<p>I have a <code>.net core</code> application which is dockerized and running in Kubernetes cluster (AKS).</p>
<p>I want to apply securityContext <code>readOnlyRootFilesystem = true</code> to satisfy the requirement <code>Immutable (read-only) root filesystem should be enforced for containers</code>.</p>
<blockquote>
<p>securityContext:
privileged: false
readOnlyRootFilesystem: true</p>
</blockquote>
<p>For <code>.net core app</code> I want to read TLS certificate and want to add into POD/Container's certificate store and to do this in startup I have below code,</p>
<pre><code>var cert = new X509Certificate2(Convert.FromBase64String(File.ReadAllText(Environment.GetEnvironmentVariable(&quot;cert_path&quot;))));
                AddCertificate(cert, StoreName.Root);
</code></pre>
<p>The problem is when I set <code>readOnlyRootFilesystem = true</code>, I am getting below error from the app,</p>
<blockquote>
<p>EXCEPTION: System.Security.Cryptography.CryptographicException: The X509 certificate could not be added to the store.
---&gt; System.IO.IOException: Read-only file system
at System.IO.FileSystem.CreateDirectory(String fullPath)</p>
</blockquote>
<p>It's saying for read only file system I can't add certificate. Is there a way to overcome this problem?</p>
<p><strong>Update</strong></p>
<p>If I set <code>emptyDir: {}</code>, I am getting below error? Where I can add it?</p>
<p><code>spec.template.spec.volumes[0].csi: Forbidden: may not specify more than 1 volume type</code></p>
<pre><code>          volumeMounts:
        - name: secrets-store
          mountPath: /app/certs
      securityContext:
        privileged: false
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        runAsNonRoot: true
        runAsUser: 1000   
  volumes:
  - name: secrets-store
    emptyDir: {}
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: azure-kvname
</code></pre>

<p>At the location you have defined as the path of the cert store, attach a volume that is not read-only. If you only want that data to last as long as the pod exists, an <a href="https://kubernetes.io/docs/concepts/storage/volumes/#emptydir" rel="nofollow noreferrer">emptyDir</a> type volume will fit the bill nicely.</p>
<p>For example, if you are creating pods with a deployment like this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: ct
  name: ct
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ct
  template:
    metadata:
      labels:
        app: ct
    spec:
      containers:
      - image: myapp
        name: myapp
        env:
        - name: cert_path
          value: /etc/certstore
        securityContext:
          readOnlyRootFilesystem: true
</code></pre>
<p>You could set up the emptyDir as follows:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: ct
  name: ct
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ct
  template:
    metadata:
      labels:
        app: ct
    spec:
      containers:
      - image: myapp
        name: myapp
        env:
        - name: cert_path
          value: /etc/certstore
        securityContext:
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /etc/certstore
          name: certstore
      volumes:
      - name: certstore
        emptyDir: {}
</code></pre>
<p>Other types of volumes would work as well. If you wanted to persist these certificates as your pods are cycled, then a persistentVolumeClaim could be used to get you a persistent volume.</p>
<p>The emptyDir won't be read-only, but the rest of the container's root filesystem will be, which should satisfy your security requirement.</p>
