Immutable Deployment #
Create Namespace #
# Create a new namespace for the deployment
kubectl create ns example-namespace
Deployment Manifest #
In this deployment, the container will have an immutable root filesystem, with the exception of the /tmp directory, which remains writable.
# Create manifest for the deployment
vi immutable-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: immutable-deployment
namespace: example-namespace
labels:
app: some-pod
spec:
replicas: 1
selector:
matchLabels:
app: some-pod
template:
metadata:
labels:
app: some-pod
spec:
containers:
- name: busybox
image: busybox:latest
command: ['sh', '-c', 'tail -f /dev/null']
imagePullPolicy: IfNotPresent
securityContext:
readOnlyRootFilesystem: true
volumeMounts:
- name: tmp-volume
mountPath: /tmp
volumes:
- name: tmp-volume
emptyDir: {}
restartPolicy: Always
# Deploy the manifest
kubectl apply -f immutable-deployment.yaml
Deployment details:
-
command: ['sh', '-c', 'tail -f /dev/null']Keeps the container alive by running an infinite tail on “/dev/null” -
readOnlyRootFilesystem: trueSet the container root filesystem to “read-only” -
The “emptyDir” volume type only exists as long as the Pod exists, but it allows data written to /tmp to be modified by processes within the container
Verify the Deployment #
# List all resources in the "example-namespace" namespace with the label "app=some-pod"
kubectl get all -l app=some-pod -n example-namespace
# Shell output:
NAME READY STATUS RESTARTS AGE
pod/immutable-deployment-96b948b78-6x6v4 1/1 Running 0 37s
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/immutable-deployment 1/1 1 1 37s
NAME DESIRED CURRENT READY AGE
replicaset.apps/immutable-deployment-96b948b78 1 1 1 37s
Verify the Immutable Filesystem #
# Access the busybox container terminal
kubectl exec -it immutable-deployment-96b948b78-6x6v4 -n example-namespace -- sh
Verify the “/tmp” directory is writeable:
# Create file
touch /tmp/file1
# List files
ls /tmp
# Shell output:
file1
Verify the root filesystem is read-only:
# Create file
touch /var/file1
# Shell output:
touch: /var/file1: Read-only file system
Exit the container terminal:
exit
Delete the Deployment #
kubectl delete -f immutable-deployment.yaml