Set readOnlyRootFilesystem for console plugin container

[razo7]

Why we need this PR

The console plugin container lacks readOnlyRootFilesystem: true, failing the certsuite immutable root filesystem check. The UBI9 nginx-120 S2I image needs several paths writable at runtime, so emptyDir mounts are added for each.

Changes made

In config/optional/console-plugin/deployment.yaml:

• Set readOnlyRootFilesystem: true in the container securityContext
• Added emptyDir volume mounts for writable paths:
  • /opt/app-root/etc/passwd (subPath): NSS wrapper writes the running user entry from a template at startup
  • /var/log/nginx: S2I run script creates stdout/stderr symlinks here
  • /var/lib/nginx/tmp: nginx proxy and temp buffers
  • /run: nginx PID file

In internal/controller/nodehealthcheck_controller_test.go:

• Fixed flaky "with invalid kind" and "with missing namespace" tests that asserted NHC phase synchronously after a 2-second sleep; replaced with Eventually polling (matching the existing pattern for the "template is deleted after NHC creation" test)

How to test

1. Deploy the NHC operator with the updated console plugin deployment
2. Verify the console plugin pod starts successfully
3. Confirm certsuite immutable root filesystem test passes
4. Verify the console UI is functional

Prerequisites

Requires the console image from medik8s/node-remediation-console#111 for the nginx logging fix.

Related

• RHWA-527

Summary by CodeRabbit

• Security

  • Hardened the Node Remediation console plugin container by using a read-only root filesystem.
  • Added isolated runtime storage for required configuration and nginx paths.

• Bug Fixes

  • Improved reconciliation test reliability when validating disabled NodeHealthCheck behavior for invalid or missing remediation templates.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: razo7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [razo7]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9ad1211f-4b6b-4524-8dd2-79f67ed39317

📥 Commits

Reviewing files that changed from the base of the PR and between b9ebcf1 and 51af50d.

📒 Files selected for processing (2)

• config/optional/console-plugin/deployment.yaml
• internal/controller/nodehealthcheck_controller_test.go

---

📝 Walkthrough

Walkthrough

The console plugin Deployment enables readOnlyRootFilesystem and adds emptyDir-backed mounts for passwd, nginx logs, nginx temporary files, and runtime data. Reconciliation tests now refresh Kubernetes objects before checking updated status.

Changes

Console plugin container hardening

Layer / File(s)	Summary
Deployment security and runtime mounts config/optional/console-plugin/deployment.yaml	The container uses a read-only root filesystem and mounts writable passwd, nginx, and runtime directories backed by new emptyDir volumes.

Reconciliation test synchronization

Layer / File(s)	Summary
Template-not-found status refresh internal/controller/nodehealthcheck_controller_test.go	Invalid-kind and missing-namespace tests re-fetch the NodeHealthCheck object inside Eventually before asserting the disabled status and reason.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• medik8s/node-healthcheck-operator#382: Applies related read-only root filesystem hardening to other operator containers.
• medik8s/node-healthcheck-operator#394: Updates controller tests to refresh objects before asserting reconciled status.

Suggested labels: lgtm

Suggested reviewers: slintes, clobrano, mshitrit

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change to harden the console plugin container with a read-only root filesystem.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}