From 541dd5e4c84fa92d3d7d46c8423b11165970812a Mon Sep 17 00:00:00 2001
From: Chever John <cheverjonathan@gmail.com>
Date: Thu, 18 Jun 2026 09:29:18 +0800
Subject: [PATCH] fix: write envsubst output to /tmp to avoid read-only
 ConfigMap mount

The entrypoint.sh was writing the rendered config back to the same
directory as the source, which fails when the config is mounted from
a Kubernetes ConfigMap (read-only filesystem). Write to /tmp instead.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 deploy/entrypoint.sh | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/deploy/entrypoint.sh b/deploy/entrypoint.sh
index 66709c4..6690195 100755
--- a/deploy/entrypoint.sh
+++ b/deploy/entrypoint.sh
@@ -4,24 +4,25 @@
 #
 # The YAML file is treated as a template with ${VAR} placeholders.
 # envsubst replaces them with actual environment variable values at container start time.
+# The rendered config is written to /tmp to avoid read-only filesystem issues (e.g. ConfigMap mounts).
 
 set -e
 
 BINARY="$1"
 shift
 
-CONFIG_FILE=""
+# Scan args for -f <config> and render to /tmp
+ARGS=""
+PREV=""
 for arg in "$@"; do
-    case "$prev" in
-        -f) CONFIG_FILE="$arg" ;;
-    esac
-    prev="$arg"
+    if [ "$PREV" = "-f" ] && [ -f "$arg" ]; then
+        RENDERED="/tmp/$(basename "$arg")"
+        envsubst < "$arg" > "$RENDERED"
+        ARGS="$ARGS $RENDERED"
+    else
+        ARGS="$ARGS $arg"
+    fi
+    PREV="$arg"
 done
 
-if [ -n "$CONFIG_FILE" ] && [ -f "$CONFIG_FILE" ]; then
-    # Replace ${VAR} placeholders with environment variable values
-    envsubst < "$CONFIG_FILE" > "${CONFIG_FILE}.tmp"
-    mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"
-fi
-
-exec "$BINARY" "$@"
+exec "$BINARY" $ARGS