NGINX not working with readOnlyRootFilesystem=true about aks-baseline-regulated

[ckittel]

Yeah, you'll have to tune exclusions in your Azure Policy to match the required capabilities of the content running in your cluster. You can consider having both a deny policy, where you know readOnlyRootFilesystem: true is acceptable, and an Audit policy for everything else (the whole cluster). That way you are at least keeping track of those containers that have that setting enabled, and blocking it where it should be blocked.

[ckittel]

Yeah, readOnlyRootFilesystem: true is not compatible with a lot of workloads unfortunately. ASP.NET containers even, as they require filesystem access for buffering events. I'm pretty sure we don't flag the deployment of the controller with a read only root filesystem, do we? Is that something you were experimenting with?

[nitinkhandelwal26]

Thank you @ckittel for your response.
Actually, I am experimenting with this :).
NGINX pods are not provisioning with two policies :
"Rootonlyfilesystem" and "Kubernetes clusters should not allow container privilege escalation".

It works only when I exclude ingress controller namespace from these two policies.

Regards,

[nitinkhandelwal26]

Thanks @ckittel