Enable Read-Only Root File System
This topic describes how to configure a read-only root file system for a Fusion deployment.
Read-only mode safeguards your file system against unauthorized changes, such as by malicious software or other attacks.
Enabling this feature entails configuring the readOnlyRootFilesystem attribute in the Fusion Helm chart.
|
This feature is only available in Fusion 5.9.9 and later versions of Fusion 5.9. |
Beginning with Fusion 5.9.10, all of Fusion’s services are designed to work with a read-only root file system, but some external services may require write access to the file system. In that case, you can configure a read-only root file system and mount a separate writable file system for these services.
The examples below show how to configure a read-only root file system for various Fusion services.
Solr
fusion:
solr:
containerSecurityContext:
readOnlyRootFilesystem: true
fusion:
solr:
exporter:
enabled: true
securityContext:
readOnlyRootFilesystem: true
containerSecurityContext:
readOnlyRootFilesystem: true
Zookeeper
fusion:
zookeeper:
containerSecurityContext:
readOnlyRootFilesystem: true
fusion:
zookeeper:
containerSecurityContext:
readOnlyRootFilesystem: true
exporters:
jmx:
enabled: true
zookeeper:
enabled: true
jobs:
chroots:
enabled: true
config:
create:
- /root-read-only
Kafka
fusion:
kafka:
containerSecurityContext:
readOnlyRootFilesystem: true
fusion:
kafka:
containerSecurityContext:
readOnlyRootFilesystem: true
volumePermissions:
enabled: true
containerSecurityContext:
readOnlyRootFilesystem: true
metrics:
kafka:
containerSecurityContext:
readOnlyRootFilesystem: true
enabled: true
jmx:
enabled: true
containerSecurityContext:
enabled: true
readOnlyRootFilesystem: true
externalAccess:
enabled: true
autoDiscovery:
enabled: true
containerSecurityContext:
enabled: true
readOnlyRootFilesystem: true
provisioning:
enabled: true
topics:
- name: test
partitions: 1
replicationFactor: 1
## https://kafka.apache.org/documentation/#topicconfigs
config:
max.message.bytes: 64000
flush.messages: 1
containerSecurityContext:
readOnlyRootFilesystem: true
enabled: true
ML Model Service
fusion:
ml-model-service:
ambassador:
containerSecurityContext:
readOnlyRootFilesystem: true
milvus:
mysql:
containerSecurityContext:
readOnlyRootFilesystem: true
securityContext:
readOnlyRootFilesystem: true
With optional services:
fusion:
ml-model-service:
ambassador:
containerSecurityContext:
readOnlyRootFilesystem: true
prometheusExporter:
enabled: true
securityContext:
readOnlyRootFilesystem: true
milvus:
mysql:
metrics:
enabled: true
securityContext:
readOnlyRootFilesystem: true
containerSecurityContext:
readOnlyRootFilesystem: true
cluster:
enabled: false
mishards:
securityContext:
readOnlyRootFilesystem: true
admin:
enabled: true
securityContext:
readOnlyRootFilesystem: true
securityContext:
readOnlyRootFilesystem: true
Argo
fusion:
argo:
minio:
containerSecurityContext:
readOnlyRootFilesystem: true
extraVolumes:
- name: config-dir
emptyDir: {}
- name: certs-dir
emptyDir: {}
extraVolumeMounts:
- name: config-dir
mountPath: /.minio
- name: certs-dir
mountPath: /etc/minio/certs
server:
securityContext:
readOnlyRootFilesystem: true
controller:
securityContext:
readOnlyRootFilesystem: true
mainContainer:
securityContext:
readOnlyRootFilesystem: true
executor:
securityContext:
readOnlyRootFilesystem: true
Seldon Core Operator
fusion:
seldon-core-operator:
containersSecurityContext:
readOnlyRootFilesystem: true
Argo Common Workflows
fusion:
argo-common-workflows:
containerSecurityContext:
readOnlyRootFilesystem: true
Question Answering
fusion:
question-answering:
containersSecurityContext:
readOnlyRootFilesystem: true
Classification
fusion:
classification:
containersSecurityContext:
readOnlyRootFilesystem: true
All-in-one values.yaml example
fusion:
solr:
containerSecurityContext:
readOnlyRootFilesystem: true
solr-managed:
containerSecurityContext:
readOnlyRootFilesystem: true
zookeeper:
containerSecurityContext:
readOnlyRootFilesystem: true
kafka:
containerSecurityContext:
readOnlyRootFilesystem: true
ml-model-service:
ambassador:
containerSecurityContext:
readOnlyRootFilesystem: true
milvus:
mysql:
containerSecurityContext:
readOnlyRootFilesystem: true
securityContext:
