NFS and readOnlyRootFilesystem

Cluster information:

Kubernetes version: v1.21.3
Cloud being used: (put bare-metal if not on a public cloud): bare-metal
Installation method: kubeadm
Host OS: Ubuntu 20.04
CNI and version:

cilium-cli: v0.8.5 compiled with go1.16.5 on linux/amd64
cilium image (default): v1.10.2
cilium image (stable): v1.10.4

CRI and version: Containerd 1.5.2-0ubuntu1~20.04.3

The problem

Hi there,

I’m having some odd issues with NFS and readOnlyRootFilesystem. Whenever readOnlyRootFilesystem is set to true, NFS mounts will time out. Longhorn volumes work just fine though. I’ve verified that the NFS server and the requested path work fine.

When I turn readOnlyRootFilesystem to false, the pod will start within seconds, but when it is true, it will fail to start with

│  Warning  FailedMount             51s (x5 over 9m42s)   kubelet                  MountVolume.SetUp failed for volume "transmission-download" : mount failed: exit status 32                                                                                                          │
│Mounting command: mount                                                                                                                                                                                                                                                               │
│Mounting arguments: -t nfs storage-hdd.intern.array21.dev:/storage-pool/transmission /var/lib/kubelet/pods/6ba1db80-7a6e-4315-a684-3157d62774b4/volumes/kubernetes.io~nfs/transmission-download                                                                                       │
│Output: mount.nfs: Connection timed out                                                                                                                                                                                                                                               │
│  Warning  FailedMount  47s (x2 over 5m18s)  kubelet  Unable to attach or mount volumes: unmounted volumes=[transmission-download], unattached volumes=[transmission-data transmission-download]: timed out waiting for the condition

Any advice would be appreciated!

Thanks.