2e01cdb5a..8327cd190 100644 --- a/charts/network-observer/templates/deployment.yaml +++ b/charts/network-observer/templates/deployment.yaml @@ -47,6 +47,10 @@ spec: {{- end }} containers: - name: network-observer + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }} + {{- end }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" imagePullPolicy: {{ .Values.image.pullPolicy }} {{- with .Values.securityContext }} From c3345f699a4224fd0f4b4bfbd343f36a63d3b76e Mon Sep 17 00:00:00 2001 From: CarolinaRFerreira Date: Thu, 2 Jul 2026 10:13:32 +0100 Subject: [PATCH 4/5] feat: add livenessProbe field --- charts/network-observer/values.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/charts/network-observer/values.yaml b/charts/network-observer/values.yaml index 9d742a813..7a15f18f3 100644 --- a/charts/network-observer/values.yaml +++ b/charts/network-observer/values.yaml @@ -235,10 +235,24 @@ readinessProbe: enabled: true # httpGet: # path: /healthz - # port: 11972 + # port: 9000 # scheme: HTTP # failureThreshold: 3 # initialDelaySeconds: 60 # periodSeconds: 30 # successThreshold: 1 # timeoutSeconds: 30 + + ## Default backend containers' liveness probe. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + livenessProbe: + enabled: true + # httpGet: + # path: /healthz + # port: http + # scheme: HTTP + # failureThreshold: 3 + # initialDelaySeconds: 60 + # periodSeconds: 30 + # successThreshold: 1 + # timeoutSeconds: 30 From 139cd836410926245592a597d838f0c48231a1d5 Mon Sep 17 00:00:00 2001 From: CarolinaRFerreira Date: Thu, 2 Jul 2026 11:17:02 +0100 Subject: [PATCH 5/5] chore: add livenessProbe to deployment --- .../templates/deployment.yaml | 4 +++ charts/network-observer/values.yaml | 32 +++++++++---------- 2 files changed, 20 insertions(+), 16 deletions(-) diff --git a/charts/network-observer/templates/deployment.yaml b/charts/network-observer/templates/deployment.yaml index 8327cd190..4ba457e37 100644 --- a/charts/network-observer/templates/deployment.yaml +++ b/charts/network-observer/templates/deployment.yaml @@ -47,6 +47,10 @@ spec: {{- end }} containers: - name: network-observer + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }} + {{- end }} {{- if .Values.readinessProbe.enabled }} readinessProbe: {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }} diff --git a/charts/network-observer/values.yaml b/charts/network-observer/values.yaml index 7a15f18f3..4b889ceb9 100644 --- a/charts/network-observer/values.yaml +++ b/charts/network-observer/values.yaml @@ -229,13 +229,13 @@ securityContext: skipManagementLabels: false -## Controller containers' readiness probe. Evaluated as a template. +## Controller containers' readiness probe ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes readinessProbe: - enabled: true + enabled: false # httpGet: # path: /healthz - # port: 9000 + # port: 9191 # scheme: HTTP # failureThreshold: 3 # initialDelaySeconds: 60 @@ -243,16 +243,16 @@ readinessProbe: # successThreshold: 1 # timeoutSeconds: 30 - ## Default backend containers' liveness probe. Evaluated as a template. - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - livenessProbe: - enabled: true - # httpGet: - # path: /healthz - # port: http - # scheme: HTTP - # failureThreshold: 3 - # initialDelaySeconds: 60 - # periodSeconds: 30 - # successThreshold: 1 - # timeoutSeconds: 30 +## Default backend containers' liveness probe +## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes +livenessProbe: + enabled: false + # httpGet: + # path: /healthz + # port: 9191 + # scheme: HTTP + # failureThreshold: 3 + # initialDelaySeconds: 60 + # periodSeconds: 30 + # successThreshold: 1 + # timeoutSeconds: 30