OSH-Infra: Add emptydirs for tmp

This PS adds emptydirs backing the /tmp directory in pods, which
is required in most cases for full operation when using a read only
filesystem backing the container.

Additionally some yaml indent issues are resolved.

Change-Id: I8b7f1614da059783254aa6efc09facf23fca3cad
Signed-off-by: Pete Birley <pete@port.direct>

calico/templates/daemonset-calico-etcd.yaml

@@ -102,6 +102,8 @@ spec:
           - --listen-peer-urls={{ tuple "etcd" "internal" "peer" . | include "helm-toolkit.endpoints.keystone_endpoint_scheme_lookup" }}://0.0.0.0:{{ tuple "etcd" "internal" "peer" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           - --auto-compaction-retention=1
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: var-etcd
               mountPath: /var/etcd
 {{ if .Values.conf.etcd.credentials.ca }}
@@ -123,6 +125,8 @@ spec:
               readOnly: true
 {{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: var-etcd
           hostPath:
             path: /var/etcd

calico/templates/daemonset-calico-node.yaml

@@ -180,6 +180,8 @@ spec:
                   key: tls.crt
 {{ end }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - mountPath: /host/etc/calico
               name: calico-cert-dir
             - mountPath: /host/opt/cni/bin
@@ -230,6 +232,8 @@ spec:
 
 
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: cni-bin-dir
               mountPath: /host/opt/cni/bin
             - name: cni-net-dir
@@ -253,6 +257,8 @@ spec:
               readOnly: true
 {{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         # Used by calico/node.
         - name: lib-modules
           hostPath:
@@ -368,6 +374,8 @@ spec:
               - -felix-ready
             periodSeconds: 10
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - mountPath: /lib/modules
               name: lib-modules
               readOnly: true

calico/templates/deployment-calico-kube-controllers.yaml

@@ -144,6 +144,8 @@ spec:
 
           # etcd tls mounts
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: calico-etcd-secrets
               mountPath: {{ .Values.endpoints.etcd.auth.client.path.ca }}
               subPath: tls.ca
@@ -169,6 +171,8 @@ spec:
               - /usr/bin/check-status
               - -r
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: calico-etcd-secrets
           secret:
             secretName: calico-etcd-secrets

calico/templates/job-calico-settings.yaml

@@ -76,6 +76,8 @@ spec:
           command:
             - /tmp/calico-settings.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: calico-bin
               mountPath: /tmp/calico-settings.sh
               subPath: calico-settings.sh
@@ -93,6 +95,8 @@ spec:
               subPath: tls.key
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: calico-bin
           configMap:
             name: calico-bin

ceph-client/templates/cronjob-checkPGs.yaml

@@ -87,6 +87,8 @@ spec:
             command:
               - /tmp/utils-checkPGs.sh
             volumeMounts:
+              - name: pod-tmp
+                mountPath: /tmp
               - name: ceph-client-bin
                 mountPath: /tmp/utils-checkPGs.py
                 subPath: utils-checkPGs.py
@@ -118,6 +120,8 @@ spec:
           restartPolicy: Never
           hostNetwork: true
           volumes:
+            - name: pod-tmp
+              emptyDir: {}
             - name: ceph-client-bin
               configMap:
                 name: ceph-client-bin

ceph-client/templates/deployment-checkdns.yaml

@@ -99,11 +99,15 @@ spec:
           command:
             - /tmp/_start.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-client-bin
               mountPath: /tmp/_start.sh
               subPath: utils-checkDNS_start.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-client-bin
           configMap:
             name: ceph-client-bin

ceph-client/templates/deployment-mds.yaml

@@ -58,6 +58,8 @@ spec:
             - name: CLUSTER
               value: "ceph"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-client-bin
               mountPath: /tmp/init-dirs.sh
               subPath: init-dirs.sh
@@ -98,6 +100,8 @@ spec:
                 port: 6800
               timeoutSeconds: 5
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-client-bin
               mountPath: /tmp/mds-start.sh
               subPath: mds-start.sh
@@ -125,6 +129,8 @@ spec:
               mountPath: /run
               readOnly: false
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-client-etc
           configMap:
             name: ceph-client-etc

ceph-client/templates/deployment-mgr.yaml

@@ -61,6 +61,8 @@ spec:
             - name: CLUSTER
               value: "ceph"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-client-bin
               mountPath: /tmp/init-dirs.sh
               subPath: init-dirs.sh
@@ -126,6 +128,8 @@ spec:
            initialDelaySeconds: 30
            timeoutSeconds: 5
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-client-bin
               mountPath: /mgr-start.sh
               subPath: mgr-start.sh
@@ -167,6 +171,8 @@ spec:
               subPath: utils-checkPGs.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-ceph
           emptyDir: {}
         - name: ceph-client-bin

ceph-client/templates/job-bootstrap.yaml

@@ -45,6 +45,8 @@ spec:
           command:
             - /tmp/bootstrap.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-client-bin
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
@@ -58,6 +60,8 @@ spec:
               subPath: ceph.client.admin.keyring
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-client-bin
           configMap:
             name: ceph-client-bin

ceph-client/templates/job-rbd-pool.yaml

@@ -51,6 +51,8 @@ spec:
           command:
             - /tmp/pool-init.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-client-bin
               mountPath: /tmp/pool-init.sh
               subPath: pool-init.sh
@@ -74,6 +76,8 @@ spec:
               mountPath: /run
               readOnly: false
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-client-etc
           configMap:
             name: ceph-client-etc

ceph-client/templates/pod-helm-tests.yaml

@@ -58,6 +58,8 @@ spec:
       command:
         - /tmp/helm-tests.sh
       volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
         - name: ceph-client-bin
           mountPath: /tmp/helm-tests.sh
           subPath: helm-tests.sh
@@ -71,6 +73,8 @@ spec:
           subPath: ceph.conf
           readOnly: true
   volumes:
+    - name: pod-tmp
+      emptyDir: {}
     - name: ceph-client-bin
       configMap:
         name: ceph-client-bin

ceph-mon/templates/daemonset-mon.yaml

@@ -83,6 +83,8 @@ spec:
             - name: CLUSTER
               value: "ceph"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-mon-bin
               mountPath: /tmp/init-dirs.sh
               subPath: init-dirs.sh
@@ -103,6 +105,8 @@ spec:
             - ceph:root
             - /var/log/ceph
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-var-log
               mountPath: /var/log/ceph
               readOnly: false
@@ -164,6 +168,8 @@ spec:
            initialDelaySeconds: 60
            periodSeconds: 60
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-mon-bin
               mountPath: /tmp/mon-start.sh
               subPath: mon-start.sh
@@ -214,6 +220,8 @@ spec:
               mountPath: /var/log/ceph
               readOnly: false
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-var-log
           hostPath:
             path: {{ print "/var/log/ceph/" $envAll.Release.Name }}

ceph-mon/templates/deployment-moncheck.yaml

@@ -68,6 +68,8 @@ spec:
           ports:
             - containerPort: {{ tuple "ceph_mon" "internal" "mon" $envAll | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-mon-bin
               mountPath: /tmp/moncheck-start.sh
               subPath: moncheck-start.sh
@@ -99,6 +101,8 @@ spec:
               mountPath: /run
               readOnly: false
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-mon-etc
           configMap:
             name: ceph-mon-etc

ceph-mon/templates/job-bootstrap.yaml

@@ -45,6 +45,8 @@ spec:
           command:
             - /tmp/bootstrap.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-mon-bin
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
@@ -58,6 +60,8 @@ spec:
               subPath: ceph.client.admin.keyring
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin

ceph-mon/templates/job-keyring.yaml

@@ -96,6 +96,8 @@ spec:
           command:
             - /tmp/keys-bootstrap-keyring-manager.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-mon-bin
               mountPath: /tmp/keys-bootstrap-keyring-manager.sh
               subPath: keys-bootstrap-keyring-manager.sh
@@ -108,6 +110,8 @@ spec:
               mountPath: /tmp/templates
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin

ceph-mon/templates/job-storage-admin-keys.yaml

@@ -89,6 +89,8 @@ spec:
           command:
             - /tmp/keys-storage-keyring-manager.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-mon-bin
               mountPath: /tmp/keys-storage-keyring-manager.sh
               subPath: keys-storage-keyring-manager.sh
@@ -101,6 +103,8 @@ spec:
               mountPath: /tmp/templates
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-mon-bin
           configMap:
             name: ceph-mon-bin

