after apply of rbdplugin daemonset and deployment cephcsi tries to write keyring on a read-only /etc/ceph which has a configmap mounted on

[carlosaml500]

Describe the bug

on a clean install on Openshift, csi-rbdplugin and csi-rbdplugin-provisioner the cephcsi returns error trying to write keyring on /etc/ceph with a configmap mounted
A clear and concise description of what the bug is.
after apply of rbdplugin daemonset and deployment cephcsi tries to write keyring on a read-only /etc/ceph which has a configmap mounted on

Environment details

• Image/version of Ceph CSI driver :
• Helm chart version : not used, just used templates
• Kernel version : N/A
• Mounter used for mounting PVC (for cephFS its fuse or kernel. for rbd its
  krbd or rbd-nbd) : N/A
• Kubernetes cluster version : 1.32 (under OCP 4.20)
• Ceph cluster version : 17.2.8

Steps to reproduce

Steps to reproduce the behavior:

1. Setup details: applied using templates
2. Deployment to trigger the issue oc apply -f csi-rbdplugin.yaml ; oc apply -f csi-rbdplugin-provisioner.yaml
3. See error: F0307 04:14:48.391716 2616501 cephcsi.go:242] failed to write ceph configuration file (open /etc/ceph/keyring: read-only file system)

Actual results

did workaround, mounted emptyDir instead of ceph-config configmap on ceph-config (= /etc/ceph)
Describe what happened
after workaround provisioners started normal and I was able to add storageclass.

Expected behavior

a question: why the image tries to write on a configmap (read-only) ?
A clear and concise description of what you expected to happen.
daemonset and deployment of rbdplugin should start normally without need to edit.

Logs

F0307 04:14:48.391716 2616501 cephcsi.go:242] failed to write ceph configuration file (open /etc/ceph/keyring: read-only file system)

Any existing bug report which describe about the similar issue/behavior
#6162

[Madhu-1]

@carlosaml500 we dont have nice documentation for using this on openshift, you need to create

ceph-csi/deploy/scc.yaml

Line 29 in f766911

readOnlyRootFilesystem: false

SCC to allow this one.

[carlosaml500]

Thanks for the answer, I will test and share results.
Meanwhile, a question: what is the impact of emptyDir on /etc/ceph ?

[carlosaml500]

The error persists:

I0428 09:51:42.126906 1 cephcsi.go:207] Driver version: v3.16-canary and Git version: 29fc2f4
F0428 09:51:42.126991 1 cephcsi.go:245] failed to write ceph configuration file (open /etc/ceph/keyring: read-only file system)

because there is a configmap ceph-config mounted on the ceph-config volume, and by design, Kubernetes ConfigMaps mounted as volumes are read-only and cannot be made directly writable within a container. Attempting to modify these files directly will result in a "read-only file system" error because they are backed by the Kubernetes API.
The only solution for now id turn it into emptyDir on the files.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.