From 966d30c655f89f7f57bc09910be947f909577f2d Mon Sep 17 00:00:00 2001
From: "Christoph Engelbert (noctarius)" <me@noctarius.com>
Date: Wed, 15 Jul 2026 11:32:32 +0200
Subject: [PATCH] The helm chart had the webhook-cert mount missing. On systems
 without writtable /tmp, cert creation will fail otherwise.

---
 .../templates/simplyblock-operator.yaml           | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/helm-charts/charts/simplyblock-operator/templates/simplyblock-operator.yaml b/helm-charts/charts/simplyblock-operator/templates/simplyblock-operator.yaml
index c4238ff7..4c07eddf 100644
--- a/helm-charts/charts/simplyblock-operator/templates/simplyblock-operator.yaml
+++ b/helm-charts/charts/simplyblock-operator/templates/simplyblock-operator.yaml
@@ -72,10 +72,15 @@ spec:
             readOnlyRootFilesystem: true
             allowPrivilegeEscalation: false
             privileged: false
-          {{- if .Values.tls.enabled }}
           volumeMounts:
+            # The webhook serving cert is written at runtime to controller-runtime's
+            # default location under /tmp. With readOnlyRootFilesystem the root fs
+            # (including /tmp) is read-only, so this must be a writable volume.
+            - mountPath: /tmp/k8s-webhook-server/serving-certs
+              name: webhook-certs
+            {{- if .Values.tls.enabled }}
             {{- include "simplyblock.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /healthz
@@ -88,10 +93,12 @@ spec:
               port: 8081
             initialDelaySeconds: 5
             periodSeconds: 10
-      {{- if .Values.tls.enabled }}
       volumes:
+        - name: webhook-certs
+          emptyDir: {}
+        {{- if .Values.tls.enabled }}
         {{- include "simplyblock.clientTlsVolume" (dict "ctx" . "clientSecret" "simplyblock-operator-client-tls") | nindent 8 }}
-      {{- end }}
+        {{- end }}
       terminationGracePeriodSeconds: 10
 
 ################# ROLE AND ROLE BINDING ##############################