ceph-osd/templates/cronjob-defragosds.yaml

@@ -84,9 +84,12 @@ spec:
                     fieldPath: metadata.namespace
               - name: KUBECTL_PARAM
                 value: {{ tuple $envAll "ceph" "ceph-defragosd" | include "helm-toolkit.snippets.kubernetes_kubectl_params" | indent 10 }}
-            command: ["/tmp/utils-defragOSDs.sh"]
+            command:
-            args: ["cron"]
+              - /tmp/utils-defragOSDs.sh
+              - cron
             volumeMounts:
+              - name: pod-tmp
+                mountPath: /tmp
               - name: ceph-osd-bin
                 mountPath: /tmp/utils-defragOSDs.sh
                 subPath: utils-defragOSDs.sh
@@ -94,6 +97,8 @@ spec:
           restartPolicy: Never
           hostNetwork: true
           volumes:
+            - name: pod-tmp
+              emptyDir: {}
             - name: ceph-osd-bin
               configMap:
                 name:  {{ printf "%s-%s" $envAll.Release.Name "bin" | quote }}

ceph-osd/templates/daemonset-osd.yaml

@@ -76,6 +76,8 @@ spec:
             - name: MON_PORT
               value: {{ tuple "ceph_mon" "internal" "mon" $envAll | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-osd-bin
               mountPath: /tmp/init-dirs.sh
               subPath: init-dirs.sh
@@ -123,6 +125,8 @@ spec:
             - ceph:root
             - /var/log/ceph
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-var-log
               mountPath: /var/log/ceph
               readOnly: false
@@ -157,6 +161,8 @@ spec:
           command:
             - /tmp/osd-init.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-osd-bin
               mountPath: /tmp/osd-init.sh
               subPath: osd-init.sh
@@ -248,6 +254,8 @@ spec:
            initialDelaySeconds: 60
            periodSeconds: 60
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-osd-bin
               mountPath: /tmp/osd-start.sh
               subPath: osd-start.sh
@@ -314,6 +322,8 @@ spec:
               mountPath: /var/log/ceph
               readOnly: false
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: devices
           hostPath:
             path: /dev

ceph-osd/templates/job-bootstrap.yaml

@@ -45,6 +45,8 @@ spec:
           command:
             - /tmp/bootstrap.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-osd-bin
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
@@ -58,6 +60,8 @@ spec:
               subPath: ceph.client.admin.keyring
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-osd-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "bin" | quote }}

ceph-osd/templates/pod-helm-tests.yaml

@@ -43,6 +43,8 @@ spec:
       command:
         - /tmp/helm-tests.sh
       volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
         - name: ceph-osd-bin
           mountPath: /tmp/helm-tests.sh
           subPath: helm-tests.sh
@@ -56,6 +58,8 @@ spec:
           subPath: ceph.conf
           readOnly: true
   volumes:
+    - name: pod-tmp
+      emptyDir: {}
     - name: ceph-osd-bin
       configMap:
         name: {{ printf "%s-%s" $envAll.Release.Name "bin" | quote }}

ceph-provisioners/templates/deployment-cephfs-provisioner.yaml

@@ -172,11 +172,15 @@ spec:
           command:
             - /tmp/provisioner-cephfs-start.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-provisioners-bin
               mountPath: /tmp/provisioner-cephfs-start.sh
               subPath: provisioner-cephfs-start.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}

ceph-provisioners/templates/deployment-rbd-provisioner.yaml

@@ -162,11 +162,15 @@ spec:
           command:
             - /tmp/provisioner-rbd-start.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-provisioners-bin
               mountPath: /tmp/provisioner-rbd-start.sh
               subPath: provisioner-rbd-start.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}

ceph-provisioners/templates/job-bootstrap.yaml

@@ -45,6 +45,8 @@ spec:
           command:
             - /tmp/bootstrap.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-provisioners-bin
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
@@ -58,6 +60,8 @@ spec:
               subPath: ceph.client.admin.keyring
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}

ceph-provisioners/templates/job-cephfs-client-key.yaml

@@ -114,11 +114,15 @@ spec:
           command:
             - /tmp/provisioner-cephfs-client-key-manager.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-provisioners-bin
               mountPath: /tmp/provisioner-cephfs-client-key-manager.sh
               subPath: provisioner-cephfs-client-key-manager.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-provisioners-bin
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin" | quote }}

ceph-provisioners/templates/job-namespace-client-key-cleaner.yaml

@@ -81,11 +81,15 @@ spec:
           command:
             - /tmp/provisioner-rbd-namespace-client-key-cleaner.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-provisioners-bin-clients
               mountPath: /tmp/provisioner-rbd-namespace-client-key-cleaner.sh
               subPath: provisioner-rbd-namespace-client-key-cleaner.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-provisioners-bin-clients
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin-clients" | quote }}

ceph-provisioners/templates/job-namespace-client-key.yaml

@@ -112,11 +112,15 @@ spec:
           command:
             - /tmp/provisioner-rbd-namespace-client-key-manager.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-provisioners-bin-clients
               mountPath: /tmp/provisioner-rbd-namespace-client-key-manager.sh
               subPath: provisioner-rbd-namespace-client-key-manager.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-provisioners-bin-clients
           configMap:
             name: {{ printf "%s-%s" $envAll.Release.Name "ceph-prov-bin-clients" | quote }}

ceph-rgw/templates/deployment-rgw.yaml

@@ -69,6 +69,8 @@ spec:
             - name: CLUSTER
               value: "ceph"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-rgw-bin
               mountPath: /tmp/init-dirs.sh
               subPath: init-dirs.sh
@@ -102,6 +104,8 @@ spec:
           command:
             - /tmp/rgw-init.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-etc-ceph
               mountPath: /etc/ceph
             - name: ceph-rgw-bin
@@ -137,6 +141,8 @@ spec:
                 port: {{ tuple "object_store" "internal" "api" $envAll | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
               timeoutSeconds: 5
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-rgw-bin
               mountPath: /tmp/rgw-start.sh
               subPath: rgw-start.sh
@@ -158,6 +164,8 @@ spec:
               mountPath: /run
               readOnly: false
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-ceph
           emptyDir: {}
         - name: ceph-rgw-bin

ceph-rgw/templates/job-rgw-storage-init.yaml

@@ -71,6 +71,8 @@ spec:
           command:
             - /tmp/ceph-admin-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: ceph-rgw-bin
@@ -95,6 +97,8 @@ spec:
           command:
             - /tmp/storage-init.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ceph-rgw-bin
               mountPath: /tmp/storage-init.sh
               subPath: storage-init.sh
@@ -113,6 +117,8 @@ spec:
               subPath: key
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ceph-rgw-bin
           configMap:
             name: ceph-rgw-bin

ceph-rgw/templates/job-s3-admin.yaml

@@ -76,6 +76,8 @@ spec:
           command:
             - /tmp/ceph-admin-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: ceph-rgw-bin
@@ -110,6 +112,8 @@ spec:
           command:
             - /tmp/rgw-s3-admin.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: ceph-rgw-bin
@@ -125,6 +129,8 @@ spec:
               subPath: key
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: etcceph
           emptyDir: {}
         - name: ceph-rgw-bin

