I have a kubernetes tomcat deployment and with property readOnlyRootFilesystem: true which prohibits me from modifying server.xml file. But I need to use a random shutdown port every time the tomcat starts as per our security practice.

To achieve that, I set an tomcat java variable shutdown string inside catalina.sh

SHUTDOWN_STRING=$(openssl rand -base64 29 | tr -d "=+/1234567890" | cut -c1-8) CATALINA_OPTS="$CATALINA_OPTS -DSHUTDOWN_STR=$SHUTDOWN_STRING"

and then use it in my server.xml file as shutdown="${SHUTDOWN_STR}"

The problem is that it generates a random string everytime the catalina.sh script runs and so while stopping it overwrites the random sting generated while start and I get an error that
Invalid shutdown command abcdEGFS received and when I see my tomcat process, -DSHUTDOWN_STR=nbgyhgEF

So I put the CATALINA_OPTS inside start block

elif [ "$1" = "start" ] ; then

SHUTDOWN_STRING=$(openssl rand -base64 29 | tr -d "=+/1234567890" | cut -c1-8) CATALINA_OPTS="$CATALINA_OPTS -DSHUTDOWN_STR=$SHUTDOWN_STRING"

but in this case even though I see that in my tomcat process the variable gets set as -DSHUTDOWN_STR=FGtrFvhg while stopping I get an error that
Invalid shutdown command [${SHUTDOWN_STR}] received.