prometheus: enable readOnlyRootFilesystem

charts/sourcegraph/templates/prometheus/prometheus.Deployment.yaml

@@ -47,12 +47,24 @@ spec:
       - name: prometheus
         image: {{ include "sourcegraph.image" (list . "prometheus") }}
         imagePullPolicy: {{ .Values.sourcegraph.image.pullPolicy }}
+        # Seed the Alertmanager config from the baked-in default on first start
+        # so it works with readOnlyRootFilesystem. prom-wrapper then rewrites this
+        # file in place whenever site config changes (see ALERTMANAGER_CONFIG_PATH).
+        command:
+        - /bin/sh
+        - -c
+        - |
+          cp -n /sg_config_prometheus/alertmanager.yml /alertmanager/alertmanager.yml
+          exec /usr/bin/prom-wrapper "$@"
+        - prom-wrapper
         {{- with .Values.prometheus.args }}
         args:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         terminationMessagePolicy: FallbackToLogsOnError
         env:
+        - name: ALERTMANAGER_CONFIG_PATH
+          value: /alertmanager/alertmanager.yml
         {{- range $name, $item := .Values.prometheus.env}}
         - name: {{ $name }}
           {{- $item | toYaml | nindent 10 }}
@@ -72,6 +84,9 @@ spec:
           name: data
         - mountPath: /sg_prometheus_add_ons
           name: config
+        - mountPath: /alertmanager
+          name: data
+          subPath: alertmanager
         {{- if .Values.prometheus.extraVolumeMounts }}
         {{- toYaml .Values.prometheus.extraVolumeMounts | nindent 8 }}
         {{- end }}

charts/sourcegraph/values.yaml

@@ -906,8 +906,6 @@ prometheus:
     allowPrivilegeEscalation: false
     runAsUser: 100
     runAsGroup: 100
-    # Read-only filesystem not supported for the prometheus container,
-    # see [sourcegraph/issues/34012](https://github.com/sourcegraph/sourcegraph/issues/34012) for more information
     readOnlyRootFilesystem: false
   # -- Name used by resources. Does not affect service names or PVCs.
   name: "prometheus"