feat: Add GKE CEL policy compliance for readOnlyRootFilesystem and em… #63
Conversation
…ptyDir sizeLimit This commit adds support for two common GKE CEL policy requirements: 1. require-readonly-root-filesystem: - Added readOnlyRootFilesystem: true to all container security contexts - Added allowPrivilegeEscalation: false - Dropped all capabilities - Added /tmp volume mounts with sizeLimit for writable temporary storage 2. require-emptydir-sizelimit: - Added configurable sizeLimit for emptyDir volumes - cache-volume: 50Gi (configurable via values.yaml) - tmp-volume: 1Gi (hardcoded) Changes: - braintrust/values.yaml: Added security contexts and volume configurations - templates/api-deployment.yaml: Added security context and tmp volume support - templates/brainstore-reader-deployment.yaml: Added security context, tmp volume, and sizeLimit - templates/brainstore-writer-deployment.yaml: Added security context, tmp volume, and sizeLimit All changes are backward compatible and configurable through values.yaml. Tested and verified on GKE Autopilot cluster.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c7002c23b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| emptyDir: | ||
| {{- if .Values.api.tmpVolume.sizeLimit }} | ||
| sizeLimit: {{ .Values.api.tmpVolume.sizeLimit | quote }} |
There was a problem hiding this comment.
If api.tmpVolume.enabled is true and api.tmpVolume.sizeLimit is set to an empty value, this block renders emptyDir: without any fields, which becomes null instead of an object. Kubernetes treats that as no volume source, so the pod spec is rejected with a volume-type validation error. Please keep an explicit empty object fallback (for example emptyDir: {}) when no sizeLimit is provided; the same templating pattern is also used in the reader/writer deployments.
Useful? React with 👍 / 👎.
When api.tmpVolume.sizeLimit (or brainstore.reader/writer.volume.sizeLimit)
is not set, the emptyDir field was rendering as null instead of an empty
object, causing Kubernetes to reject the pod spec with a volume-type
validation error.
This change ensures emptyDir always renders as a valid object by adding
an explicit empty object fallback ({}) when sizeLimit is not provided.
Files modified:
- api-deployment.yaml
- brainstore-reader-deployment.yaml
- brainstore-writer-deployment.yaml
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
1 participant
…ptyDir sizeLimit
This commit adds support for two common GKE CEL policy requirements:
require-readonly-root-filesystem:
require-emptydir-sizelimit:
Changes:
All changes are backward compatible and configurable through values.yaml. Tested and verified on GKE Autopilot cluster.