[SHOT-216] feat: Add generic extra volumes to self-host hook/job and mssql pods

charts/self-host/README.md

@@ -285,6 +285,48 @@ component:
 
 You can override the image repository for any component.
 
+#### Extra Volumes
+
+Every long-running service under `component.<name>` accepts `extraVolumeMounts` (added to the container) and `extraVolumes` (added to the pod). The pre-/post-install hook and job pods share a single `jobs.extraVolumeMounts` / `jobs.extraVolumes` pair, and the database (MSSQL) pod uses `database.extraVolumeMounts` / `database.extraVolumes`. All default to `[]`, so leaving them unset changes nothing.
+
+This is useful for hardened deployments that set `readOnlyRootFilesystem: true`, where containers need writable scratch space (typically `/tmp`) mounted as an `emptyDir`. Supply the volume where it is needed instead of patching the chart:
+
+```yaml
+# Writable /tmp for the hardened app containers
+component:
+  api:
+    securityContext:
+      readOnlyRootFilesystem: true
+    extraVolumeMounts:
+      - name: tmp
+        mountPath: /tmp
+    extraVolumes:
+      - name: tmp
+        emptyDir: {}
+
+# Writable /tmp for every pre-/post-install hook and job pod
+jobs:
+  securityContext:
+    readOnlyRootFilesystem: true
+  extraVolumeMounts:
+    - name: tmp
+      mountPath: /tmp
+  extraVolumes:
+    - name: tmp
+      emptyDir: {}
+
+# Writable scratch for the MSSQL pod
+database:
+  extraVolumeMounts:
+    - name: mssql-secrets
+      mountPath: /var/opt/mssql/secrets
+  extraVolumes:
+    - name: mssql-secrets
+      emptyDir: {}
+```
+
+`extraVolumes` accepts any Kubernetes volume source (`emptyDir`, `configMap`, `secret`, `persistentVolumeClaim`, `csi`, etc.), and each `extraVolumeMounts` entry must reference a volume `name` defined in the corresponding `extraVolumes` list.
+
 #### Raw Manifests Files
 
 This chart allows you to include other Kubernetes manifest files either pre- or post-install. To do this, update the `rawManifests` section of the chart

charts/self-host/templates/mssql.yaml

@@ -104,6 +104,9 @@ spec:
               mountPath: "/mnt/secrets-store"
               readOnly: true
             {{- end }}
+            {{- with .Values.database.extraVolumeMounts }}
+{{ toYaml . | indent 12 }}
+            {{- end }}
           livenessProbe:
             tcpSocket:
               port: mssql
@@ -148,6 +151,9 @@ spec:
             volumeAttributes:
               secretProviderClass: {{ .Values.secrets.secretProviderClass }}
         {{- end }}
+        {{- with .Values.database.extraVolumes }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
 
 ---
 kind: Service

charts/self-host/templates/post-delete-hook.yaml

@@ -83,5 +83,13 @@ spec:
         resources:
           {{- toYaml .Values.jobs.cleanup.resources | nindent 10 }}
         {{- end }}
+        {{- with .Values.jobs.extraVolumeMounts }}
+        volumeMounts:
+{{ toYaml . | indent 8 }}
+        {{- end }}
       restartPolicy: Never
+      {{- with .Values.jobs.extraVolumes }}
+      volumes:
+{{ toYaml . | indent 6 }}
+      {{- end }}
 {{- end }}

charts/self-host/templates/post-install-db-migrator-job.yaml

@@ -98,6 +98,9 @@ spec:
           - name: mssql-data
             mountPath: /db
           {{- end }}
+          {{- with .Values.jobs.extraVolumeMounts }}
+{{ toYaml . | indent 10 }}
+          {{- end }}
       containers:
       - name: migrate-db
         env:
@@ -129,6 +132,9 @@ spec:
           mountPath: "/mnt/secrets-store"
           readOnly: true
         {{- end }}
+        {{- with .Values.jobs.extraVolumeMounts }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
         {{- if or ( not .Values.database.enabled ) ( and .Values.database.enabled .Release.IsUpgrade ) }}
         args: [ "-f", "DbScripts_transition", "-r"]
         {{- end }}
@@ -149,4 +155,7 @@ spec:
             volumeAttributes:
               secretProviderClass: {{ .Values.secrets.secretProviderClass }}
         {{- end }}
+        {{- with .Values.jobs.extraVolumes }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
 {{- end }}

charts/self-host/templates/pre-install-db-migrator-job.yaml

@@ -94,6 +94,9 @@ spec:
           mountPath: "/mnt/secrets-store"
           readOnly: true
         {{- end }}
+        {{- with .Values.jobs.extraVolumeMounts }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
       restartPolicy: Never
       volumes:
         - name: migrator-extract-dir
@@ -106,4 +109,7 @@ spec:
             volumeAttributes:
               secretProviderClass: {{ .Values.secrets.secretProviderClass }}
         {{- end }}
+        {{- with .Values.jobs.extraVolumes }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
 {{- end }}

charts/self-host/templates/pre-install-job.yaml

@@ -90,6 +90,9 @@ spec:
         volumeMounts:
         - name: temp
           mountPath: "/bitwarden"
+        {{- with .Values.jobs.extraVolumeMounts }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
 {{- end }}
       containers:
       - name: create-resources
@@ -117,9 +120,15 @@ spec:
         volumeMounts:
         - name: temp
           mountPath: "/bitwarden"
+        {{- with .Values.jobs.extraVolumeMounts }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
       restartPolicy: Never
       volumes:
         - name: temp
           emptyDir:
             medium: Memory
+        {{- with .Values.jobs.extraVolumes }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
 {{- end }}

charts/self-host/templates/pre-install-secret-sql.yaml

@@ -93,6 +93,9 @@ spec:
           mountPath: "/mnt/secrets-store"
           readOnly: true
         {{- end }}
+        {{- with .Values.jobs.extraVolumeMounts }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
       restartPolicy: Never
       volumes:
         - name: temp
@@ -106,4 +109,7 @@ spec:
             volumeAttributes:
               secretProviderClass: {{ .Values.secrets.secretProviderClass }}
         {{- end }}
+        {{- with .Values.jobs.extraVolumes }}
+{{ toYaml . | indent 8 }}
+        {{- end }}
 {{- end }}