ceph-rgw/templates/pod-helm-tests.yaml

@@ -53,6 +53,8 @@ spec:
       command:
         - /tmp/helm-tests.sh
       volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
         - name: etcceph
           mountPath: /etc/ceph
         - name: ceph-rgw-bin
@@ -67,7 +69,30 @@ spec:
           mountPath: /etc/ceph/ceph.conf
           subPath: ceph.conf
           readOnly: true
+{{- end }}
+{{ if .Values.conf.rgw_s3.enabled }}
+    - name: ceph-rgw-s3-validation
+{{ tuple $envAll "ceph_rgw" | include "helm-toolkit.snippets.image" | indent 6 }}
+{{ tuple $envAll $envAll.Values.pod.resources.tests | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }}
+      env:
+{{- with $env := dict "s3AdminSecret" $envAll.Values.secrets.rgw_s3.admin }}
+{{- include "helm-toolkit.snippets.rgw_s3_admin_env_vars" $env | indent 8 }}
+{{- end }}
+        - name: RGW_HOST
+          value: {{ tuple "ceph_object_store" "internal" "api" $envAll | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
+      command:
+        - /tmp/helm-tests.sh
+      volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
+        - name: ceph-rgw-bin
+          mountPath: /tmp/helm-tests.sh
+          subPath: helm-tests.sh
+          readOnly: true
+{{- end }}
   volumes:
+    - name: pod-tmp
+      emptyDir: {}
     - name: etcceph
       emptyDir: {}
     - name: ceph-rgw-bin
@@ -82,28 +107,3 @@ spec:
         name: ceph-rgw-etc
         defaultMode: 0444
 {{- end }}
-{{ if .Values.conf.rgw_s3.enabled }}
-  containers:
-    - name: ceph-rgw-s3-validation
-{{ tuple $envAll "ceph_rgw" | include "helm-toolkit.snippets.image" | indent 6 }}
-{{ tuple $envAll $envAll.Values.pod.resources.tests | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }}
-      env:
-{{- with $env := dict "s3AdminSecret" $envAll.Values.secrets.rgw_s3.admin }}
-{{- include "helm-toolkit.snippets.rgw_s3_admin_env_vars" $env | indent 8 }}
-{{- end }}
-        - name: RGW_HOST
-          value: {{ tuple "ceph_object_store" "internal" "api" $envAll | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
-      command:
-        - /tmp/helm-tests.sh
-      volumeMounts:
-        - name: ceph-rgw-bin
-          mountPath: /tmp/helm-tests.sh
-          subPath: helm-tests.sh
-          readOnly: true
-  volumes:
-    - name: ceph-rgw-bin
-      configMap:
-        name: ceph-rgw-bin
-        defaultMode: 0555
-{{- end }}
-{{- end }}

elastic-apm-server/templates/deployment.yaml

@@ -109,6 +109,8 @@ spec:
                   name: {{ $esUserSecret }}
                   key: ELASTICSEARCH_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elastic-apm-server-etc
               mountPath: /usr/share/apm-server/apm-server.yml
               readOnly: true
@@ -117,6 +119,8 @@ spec:
               mountPath: /usr/share/apm-server/data
 {{ if $mounts_elastic_apm_server.volumeMounts }}{{ toYaml $mounts_elastic_apm_server.volumeMounts | indent 8 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: elastic-apm-server-etc
           configMap:
             name: elastic-apm-server-etc

elastic-filebeat/templates/daemonset.yaml

@@ -127,6 +127,8 @@ spec:
                   name: {{ $esUserSecret }}
                   key: ELASTICSEARCH_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: data
               mountPath: /usr/share/filebeat/data
             - name: varlog
@@ -140,6 +142,8 @@ spec:
               subPath: filebeat.yml
 {{ if $mounts_filebeat.volumeMounts }}{{ toYaml $mounts_filebeat.volumeMounts | indent 8 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: varlog
           hostPath:
             path: /var/log

elastic-metricbeat/templates/daemonset-node-metrics.yaml

@@ -134,6 +134,8 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: metricbeat-etc
               mountPath: /etc/metricbeat.yml
               subPath: metricbeat.yml
@@ -156,20 +158,22 @@ spec:
               readOnly: true
 {{ if $mounts_metricbeat.volumeMounts }}{{ toYaml $mounts_metricbeat.volumeMounts | indent 12 }}{{ end }}
       volumes:
-      - name: proc
+        - name: pod-tmp
-        hostPath:
+          emptyDir: {}
-          path: /proc
+        - name: proc
-      - name: cgroup
+          hostPath:
-        hostPath:
+            path: /proc
-          path: /sys/fs/cgroup
+        - name: cgroup
-      - name: dockersock
+          hostPath:
-        hostPath:
+            path: /sys/fs/cgroup
-          path: /var/run/docker.sock
+        - name: dockersock
-      - name: metricbeat-etc
+          hostPath:
-        configMap:
+            path: /var/run/docker.sock
-          defaultMode: 0444
+        - name: metricbeat-etc
-          name: metricbeat-etc
+          configMap:
-      - name: data
+            defaultMode: 0444
-        emptyDir: {}
+            name: metricbeat-etc
+        - name: data
+          emptyDir: {}
 {{ if $mounts_metricbeat.volumes }}{{ toYaml $mounts_metricbeat.volumes | indent 8 }}{{ end }}
 {{- end }}

elastic-metricbeat/templates/deployment-modules.yaml

@@ -83,6 +83,8 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: metricbeat-etc
               mountPath: /etc/metricbeat.yml
               subPath: metricbeat.yml
@@ -100,6 +102,8 @@ spec:
               subPath: rabbitmq.yml
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: metricbeat-etc
           configMap:
             name: metricbeat-etc

elastic-packetbeat/templates/daemonset.yaml

@@ -134,12 +134,16 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: packetbeat-etc
               mountPath: /etc/packetbeat/packetbeat.yml
               subPath: packetbeat.yml
               readOnly: true
 {{ if $mounts_packetbeat.volumeMounts }}{{ toYaml $mounts_packetbeat.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: packetbeat-etc
           configMap:
             defaultMode: 0444

elasticsearch/templates/cron-job-curator.yaml

@@ -59,6 +59,8 @@ spec:
                       name: {{ $esUserSecret }}
                       key: ELASTICSEARCH_URI
               volumeMounts:
+                - name: pod-tmp
+                  mountPath: /tmp
                 - name: pod-etc-curator
                   mountPath: /etc/config
                 - name: elasticsearch-bin
@@ -74,6 +76,8 @@ spec:
                   subPath: action_file.yml
                   readOnly: true
           volumes:
+            - name: pod-tmp
+              emptyDir: {}
             - name: pod-etc-curator
               emptyDir: {}
             - name: elasticsearch-bin

elasticsearch/templates/deployment-client.yaml

@@ -130,6 +130,8 @@ spec:
                   name: {{ $esUserSecret }}
                   key: ELASTICSEARCH_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elasticsearch-bin
               mountPath: /tmp/apache.sh
               subPath: apache.sh
@@ -192,6 +194,8 @@ spec:
             - name: ES_PLUGINS_INSTALL
               value: "elasticsearch-s3"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elasticsearch-logs
               mountPath: {{ .Values.conf.elasticsearch.config.path.logs }}
             - name: elasticsearch-bin
@@ -212,6 +216,8 @@ spec:
               mountPath: {{ .Values.conf.elasticsearch.config.path.data }}
 {{ if $mounts_elasticsearch.volumeMounts }}{{ toYaml $mounts_elasticsearch.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: elasticsearch-config
           emptyDir: {}
         - name: elasticsearch-logs

elasticsearch/templates/deployment-master.yaml

@@ -150,6 +150,8 @@ spec:
             - name: ES_PLUGINS_INSTALL
               value: "elasticsearch-s3"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elasticsearch-logs
               mountPath: {{ .Values.conf.elasticsearch.config.path.logs }}
             - name: elasticsearch-bin
@@ -170,6 +172,8 @@ spec:
               mountPath: {{ .Values.conf.elasticsearch.config.path.data }}
 {{ if $mounts_elasticsearch.volumeMounts }}{{ toYaml $mounts_elasticsearch.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: elasticsearch-logs
           emptyDir: {}
         - name: elasticsearch-config

elasticsearch/templates/job-es-cluster-wait.yaml

@@ -60,11 +60,15 @@ spec:
           command:
             - /tmp/es-cluster-wait.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elasticsearch-bin
               mountPath: /tmp/es-cluster-wait.sh
               subPath: es-cluster-wait.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin

elasticsearch/templates/job-register-snapshot-repository.yaml

@@ -75,11 +75,15 @@ spec:
           command:
             - /tmp/register-repository.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elasticsearch-bin
               mountPath: /tmp/register-repository.sh
               subPath: register-repository.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: elasticsearch-bin
           configMap:
             name: elasticsearch-bin

elasticsearch/templates/monitoring/prometheus/exporter-deployment.yaml

@@ -77,11 +77,15 @@ spec:
             initialDelaySeconds: 20
             periodSeconds: 10
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elasticsearch-exporter-bin
               mountPath: /tmp/elasticsearch-exporter.sh
               subPath: elasticsearch-exporter.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: elasticsearch-exporter-bin
           configMap:
             name: elasticsearch-exporter-bin