readOnlyRootFilesystem: true
argo:
minio:
containerSecurityContext:
readOnlyRootFilesystem: true
extraVolumes:
- name: config-dir
emptyDir: {}
- name: certs-dir
emptyDir: {}
extraVolumeMounts:
- name: config-dir
mountPath: /.minio
- name: certs-dir
mountPath: /etc/minio/certs
server:
securityContext:
readOnlyRootFilesystem: true
controller:
securityContext:
readOnlyRootFilesystem: true
mainContainer:
securityContext:
readOnlyRootFilesystem: true
executor:
securityContext:
readOnlyRootFilesystem: true
seldon-core-operator:
containersSecurityContext:
readOnlyRootFilesystem: true
argo-common-workflows:
containerSecurityContext:
readOnlyRootFilesystem: true
question-answering:
containersSecurityContext:
readOnlyRootFilesystem: true
classification:
containersSecurityContext:
readOnlyRootFilesystem: true
All-in-one values.yaml with optional services example
fusion:
argo:
minio:
persistence:
enabled: false
containerSecurityContext:
readOnlyRootFilesystem: true
extraVolumes:
- name: config-dir
emptyDir: {}
- name: certs-dir
emptyDir: {}
extraVolumeMounts:
- name: config-dir
mountPath: /.minio
- name: certs-dir
mountPath: /etc/minio/certs
server:
securityContext:
readOnlyRootFilesystem: true
controller:
securityContext:
readOnlyRootFilesystem: true
mainContainer:
securityContext:
readOnlyRootFilesystem: true
executor:
securityContext:
readOnlyRootFilesystem: true
solr:
exporter:
enabled: true
securityContext:
readOnlyRootFilesystem: true
containerSecurityContext:
readOnlyRootFilesystem: true
# tls:
# enabled: true
solr-managed:
exporter:
enabled: true
securityContext:
readOnlyRootFilesystem: true
enableExternalFiles: true
enabledStorage:
- gcs
processRaw:
image:
repository: fusion-dev-docker.ci-artifactory.lucidworks.com
cloudRoot: gs://lw-managed-fusion-data/tmp
gcs:
secret: gcs-key
secretFieldName: key.json
securityContext:
readOnlyRootFilesystem: true
containerSecurityContext:
readOnlyRootFilesystem: true
# tls:
# enabled: true
zookeeper:
containerSecurityContext:
readOnlyRootFilesystem: true
exporters:
jmx:
enabled: true
zookeeper:
enabled: true
jobs:
chroots:
# enabled: true
config:
create:
- /root-read-only
kafka:
containerSecurityContext:
readOnlyRootFilesystem: true
volumePermissions:
enabled: true
image:
repository: "fusion-dev-docker.ci-artifactory.lucidworks.com/os-shell"
containerSecurityContext:
readOnlyRootFilesystem: true
metrics:
kafka:
containerSecurityContext:
readOnlyRootFilesystem: true
enabled: true
jmx:
enabled: true
containerSecurityContext:
enabled: true
readOnlyRootFilesystem: true
externalAccess:
enabled: true
autoDiscovery:
enabled: true
containerSecurityContext:
enabled: true
readOnlyRootFilesystem: true
provisioning:
enabled: true
topics:
- name: test
partitions: 1
replicationFactor: 1
## https://kafka.apache.org/documentation/#topicconfigs
config:
max.message.bytes: 64000
flush.messages: 1
containerSecurityContext:
readOnlyRootFilesystem: true
enabled: true
ml-model-service:
enabled: true
ambassador:
containerSecurityContext:
readOnlyRootFilesystem: true
prometheusExporter:
enabled: true
securityContext:
readOnlyRootFilesystem: true
milvus:
mysql:
metrics:
enabled: true
securityContext:
readOnlyRootFilesystem: true
containerSecurityContext:
readOnlyRootFilesystem: true
cluster:
enabled: false
mishards:
securityContext:
readOnlyRootFilesystem: true
admin:
enabled: true
securityContext:
readOnlyRootFilesystem: true
securityContext:
readOnlyRootFilesystem: true
seldon-core-operator:
containersSecurityContext:
readOnlyRootFilesystem: true
argo-common-workflows:
containerSecurityContext:
readOnlyRootFilesystem: true
question-answering:
containersSecurityContext:
readOnlyRootFilesystem: true
classification:
containersSecurityContext:
readOnlyRootFilesystem: true
Supported services
The table below lists the services that support a read-only root file system, the ones that have it enabled by default, and the Fusion release in which support was added:
| Chart Name | Pod Name | Container Name | Supported | Default enabled | Supported version |
|---|---|---|---|---|---|
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.9+ |
|
|
✅/❌ |
❌ |
5.9.9+ |
|
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
✅ |
5.9.9+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |
|
|
|
✅ |
❌ |
5.9.10+ |