readOnlyRootFilesystem=true

[JSlater743]

For security and compliance reasons we are trying to run keda with readOnlyRootFilesystem enabled
FAQs say the following:

We are struggling to understand why the metrics service needs this certificate? Can anyone please explain, or point to more detailed documentation in this area.

Thanks

[zroubalik]

It's for secured communication between the KEDA Metrics Server and Kuberentes apiserver

[ygnr]

Is there a guide or example on how to generate and pass the certificates? @zroubalik
@JSlater743 Have you made it work?

[JSlater743]

hi @ygnr, no we have not found a way to do this. If you find some instructions could you please let me know. Thank you

[ygnr]

@JSlater743 Made it work with similar to what you mentioned above. I saw that certificates are created in the folder /apiserver.local.config/certificates/ so I set the mount path as that folder, like this

--set volumes.metricsApiServer.extraVolumes[0].name=keda-volume
--set volumes.metricsApiServer.extraVolumeMounts[0].name=keda-volume
--set volumes.metricsApiServer.extraVolumeMounts[0].mountPath=/apiserver.local.config/certificates/

and then set the readOnlyRootFilesystem to true on securityContext of metricServer

[zroubalik]

Sorry I have been very busy and missed this, that's correct, you need to mount a volume with certs.

@ygnr would be awesome if you can open a PR to KEDA doc repo with this info, so other users can benefit

[JSlater743]

@ygnr Awesome!! that works :-) . Thank you

[joebowbeer]

Summarizing:

The FAQ answer says you can’t run KEDA with readOnlyRootFilesystem=true unless you create your own cert and configure metrics server to use it.

However it is possible to run KEDA with readOnlyRootFilesystem=true simply by creating an emptyDir volume (default type) and mounting it to the path where, by default, metrics server writes its generated cert:

/apiserver.local.config/certificates/

The helm command is:

helm install keda kedacore/keda --namespace keda \
  --set 'volumes.metricsApiServer.extraVolumes[0].name=keda-volume' \
  --set 'volumes.metricsApiServer.extraVolumeMounts[0].name=keda-volume' \
  --set 'volumes.metricsApiServer.extraVolumeMounts[0].mountPath=/apiserver.local.config/certificates/' \
  --set 'securityContext.metricServer.readOnlyRootFilesystem=true'

PR to improve FAQ answer: kedacore/keda-docs#830

[joebowbeer]

Answered?

https://keda.sh/docs/2.15/reference/faq/#how-do-i-run-keda-with-readonlyrootfilesystemtrue