elasticsearch/templates/pod-helm-tests.yaml

@@ -57,11 +57,15 @@ spec:
         - name: ELASTICSEARCH_ENDPOINT
           value: {{ tuple "elasticsearch" "internal" "http" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
       volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
         - name: elasticsearch-bin
           mountPath: /tmp/helm-tests.sh
           subPath: helm-tests.sh
           readOnly: true
   volumes:
+    - name: pod-tmp
+      emptyDir: {}
     - name: elasticsearch-bin
       configMap:
         name: elasticsearch-bin

elasticsearch/templates/statefulset-data.yaml

@@ -148,6 +148,8 @@ spec:
             - name: ES_PLUGINS_INSTALL
               value: "elasticsearch-s3"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: elasticsearch-logs
               mountPath: {{ .Values.conf.elasticsearch.config.path.logs }}
             - name: elasticsearch-bin
@@ -168,6 +170,8 @@ spec:
               mountPath: {{ .Values.conf.elasticsearch.config.path.data }}
 {{ if $mounts_elasticsearch.volumeMounts }}{{ toYaml $mounts_elasticsearch.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: elasticsearch-logs
           emptyDir: {}
         - name: elasticsearch-config

etcd/templates/deployment.yaml

@@ -60,11 +60,15 @@ spec:
             tcpSocket:
               port: {{ tuple "etcd" "internal" "client" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcd-bin
               mountPath: /tmp/etcd.sh
               subPath: etcd.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: etcd-bin
           configMap:
             name: {{ $configMapBinName | quote }}

falco/templates/daemonset.yaml

@@ -90,6 +90,8 @@ spec:
           args:
             - /tmp/falco.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - mountPath: /tmp/falco.sh
               name: falco-bin
               subPath: falco.sh
@@ -115,6 +117,8 @@ spec:
               name: rules-volume
             {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: falco-bin
           configMap:
             name: falco-bin

flannel/templates/daemonset-kube-flannel-ds.yaml

@@ -110,6 +110,8 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: run
               mountPath: /run
             - name: flannel-cfg
@@ -118,11 +120,15 @@ spec:
           image: {{ .Values.images.tags.flannel }}
           command: [ "/bin/sh", "-c", "set -e -x; cp -f /etc/kube-flannel/cni-conf.json /etc/cni/net.d/10-flannel.conf; while true; do sleep 3600; done" ]
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: cni
               mountPath: /etc/cni/net.d
             - name: flannel-cfg
               mountPath: /etc/kube-flannel/
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: run
           hostPath:
             path: /run

fluent-logging/templates/daemonset-fluent-bit.yaml

@@ -118,6 +118,8 @@ spec:
             - name: FLUENTD_PORT
               value: {{ tuple "fluentd" "internal" "service" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: fluent-logging-bin
               mountPath: /tmp/fluent-bit.sh
               subPath: fluent-bit.sh
@@ -138,6 +140,8 @@ spec:
               readOnly: true
 {{ if $mounts_fluentbit.volumeMounts }}{{ toYaml $mounts_fluentbit.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: varlog
           hostPath:
             path: /var/log

fluent-logging/templates/deployment-fluentd.yaml

@@ -145,6 +145,8 @@ spec:
                   name: {{ $esUserSecret }}
                   key: ELASTICSEARCH_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-etc-fluentd
               mountPath: /fluentd/etc
             - name: fluent-logging-etc
@@ -157,6 +159,8 @@ spec:
               readOnly: true
 {{- if $mounts_fluentd.volumeMounts }}{{ toYaml $mounts_fluentd.volumeMounts | indent 12 }}{{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-fluentd
           emptyDir: {}
         - name: fluent-logging-etc

fluent-logging/templates/job-elasticsearch-template.yaml

@@ -63,6 +63,8 @@ spec:
           command:
             - /tmp/create_template.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: fluent-logging-bin
               mountPath: /tmp/create_template.sh
               subPath: create_template.sh
@@ -75,6 +77,8 @@ spec:
             {{ end }}
 {{ if $mounts_elasticsearch_template.volumeMounts }}{{ toYaml $mounts_elasticsearch_template.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: fluent-logging-bin
           configMap:
             name: fluent-logging-bin

fluent-logging/templates/monitoring/prometheus/exporter-deployment.yaml

@@ -68,11 +68,15 @@ spec:
             - name: FLUENTD_METRICS_HOST
               value: {{ $fluentd_metrics_host }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: fluentd-exporter-bin
               mountPath: /tmp/fluentd-exporter.sh
               subPath: fluentd-exporter.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: fluentd-exporter-bin
           configMap:
             name: fluentd-exporter-bin

fluent-logging/templates/pod-helm-tests.yaml

@@ -42,28 +42,32 @@ spec:
 {{ tuple $envAll "helm_tests" | include "helm-toolkit.snippets.image" | indent 6 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.tests | include "helm-toolkit.snippets.kubernetes_resources" | indent 6 }}
       command:
-      - /tmp/helm-tests.sh
+        - /tmp/helm-tests.sh
       env:
-      - name: ELASTICSEARCH_USERNAME
+        - name: ELASTICSEARCH_USERNAME
-        valueFrom:
+          valueFrom:
-          secretKeyRef:
+            secretKeyRef:
-            name: {{ $esUserSecret }}
+              name: {{ $esUserSecret }}
-            key: ELASTICSEARCH_USERNAME
+              key: ELASTICSEARCH_USERNAME
-      - name: ELASTICSEARCH_PASSWORD
+        - name: ELASTICSEARCH_PASSWORD
-        valueFrom:
+          valueFrom:
-          secretKeyRef:
+            secretKeyRef:
-            name: {{ $esUserSecret }}
+              name: {{ $esUserSecret }}
-            key: ELASTICSEARCH_PASSWORD
+              key: ELASTICSEARCH_PASSWORD
-      - name: ELASTICSEARCH_ENDPOINT
+        - name: ELASTICSEARCH_ENDPOINT
-        value: {{ tuple "elasticsearch" "internal" "http" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
+          value: {{ tuple "elasticsearch" "internal" "http" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
       volumeMounts:
-      - name: fluent-logging-bin
+        - name: pod-tmp
-        mountPath: /tmp/helm-tests.sh
+          mountPath: /tmp
-        subPath: helm-tests.sh
+        - name: fluent-logging-bin
-        readOnly: true
+          mountPath: /tmp/helm-tests.sh
+          subPath: helm-tests.sh
+          readOnly: true
   volumes:
-  - name: fluent-logging-bin
+    - name: pod-tmp
-    configMap:
+      emptyDir: {}
-      name: fluent-logging-bin
+    - name: fluent-logging-bin
-      defaultMode: 0555
+      configMap:
+        name: fluent-logging-bin
+        defaultMode: 0555
 {{- end }}

gnocchi/templates/cron-job-resources-cleaner.yaml

@@ -70,27 +70,31 @@ spec:
               command:
                 - /tmp/gnocchi-resources-cleaner.sh
               volumeMounts:
-              - name: gnocchi-bin
+                - name: pod-tmp
-                mountPath: /tmp/gnocchi-resources-cleaner.sh
+                  mountPath: /tmp
-                subPath: gnocchi-resources-cleaner.sh
+                - name: gnocchi-bin
-                readOnly: true
+                  mountPath: /tmp/gnocchi-resources-cleaner.sh
-              - name: pod-etc-gnocchi
+                  subPath: gnocchi-resources-cleaner.sh
-                mountPath: /etc/gnocchi
+                  readOnly: true
-              - name: gnocchi-etc
+                - name: pod-etc-gnocchi
-                mountPath: /etc/gnocchi/gnocchi.conf
+                  mountPath: /etc/gnocchi
-                subPath: gnocchi.conf
+                - name: gnocchi-etc
-                readOnly: true
+                  mountPath: /etc/gnocchi/gnocchi.conf
-{{ if $mounts_gnocchi_resources_cleaner.volumeMounts }}{{ toYaml $mounts_gnocchi_resources_cleaner.volumeMounts | indent 14 }}{{ end }}
+                  subPath: gnocchi.conf
+                  readOnly: true
+{{ if $mounts_gnocchi_resources_cleaner.volumeMounts }}{{ toYaml $mounts_gnocchi_resources_cleaner.volumeMounts | indent 16 }}{{ end }}
           volumes:
-          - name: pod-etc-gnocchi
+            - name: pod-tmp
-            emptyDir: {}
+              emptyDir: {}
-          - name: gnocchi-etc
+            - name: pod-etc-gnocchi
-            secret:
+              emptyDir: {}
-              secretName: gnocchi-etc
+            - name: gnocchi-etc
-              defaultMode: 0444
+              secret:
-          - name: gnocchi-bin
+                secretName: gnocchi-etc
-            configMap:
+                defaultMode: 0444
-              name: gnocchi-bin
+            - name: gnocchi-bin
-              defaultMode: 0555
+              configMap:
-{{ if $mounts_gnocchi_resources_cleaner.volumes }}{{ toYaml $mounts_gnocchi_resources_cleaner.volumes | indent 10 }}{{ end }}
+                name: gnocchi-bin
+                defaultMode: 0555
+{{ if $mounts_gnocchi_resources_cleaner.volumes }}{{ toYaml $mounts_gnocchi_resources_cleaner.volumes | indent 12 }}{{ end }}
 {{- end }}

