fix: write envsubst output to /tmp to avoid read-only ConfigMap mount

The entrypoint.sh was writing the rendered config back to the same
directory as the source, which fails when the config is mounted from
a Kubernetes ConfigMap (read-only filesystem). Write to /tmp instead.

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/entrypoint.sh

@@ -4,24 +4,25 @@
 #
 # The YAML file is treated as a template with ${VAR} placeholders.
 # envsubst replaces them with actual environment variable values at container start time.
+# The rendered config is written to /tmp to avoid read-only filesystem issues (e.g. ConfigMap mounts).
 
 set -e
 
 BINARY="$1"
 shift
 
-CONFIG_FILE=""
+# Scan args for -f <config> and render to /tmp
+ARGS=""
+PREV=""
 for arg in "$@"; do
-    case "$prev" in
+    if [ "$PREV" = "-f" ] && [ -f "$arg" ]; then
-        -f) CONFIG_FILE="$arg" ;;
+        RENDERED="/tmp/$(basename "$arg")"
-    esac
+        envsubst < "$arg" > "$RENDERED"
-    prev="$arg"
+        ARGS="$ARGS $RENDERED"
+    else
+        ARGS="$ARGS $arg"
+    fi
+    PREV="$arg"
 done
 
-if [ -n "$CONFIG_FILE" ] && [ -f "$CONFIG_FILE" ]; then
+exec "$BINARY" $ARGS
-    # Replace ${VAR} placeholders with environment variable values
-    envsubst < "$CONFIG_FILE" > "${CONFIG_FILE}.tmp"
-    mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"
-fi
-
-exec "$BINARY" "$@"