K8SPG-1053 make PMM sidecar work with readOnlyRootFilesystem#1639
Open
hors wants to merge 2 commits into
Open
Conversation
The pmm-agent config (pmm-agent.yaml) was written to the container root filesystem, so the sidecar failed on pods enforcing readOnlyRootFilesystem: true (e.g. OpenShift): Config file /usr/local/percona/pmm/config/pmm-agent.yaml is not writable: read-only file system. The config is stateless — pmm-agent regenerates it on every start (PMM_AGENT_SETUP_FORCE=1) — so from crVersion 3.1.0 relocate it to the writable /tmp/pmm path (inside the /tmp emptyDir already mounted into the sidecar) for both PMM2 and PMM3, and align the PMM2 tempdir to /tmp/pmm. Older crVersions keep the previous paths to avoid changing running pods.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the PMM sidecar container configuration so that the pmm-agent.yaml file is written to a writable location (/tmp/pmm) when readOnlyRootFilesystem: true is enforced, while preserving legacy paths for older CR versions.
Changes:
- Added version-gated helpers to select a writable PMM agent config path and (for PMM2) an aligned temp directory starting from CR version
3.1.0. - Updated PMM2 and PMM3 sidecar environment variables to use the new config path logic (and PMM2 tempdir logic).
- Extended/unit-updated tests to validate the new config path behavior and updated expected env var values.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
percona/pmm/pmm.go |
Introduces version-based selection of PMM_AGENT_CONFIG_FILE (and PMM2 tempdir) to support read-only root filesystems. |
percona/pmm/pmm_test.go |
Adds coverage for config path selection and updates expected env var values for PMM sidecars. |
egegunes
previously approved these changes
Jun 15, 2026
egegunes
left a comment
Contributor
There was a problem hiding this comment.
LGTM but please check monitoring tests
Collaborator
commit: 808852d |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pmm-agent config (pmm-agent.yaml) was written to the container root filesystem, so the sidecar failed on pods enforcing readOnlyRootFilesystem: true (e.g. OpenShift):
Config file /usr/local/percona/pmm/config/pmm-agent.yaml is not writable: read-only file system.
The config is stateless — pmm-agent regenerates it on every start (PMM_AGENT_SETUP_FORCE=1) — so from crVersion 3.1.0 relocate it to the writable /tmp/pmm path (inside the /tmp emptyDir already mounted into the sidecar) for both PMM2 and PMM3, and align the PMM2 tempdir to /tmp/pmm. Older crVersions keep the previous paths to avoid changing running pods.
CHECKLIST
Jira
Needs Doc) and QA (Needs QA)?Tests
Config/Logging/Testability