gnocchi/templates/daemonset-metricd.yaml

@@ -53,6 +53,8 @@ spec:
           command:
             - /tmp/ceph-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: gnocchi-bin
@@ -70,6 +72,8 @@ spec:
           command:
             - /tmp/gnocchi-metricd.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-etc-gnocchi
               mountPath: /etc/gnocchi
             - name: gnocchi-etc
@@ -96,6 +100,8 @@ spec:
               readOnly: true
 {{ if $mounts_gnocchi_metricd.volumeMounts }}{{ toYaml $mounts_gnocchi_metricd.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-gnocchi
           emptyDir: {}
         - name: gnocchi-etc

gnocchi/templates/daemonset-statsd.yaml

@@ -52,6 +52,8 @@ spec:
           command:
             - /tmp/ceph-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: gnocchi-bin
@@ -72,6 +74,8 @@ spec:
             - name: gn-stats
               containerPort: {{ tuple "metric_statsd" "internal" "statsd" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-etc-gnocchi
               mountPath: /etc/gnocchi
             - name: gnocchi-etc
@@ -102,6 +106,8 @@ spec:
               readOnly: true
 {{ if $mounts_gnocchi_statsd.volumeMounts }}{{ toYaml $mounts_gnocchi_statsd.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-gnocchi
           emptyDir: {}
         - name: gnocchi-etc

gnocchi/templates/deployment-api.yaml

@@ -57,6 +57,8 @@ spec:
           command:
             - /tmp/ceph-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: gnocchi-bin
@@ -87,6 +89,8 @@ spec:
             tcpSocket:
               port: {{ tuple "metric" "internal" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-etc-gnocchi
               mountPath: /etc/gnocchi
             - name: gnocchi-etc
@@ -121,6 +125,8 @@ spec:
               readOnly: true
 {{ if $mounts_gnocchi_api.volumeMounts }}{{ toYaml $mounts_gnocchi_api.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-gnocchi
           emptyDir: {}
         - name: gnocchi-etc

gnocchi/templates/job-clean.yaml

@@ -79,11 +79,15 @@ spec:
           command:
             - /tmp/clean-secrets.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: gnocchi-bin
               mountPath: /tmp/clean-secrets.sh
               subPath: clean-secrets.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin

gnocchi/templates/job-db-init-indexer.yaml

@@ -55,6 +55,8 @@ spec:
           command:
             - /tmp/db-init.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: gnocchi-etc
               mountPath: /etc/gnocchi/gnocchi.conf
               subPath: gnocchi.conf
@@ -65,6 +67,8 @@ spec:
               subPath: db-init.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: gnocchi-etc
           secret:
             secretName: gnocchi-etc

gnocchi/templates/job-db-sync.yaml

@@ -41,6 +41,8 @@ spec:
           command:
             - /tmp/ceph-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: gnocchi-bin
@@ -58,6 +60,8 @@ spec:
           command:
             - /tmp/db-sync.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: gnocchi-etc
               mountPath: /etc/gnocchi/gnocchi.conf
               subPath: gnocchi.conf
@@ -75,6 +79,8 @@ spec:
               subPath: key
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: gnocchi-etc
           secret:
             secretName: gnocchi-etc

gnocchi/templates/job-storage-init.yaml

@@ -71,6 +71,8 @@ spec:
           command:
             - /tmp/ceph-admin-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: gnocchi-bin
@@ -101,6 +103,8 @@ spec:
           command:
             - /tmp/storage-init.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: gnocchi-bin
               mountPath: /tmp/storage-init.sh
               subPath: storage-init.sh
@@ -116,6 +120,8 @@ spec:
               subPath: key
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: gnocchi-bin
           configMap:
             name: gnocchi-bin

gnocchi/templates/pod-gnocchi-test.yaml

@@ -59,6 +59,8 @@ spec:
       command:
         - /tmp/gnocchi-test.sh
       volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
         - name: gnocchi-etc
           mountPath: /etc/gnocchi/gnocchi.conf
           subPath: gnocchi.conf
@@ -69,6 +71,8 @@ spec:
           readOnly: true
 {{ if $mounts_gnocchi_tests.volumeMounts }}{{ toYaml $mounts_gnocchi_tests.volumeMounts | indent 8 }}{{ end }}
   volumes:
+    - name: pod-tmp
+      emptyDir: {}
     - name: gnocchi-etc
       secret:
         secretName: gnocchi-etc

grafana/templates/deployment.yaml

@@ -82,6 +82,8 @@ spec:
             - name: PROMETHEUS_URL
               value: {{ tuple "monitoring" "internal" "api" $envAll | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: pod-etc-grafana
               mountPath: /etc/grafana
             - name: pod-provisioning-grafana
@@ -111,6 +113,8 @@ spec:
             {{- end }}
 {{ if $mounts_grafana.volumeMounts }}{{ toYaml $mounts_grafana.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-grafana
           emptyDir: {}
         - name: pod-provisioning-grafana

grafana/templates/job-db-init-session.yaml

@@ -56,11 +56,15 @@ spec:
           command:
             - /tmp/db-init.py
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: grafana-bin
               mountPath: /tmp/db-init.py
               subPath: db-init.py
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: grafana-bin
           configMap:
             name: grafana-bin

grafana/templates/job-db-init.yaml

@@ -56,11 +56,15 @@ spec:
           command:
             - /tmp/db-init.py
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: grafana-bin
               mountPath: /tmp/db-init.py
               subPath: db-init.py
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: grafana-bin
           configMap:
             name: grafana-bin

grafana/templates/job-db-session-sync.yaml

@@ -51,11 +51,15 @@ spec:
           command:
             - /tmp/db-session-sync.py
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: grafana-bin
               mountPath: /tmp/db-session-sync.py
               subPath: db-session-sync.py
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: grafana-bin
           configMap:
             name: grafana-bin

grafana/templates/job-set-admin-user.yaml

@@ -58,6 +58,8 @@ spec:
                   name: grafana-admin-creds
                   key: GRAFANA_ADMIN_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: grafana-etc
               mountPath: /etc/grafana/grafana.ini
               subPath: grafana.ini
@@ -66,6 +68,8 @@ spec:
               subPath: set-admin-password.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-grafana
           emptyDir: {}
         - name: grafana-bin

grafana/templates/pod-helm-tests.yaml

@@ -59,11 +59,15 @@ spec:
         - name: GRAFANA_ENDPOINT
           value: {{ tuple "grafana" "internal" "grafana" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
       volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
         - name: grafana-bin
           mountPath: /tmp/helm-tests.sh
           subPath: helm-tests.sh
           readOnly: true
   volumes:
+    - name: pod-tmp
+      emptyDir: {}
     - name: grafana-bin
       configMap:
         name: grafana-bin

helm-toolkit/templates/manifests/_job-bootstrap.tpl

@@ -67,6 +67,8 @@ spec:
           command:
             - /tmp/bootstrap.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: bootstrap-sh
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
@@ -85,6 +87,8 @@ spec:
 {{ $podVolMounts | toYaml | indent 12 }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: bootstrap-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-db-drop-mysql.tpl

