From d9eb13c3e6220b24122849680155b47b0deeb446 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Wed, 29 Jul 2026 22:41:34 +1000 Subject: [PATCH] Fix nats-bootstrap: run from /tmp so the nats CLI works under readOnlyRootFS The nats-bootstrap PostSync Job failed at deploy time with "could not load schema ... stat .: permission denied". The nats CLI stats its working directory when loading response-validation schemas, and under the Job's readOnlyRootFilesystem + runAsUser 1000 the image's default WORKDIR is not accessible. Set workingDir: /tmp (the writable emptyDir already mounted for HOME) so the CLI can stat/operate. Verified against the live cluster: a nats-box pod with the exact restrictive securityContext + workingDir: /tmp runs `nats stream info` cleanly. Without this the PostSync hook never completes, so the logging-logging app stays OutOfSync (the LOGS stream/consumers persist in JetStream once created, so log flow is unaffected, but GitOps convergence is blocked). Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv --- apps/base/logging/nats-bootstrap-job.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/base/logging/nats-bootstrap-job.yaml b/apps/base/logging/nats-bootstrap-job.yaml index 5e2fc68..dd27630 100644 --- a/apps/base/logging/nats-bootstrap-job.yaml +++ b/apps/base/logging/nats-bootstrap-job.yaml @@ -59,6 +59,11 @@ spec: containers: - name: nats-bootstrap image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/natsio/nats-box:0.18.0 + # nats CLI stats the working directory when loading its response + # schemas; under readOnlyRootFilesystem + runAsUser 1000 the image's + # default WORKDIR is not accessible ("stat .: permission denied"), so + # run from the writable /tmp emptyDir. + workingDir: /tmp securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true -- 2.47.3