Solutions related to Kyverno policies

[tmachnicki]

Client who is using Pega helm charts has been asking about some Kyverno policies. They want to know if they can make root filesystem read-only. Additionally - they have some environment variables which have values from some Kubernetes secrets. They need to mount these secrets as volumes. They would like to use "pegaVolumeCredentials" from _helpers.tpl inside the helm chart but they are not sure if there is a way to make them variables or use them inside context.xml.

I've checked the documentation and discussed internally and my understanding is that when it comes to the first question on making root filesystem read-only - this is a custom solution and it may work if they set up the temp and log directories with volume mounts but such a customized configuration is not officially supported at this point. Regarding the second question this is again a customization.

Client is suggesting to implement this as an enhancement request.