@@ -88,6 +88,8 @@ spec:
           command:
             - /tmp/db-drop.py
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: db-drop-sh
               mountPath: /tmp/db-drop.py
               subPath: db-drop.py
@@ -106,6 +108,8 @@ spec:
 {{- end }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: db-drop-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-db-init-mysql.tpl

@@ -85,6 +85,8 @@ spec:
           command:
             - /tmp/db-init.py
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: db-init-sh
               mountPath: /tmp/db-init.py
               subPath: db-init.py
@@ -103,6 +105,8 @@ spec:
 {{- end }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: db-init-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-db-sync.tpl

@@ -63,6 +63,8 @@ spec:
           command:
             - /tmp/db-sync.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: db-sync-sh
               mountPath: /tmp/db-sync.sh
               subPath: db-sync.sh
@@ -81,6 +83,8 @@ spec:
 {{ $podVolMounts | toYaml | indent 12 }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: db-sync-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-ks-endpoints.tpl

@@ -56,6 +56,8 @@ spec:
           command:
             - /tmp/ks-endpoints.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ks-endpoints-sh
               mountPath: /tmp/ks-endpoints.sh
               subPath: ks-endpoints.sh
@@ -75,6 +77,8 @@ spec:
 {{- end }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ks-endpoints-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-ks-service.tpl

@@ -55,6 +55,8 @@ spec:
           command:
             - /tmp/ks-service.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ks-service-sh
               mountPath: /tmp/ks-service.sh
               subPath: ks-service.sh
@@ -69,6 +71,8 @@ spec:
               value: {{ $osServiceType | quote }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ks-service-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-ks-user.yaml.tpl

@@ -54,6 +54,8 @@ spec:
           command:
             - /tmp/ks-user.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ks-user-sh
               mountPath: /tmp/ks-user.sh
               subPath: ks-user.sh
@@ -75,6 +77,8 @@ spec:
               value: {{ $serviceOsRoles | quote }}
             {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ks-user-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-rabbit-init.yaml.tpl

@@ -49,6 +49,8 @@ spec:
           command:
             - /tmp/rabbit-init.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: rabbit-init-sh
               mountPath: /tmp/rabbit-init.sh
               subPath: rabbit-init.sh
@@ -69,6 +71,8 @@ spec:
             value: {{ toJson $envAll.Values.conf.rabbitmq | quote }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: rabbit-init-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-s3-bucket.yaml.tpl

@@ -71,6 +71,8 @@ spec:
             - name: RGW_PROTO
               value: {{ tuple "ceph_object_store" "internal" "api" $envAll | include "helm-toolkit.endpoints.keystone_endpoint_scheme_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: s3-bucket-sh
               mountPath: /tmp/create-s3-bucket.sh
               subPath: create-s3-bucket.sh
@@ -88,6 +90,8 @@ spec:
               readOnly: true
             {{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: s3-bucket-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job-s3-user.yaml.tpl

@@ -55,6 +55,8 @@ spec:
           command:
             - /tmp/ceph-admin-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: ceph-keyring-sh
@@ -84,6 +86,8 @@ spec:
             - name: RGW_HOST
               value: {{ tuple "ceph_object_store" "internal" "api" $envAll | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: create-s3-user-sh
               mountPath: /tmp/create-s3-user.sh
               subPath: create-s3-user.sh
@@ -101,6 +105,8 @@ spec:
               readOnly: true
             {{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: create-s3-user-sh
           configMap:
             name: {{ $configMapBin | quote }}

helm-toolkit/templates/manifests/_job_image_repo_sync.tpl

@@ -60,6 +60,8 @@ spec:
           command:
             - /tmp/image-repo-sync.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: bootstrap-sh
               mountPath: /tmp/image-repo-sync.sh
               subPath: image-repo-sync.sh
@@ -70,6 +72,8 @@ spec:
 {{ $podVolMounts | toYaml | indent 12 }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: bootstrap-sh
           configMap:
             name: {{ $configMapBin | quote }}

ingress/templates/deployment-error.yaml

@@ -75,13 +75,17 @@ spec:
                   - /tmp/ingress-error-pages.sh
                   - stop
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ingress-bin
               mountPath: /tmp/ingress-error-pages.sh
               subPath: ingress-error-pages.sh
               readOnly: true
       volumes:
-      - name: ingress-bin
+        - name: pod-tmp
-        configMap:
+          emptyDir: {}
-          name: ingress-bin
+        - name: ingress-bin
-          defaultMode: 0555
+          configMap:
+            name: ingress-bin
+            defaultMode: 0555
 {{- end }}

ingress/templates/deployment-ingress.yaml

@@ -208,6 +208,8 @@ spec:
             - /tmp/ingress-vip.sh
             - kernel_modules
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ingress-bin
               mountPath: /tmp/ingress-vip.sh
               subPath: ingress-vip.sh
@@ -228,6 +230,8 @@ spec:
             - /tmp/ingress-vip.sh
             - start
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ingress-bin
               mountPath: /tmp/ingress-vip.sh
               subPath: ingress-vip.sh
@@ -304,6 +308,8 @@ spec:
                   - /tmp/ingress-controller.sh
                   - stop
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ingress-bin
               mountPath: /tmp/ingress-controller.sh
               subPath: ingress-controller.sh
@@ -329,6 +335,8 @@ spec:
                   - /tmp/ingress-vip.sh
                   - stop
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ingress-bin
               mountPath: /tmp/ingress-vip.sh
               subPath: ingress-vip.sh
@@ -345,6 +353,8 @@ spec:
 {{- end }}
 {{- end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: ingress-bin
           configMap:
             name: ingress-bin

kibana/templates/deployment.yaml

@@ -79,6 +79,8 @@ spec:
                   name: {{ $esUserSecret }}
                   key: ELASTICSEARCH_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: kibana-bin
               mountPath: /tmp/apache.sh
               subPath: apache.sh
@@ -110,6 +112,8 @@ spec:
                   name: {{ $esUserSecret }}
                   key: ELASTICSEARCH_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: kibana-bin
               mountPath: /tmp/kibana.sh
               subPath: kibana.sh
@@ -121,6 +125,8 @@ spec:
               subPath: kibana.yml
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-etc-kibana
           emptyDir: {}
         - name: kibana-bin

kibana/templates/job-register-kibana-indexes.yaml

@@ -56,11 +56,15 @@ spec:
           command:
             - /tmp/create_kibana_index_patterns.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: kibana-bin
               mountPath: /tmp/create_kibana_index_patterns.sh
               subPath: create_kibana_index_patterns.sh
               readOnly: false
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: kibana-bin
           configMap:
             name: kibana-bin

kube-dns/templates/deployment-kube-dns.yaml

@@ -105,6 +105,8 @@ spec:
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - mountPath: /kube-dns-config
               name: kube-dns-config
         - name: dnsmasq
@@ -145,6 +147,8 @@ spec:
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - mountPath: /etc/k8s/dns/dnsmasq-nanny
               name: kube-dns-config
         - name: sidecar
@@ -187,9 +191,11 @@ spec:
       - effect: NoSchedule
         key: node-role.kubernetes.io/master
       volumes:
-      - configMap:
+        - name: pod-tmp
-          defaultMode: 420
+          emptyDir: {}
-          name: kube-dns
+        - configMap:
-          optional: true
+            defaultMode: 420
-        name: kube-dns-config
+            name: kube-dns
+            optional: true
+          name: kube-dns-config
 {{- end }}

kubernetes-keystone-webhook/templates/deployment.yaml

@@ -57,6 +57,8 @@ spec:
             - name: k8sksauth-pub
               containerPort: {{ tuple "kubernetes_keystone_webhook" "internal" "api" $envAll | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etc-kubernetes-keystone-webhook
               mountPath: /etc/kubernetes-keystone-webhook
             - name: key-kubernetes-keystone-webhook
@@ -76,6 +78,8 @@ spec:
               subPath: start.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: etc-kubernetes-keystone-webhook
           emptyDir: {}
         - name: key-kubernetes-keystone-webhook

