Unable to install Helm chart in rootless/read-only mode due to cache folder permissions issue

[interone-ms]

For compliance reasons we are running in rootless and read-only rootfs mode, with this values.yaml (chart 9.10.1):

cachePersistence:
  enabled: true
containerSecurityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 12021
  runAsGroup: 12021
  fsGroup: 12021
  supplementalGroups:
    - 12021
  seccompProfile:
    type: "RuntimeDefault"

Renovate fails to start with ENOENT:

{"name":"mend-renovate","hostname":"renovate-ce-mend-renovate-ce-674fd5c7d7-x5ntd","pid":8,"level":60,"logContext":"6n4G-AKU9j64b9Q6BX2cQ","err":{"errno":-2,"code":"ENOENT","syscall":"mkdir","path":"/tmp/renovate-ee/","message":"ENOENT: no such file or directory, mkdir '/tmp/renovate-ee/'","stack":"Error: ENOENT: no such file or directory, mkdir '/tmp/renovate-ee/'\n    at Object.mkdirSync (node:fs:1364:26)\n    at module.exports.makeDirSync (/usr/src/mend/node_modules/fs-extra/lib/mkdirs/make-dir.js:23:13)\n    at rt.validate (file:///usr/src/mend/src/community.js:1:16895)\n    at rt.init (file:///usr/src/mend/src/community.js:1:7934)\n    at xs (file:///usr/src/mend/src/community.js:5:83677)\n    at file:///usr/src/mend/src/community.js:5:95234\n    at file:///usr/src/mend/src/community.js:5:95240\n    at ModuleJob.run (node:internal/modules/esm/module_job:274:25)\n    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:644:26)\n    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:116:5)"},"msg":"Failure initializing Renovate community edition - exiting...","time":"2025-05-06T12:49:34.170Z","v":0}

The cause seems to be that the chart creates and mounts /tmp/renovate, whereas Renovate tries to create (and use) /tmp/renovate-ee/ which is covered by readOnlyRootFilesystem.

[Gabriel-Ladzaretti]

disable the cache volume via:

• renovate-ce-ee/helm-charts/mend-renovate-ce/values.yaml

  Line 224 in a18add1

  disableCacheVolume: false

+
in order for the ro file system to work you need to also mount both /tmp and /opt/contianerbase

e.g,

  extraVolumes:
    - name: mend-renovate-containerbase-volume
      emptyDir: { }
    - name: mend-renovate-cache-volume
      emptyDir: { }

  extraVolumeMounts:
    - name: mend-renovate-containerbase-volume
      mountPath: /opt/containerbase
    - name: mend-renovate-cache-volume
      mountPath: /tmp