kubernetes-keystone-webhook/templates/pod-test.yaml

@@ -49,12 +49,16 @@ spec:
       command:
         - /tmp/kubernetes-keystone-webhook-test.sh
       volumeMounts:
+        - name: pod-tmp
+          mountPath: /tmp
         - name: kubernetes-keystone-webhook-bin
           mountPath: /tmp/kubernetes-keystone-webhook-test.sh
           subPath: kubernetes-keystone-webhook-test.sh
           readOnly: true
 {{ if $mounts_kubernetes_keystone_webhook_tests.volumeMounts }}{{ toYaml $mounts_kubernetes_keystone_webhook_tests.volumeMounts | indent 8 }}{{ end }}
   volumes:
+    - name: pod-tmp
+      emptyDir: {}
     - name: kubernetes-keystone-webhook-bin
       configMap:
         name: kubernetes-keystone-webhook-bin

ldap/templates/statefulset.yaml

@@ -62,12 +62,16 @@ spec:
           ports:
             - containerPort: {{ tuple "ldap" "internal" "ldap" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ldap-data
               mountPath: /var/lib/ldap
             - name: ldap-config
               mountPath: /etc/ldap/slapd.d
-{{- if not .Values.storage.pvc.enabled }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
+{{- if not .Values.storage.pvc.enabled }}
         - name: ldap-data
           hostPath:
             path: {{ .Values.storage.host.data_path }}
@@ -76,21 +80,21 @@ spec:
             path: {{ .Values.storage.host.config_path }}
 {{- else }}
   volumeClaimTemplates:
-  - metadata:
+    - metadata:
-      name: ldap-data
+        name: ldap-data
-    spec:
+      spec:
-      accessModes: [ "ReadWriteOnce" ]
+        accessModes: [ "ReadWriteOnce" ]
-      storageClassName: {{ .Values.storage.pvc.class_name }}
+        storageClassName: {{ .Values.storage.pvc.class_name }}
-      resources:
+        resources:
-        requests:
+          requests:
-          storage: {{ .Values.storage.pvc.size }}
+            storage: {{ .Values.storage.pvc.size }}
-  - metadata:
+    - metadata:
-      name: ldap-config
+        name: ldap-config
-    spec:
+      spec:
-      accessModes: [ "ReadWriteOnce" ]
+        accessModes: [ "ReadWriteOnce" ]
-      storageClassName: {{ .Values.storage.pvc.class_name }}
+        storageClassName: {{ .Values.storage.pvc.class_name }}
-      resources:
+        resources:
-        requests:
+          requests:
-          storage: {{ .Values.storage.pvc.size }}
+            storage: {{ .Values.storage.pvc.size }}
 {{- end }}
 {{- end }}

libvirt/templates/daemonset-libvirt.yaml

@@ -67,6 +67,8 @@ spec:
           command:
             - /tmp/ceph-admin-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: libvirt-bin
@@ -96,6 +98,8 @@ spec:
           command:
             - /tmp/ceph-keyring.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: etcceph
               mountPath: /etc/ceph
             - name: libvirt-bin
@@ -148,6 +152,8 @@ spec:
                   - |-
                     kill $(cat /var/run/libvirtd.pid)
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: libvirt-bin
               mountPath: /tmp/libvirt.sh
               subPath: libvirt.sh
@@ -201,6 +207,8 @@ spec:
             {{- end }}
 {{ if $mounts_libvirt.volumeMounts }}{{ toYaml $mounts_libvirt.volumeMounts | indent 12 }}{{ end }}
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: libvirt-bin
           configMap:
             name: libvirt-bin

mariadb/templates/cron-job-backup-mariadb.yaml

@@ -48,53 +48,57 @@ spec:
           initContainers:
 {{ tuple $envAll "mariadb_backup" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 10 }}
           containers:
-          - command:
+            - name: mariadb-backup
-            - /tmp/backup_mariadb.sh
+              command:
-            env:
+                - /tmp/backup_mariadb.sh
-            - name: MARIADB_BACKUP_BASE_DIR
+              env:
-              value: {{ .Values.conf.backup.base_path | quote }}
+                - name: MARIADB_BACKUP_BASE_DIR
-            - name: MYSQL_BACKUP_MYSQLDUMP_OPTIONS
+                  value: {{ .Values.conf.backup.base_path | quote }}
-              value: {{ .Values.conf.backup.mysqldump_options | quote }}
+                - name: MYSQL_BACKUP_MYSQLDUMP_OPTIONS
-            - name: MARIADB_BACKUP_DAYS_TO_KEEP
+                  value: {{ .Values.conf.backup.mysqldump_options | quote }}
-              value: {{ .Values.conf.backup.days_of_backup_to_keep | quote }}
+                - name: MARIADB_BACKUP_DAYS_TO_KEEP
-            - name: MARIADB_POD_NAMESPACE
+                  value: {{ .Values.conf.backup.days_of_backup_to_keep | quote }}
-              valueFrom:
+                - name: MARIADB_POD_NAMESPACE
-                fieldRef:
+                  valueFrom:
-                  fieldPath: metadata.namespace
+                    fieldRef:
-{{ tuple $envAll "mariadb_backup" | include "helm-toolkit.snippets.image" | indent 12 }}
+                      fieldPath: metadata.namespace
-{{ tuple $envAll $envAll.Values.pod.resources.jobs.mariadb_backup | include "helm-toolkit.snippets.kubernetes_resources" | indent 12 }}
+{{ tuple $envAll "mariadb_backup" | include "helm-toolkit.snippets.image" | indent 14 }}
-            name: mariadb-backup
+{{ tuple $envAll $envAll.Values.pod.resources.jobs.mariadb_backup | include "helm-toolkit.snippets.kubernetes_resources" | indent 14 }}
-            volumeMounts:
+              volumeMounts:
-            - mountPath: /tmp/backup_mariadb.sh
+                - name: pod-tmp
-              name: mariadb-bin
+                  mountPath: /tmp
-              readOnly: true
+                - mountPath: /tmp/backup_mariadb.sh
-              subPath: backup_mariadb.sh
+                  name: mariadb-bin
-            - mountPath: {{ .Values.conf.backup.base_path }}
+                  readOnly: true
-              name: mariadb-backup-dir
+                  subPath: backup_mariadb.sh
-            - name: mariadb-secrets
+                - mountPath: {{ .Values.conf.backup.base_path }}
-              mountPath: /etc/mysql/admin_user.cnf
+                  name: mariadb-backup-dir
-              subPath: admin_user.cnf
+                - name: mariadb-secrets
-              readOnly: true
+                  mountPath: /etc/mysql/admin_user.cnf
+                  subPath: admin_user.cnf
+                  readOnly: true
           restartPolicy: OnFailure
           serviceAccount: {{ $serviceAccountName }}
           serviceAccountName: {{ $serviceAccountName }}
           volumes:
-          - name: mariadb-secrets
+            - name: pod-tmp
-            secret:
+              emptyDir: {}
-              secretName: mariadb-secrets
+            - name: mariadb-secrets
-              defaultMode: 384
+              secret:
-          - configMap:
+                secretName: mariadb-secrets
-              defaultMode: 365
+                defaultMode: 384
+            - configMap:
+                defaultMode: 365
+                name: mariadb-bin
               name: mariadb-bin
-            name: mariadb-bin
+            {{- if and .Values.volume.backup.enabled  .Values.manifests.pvc_backup }}
-          {{- if and .Values.volume.backup.enabled  .Values.manifests.pvc_backup }}
+            - name: mariadb-backup-dir
-          - name: mariadb-backup-dir
+              persistentVolumeClaim:
-            persistentVolumeClaim:
+                claimName: mariadb-backup-data
-              claimName: mariadb-backup-data
+            {{- else }}
-          {{- else }}
+            - hostPath:
-          - hostPath:
+                path: {{ .Values.conf.backup.base_path }}
-              path: {{ .Values.conf.backup.base_path }}
+                type: DirectoryOrCreate
-              type: DirectoryOrCreate
+              name: mariadb-backup-dir
-            name: mariadb-backup-dir
+            {{- end }}
-          {{- end }}
 {{- end }}

mariadb/templates/deployment-error.yaml

@@ -77,13 +77,17 @@ spec:
                   - /tmp/mariadb-ingress-error-pages.sh
                   - stop
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: ingress-bin
               mountPath: /tmp/mariadb-ingress-error-pages.sh
               subPath: mariadb-ingress-error-pages.sh
               readOnly: true
       volumes:
-      - name: ingress-bin
+        - name: pod-tmp
-        configMap:
+          emptyDir: {}
-          name: mariadb-bin
+        - name: ingress-bin
-          defaultMode: 0555
+          configMap:
+            name: mariadb-bin
+            defaultMode: 0555
 {{- end }}

mariadb/templates/deployment-ingress.yaml

@@ -188,6 +188,8 @@ spec:
                   - /tmp/mariadb-ingress-controller.sh
                   - stop
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: mariadb-bin
               mountPath: /tmp/mariadb-ingress-controller.sh
               subPath: mariadb-ingress-controller.sh
@@ -197,6 +199,8 @@ spec:
               subPath: nginx.tmpl
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: mariadb-bin
           configMap:
             name: mariadb-bin

mariadb/templates/monitoring/prometheus/exporter-deployment.yaml

@@ -82,6 +82,8 @@ spec:
             - name: TELEMETRY_PATH
               value: {{ tuple "prometheus_mysql_exporter" "internal" "metrics" . | include "helm-toolkit.endpoints.keystone_endpoint_path_lookup" | quote }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: mysql-exporter-secrets
               mountPath: /etc/mysql/mysql_user.cnf
               subPath: mysql_user.cnf
@@ -91,6 +93,8 @@ spec:
               subPath: mysqld-exporter.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: mysql-exporter-secrets
           secret:
             secretName: mysql-exporter-secrets

mariadb/templates/monitoring/prometheus/exporter-job-create-user.yaml

@@ -59,6 +59,8 @@ spec:
                   name: mysql-exporter-secrets
                   key: EXPORTER_PASSWORD
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: mysql-exporter-bin
               mountPath: /tmp/create-mysql-user.sh
               subPath: create-mysql-user.sh
@@ -68,6 +70,8 @@ spec:
               subPath: admin_user.cnf
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: mysql-exporter-bin
           configMap:
             name: mysql-exporter-bin

mariadb/templates/pod-test.yaml

@@ -46,7 +46,7 @@ spec:
       command:
         - /tmp/test.sh
       volumeMounts:
-        - name: tmp
+        - name: pod-tmp
           mountPath: /tmp
         - name: mariadb-bin
           mountPath: /tmp/test.sh
@@ -63,7 +63,7 @@ spec:
           {{ end }}
           readOnly: true
   volumes:
-    - name: tmp
+    - name: pod-tmp
       emptyDir: {}
     - name: mariadb-bin
       configMap:

mariadb/templates/statefulset.yaml

@@ -115,6 +115,8 @@ spec:
             - "mysql:mysql"
             - /var/lib/mysql
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: mysql-data
               mountPath: /var/lib/mysql
 {{- end }}
@@ -176,7 +178,7 @@ spec:
               command:
                 - /tmp/readiness.sh
           volumeMounts:
-            - name: tmp
+            - name: pod-tmp
               mountPath: /tmp
             - name: var-run
               mountPath: /var/run/mysqld
@@ -217,9 +219,9 @@ spec:
             - name: mysql-data
               mountPath: /var/lib/mysql
       volumes:
-        - name: mycnfd
+        - name: pod-tmp
           emptyDir: {}
-        - name: tmp
+        - name: mycnfd
           emptyDir: {}
         - name: var-run
           emptyDir: {}

memcached/templates/deployment.yaml

@@ -76,11 +76,15 @@ spec:
             tcpSocket:
               port: {{ tuple "oslo_cache" "internal" "memcache" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: memcached-bin
               mountPath: /tmp/memcached.sh
               subPath: memcached.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: memcached-bin
           configMap:
             name: {{ $configMapBinName | quote }}

memcached/templates/monitoring/prometheus/exporter-deployment.yaml

@@ -64,11 +64,15 @@ spec:
           - name: MEMCACHED_HOST
             value: {{ tuple "oslo_cache" "internal" "memcache" . | include "helm-toolkit.endpoints.host_and_port_endpoint_uri_lookup" }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: memcached-exporter-bin
               mountPath: /tmp/memcached-exporter.sh
               subPath: memcached-exporter.sh
               readOnly: true
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: memcached-exporter-bin
           configMap:
             name: {{ $configMapBinName | quote }}

mongodb/templates/statefulset.yaml

@@ -61,6 +61,8 @@ spec:
             - "mongodb:"
             - {{ $envAll.Values.volume.host.host_path }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: mongodb-data
               mountPath: {{ $envAll.Values.volume.host.host_path }}
 {{- end }}
@@ -100,6 +102,8 @@ spec:
             timeoutSeconds: 5
 {{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: mongodb-bin
               mountPath: /tmp/start.sh
               subPath: start.sh
@@ -111,24 +115,26 @@ spec:
             - name: mongodb-data
               mountPath: /data/db
       volumes:
-      - name: mongodb-bin
+        - name: pod-tmp
-        configMap:
+          emptyDir: {}
-          name: mongodb-bin
+        - name: mongodb-bin
-          defaultMode: 0555
+          configMap:
+            name: mongodb-bin
+            defaultMode: 0555
 {{- if not .Values.volume.enabled }}
-      - name: mongodb-data
+        - name: mongodb-data
-        hostPath:
+          hostPath:
-          path: {{ .Values.volume.host_path }}
+            path: {{ .Values.volume.host_path }}
 {{- else }}
   volumeClaimTemplates:
-  - metadata:
+    - metadata:
-      name: mongodb-data
+        name: mongodb-data
-      annotations:
+        annotations:
-        {{ .Values.volume.class_path }}: {{ .Values.volume.class_name }}
+          {{ .Values.volume.class_path }}: {{ .Values.volume.class_name }}
-    spec:
+      spec:
-      accessModes: [ "ReadWriteOnce" ]
+        accessModes: [ "ReadWriteOnce" ]
-      resources:
+        resources:
-        requests:
+          requests:
-          storage: {{ .Values.volume.size }}
+            storage: {{ .Values.volume.size }}
 {{- end }}
 {{- end }}

nagios/templates/deployment.yaml

@@ -122,6 +122,8 @@ spec:
                   name: {{ $nagiosUserSecret }}
                   key: NAGIOSADMIN_PASS
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: nagios-bin
               mountPath: /tmp/apache.sh
               subPath: apache.sh
@@ -174,6 +176,8 @@ spec:
                   name: {{ $nagiosUserSecret }}
                   key: NAGIOSADMIN_PASS
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: nagios-etc
               mountPath: /opt/nagios/etc/nagios.cfg
               subPath: nagios.cfg
@@ -199,6 +203,8 @@ spec:
             - name: pod-var-log
               mountPath: /opt/nagios/var/log
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: pod-var-log
           emptyDir: {}
         - name: nagios-etc

nfs-provisioner/templates/deployment.yaml

@@ -159,9 +159,13 @@ spec:
             {{- end }}
             - "-grace-period=10"
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: export-volume
               mountPath: /export
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: export-volume
           {{- if eq .Values.storage.type "persistentVolumeClaim" }}
           persistentVolumeClaim:

openvswitch/templates/daemonset-ovs-db.yaml

@@ -82,6 +82,8 @@ spec:
                   - /tmp/openvswitch-db-server.sh
                   - stop
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: openvswitch-bin
               mountPath: /tmp/openvswitch-db-server.sh
               subPath: openvswitch-db-server.sh
@@ -91,6 +93,8 @@ spec:
             - name: run
               mountPath: /run
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: openvswitch-bin
           configMap:
             name: openvswitch-bin

openvswitch/templates/daemonset-ovs-vswitchd.yaml

@@ -59,6 +59,8 @@ spec:
           command:
             - /tmp/openvswitch-vswitchd-init-modules.sh
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: openvswitch-bin
               mountPath: /tmp/openvswitch-vswitchd-init-modules.sh
               subPath: openvswitch-vswitchd-init-modules.sh
@@ -100,6 +102,8 @@ spec:
                   - /tmp/openvswitch-db-server.sh
                   - stop
           volumeMounts:
+            - name: pod-tmp
+              mountPath: /tmp
             - name: openvswitch-bin
               mountPath: /tmp/openvswitch-vswitchd.sh
               subPath: openvswitch-vswitchd.sh
@@ -107,6 +111,8 @@ spec:
             - name: run
               mountPath: /run
       volumes:
+        - name: pod-tmp
+          emptyDir: {}
         - name: openvswitch-bin
           configMap:
             name: openvswitch-bin