Merge pull request #454 from rivkyrizel/MGMT-22200

openshift-merge-bot[bot] · web-flow · commit 73013929d89a · 2025-12-01T09:30:36.000Z
MGMT-22200: Add readOnlyRootFilesystem security constrain in CAPI providers
diff --git a/bootstrap-components.yaml b/bootstrap-components.yaml
@@ -812,6 +812,7 @@ spec:
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
         volumeMounts:
         - mountPath: /tmp/k8s-webhook-server/serving-certs/
           name: certs
diff --git a/bootstrap/config/manager/manager.yaml b/bootstrap/config/manager/manager.yaml
@@ -35,6 +35,7 @@ spec:
                 fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"
diff --git a/controlplane-components.yaml b/controlplane-components.yaml
@@ -944,6 +944,7 @@ spec:
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
       securityContext:
         runAsNonRoot: true
       serviceAccountName: capoa-controlplane-controller-manager
diff --git a/controlplane/config/manager/manager.yaml b/controlplane/config/manager/manager.yaml
@@ -30,6 +30,7 @@ spec:
         name: manager
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"
diff --git a/test/e2e/manifests/capboa/bootstrap_install.yaml b/test/e2e/manifests/capboa/bootstrap_install.yaml
@@ -812,6 +812,7 @@ spec:
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
         volumeMounts:
         - mountPath: /tmp/k8s-webhook-server/serving-certs/
           name: certs
diff --git a/test/e2e/manifests/capcoa/controlplane_install.yaml b/test/e2e/manifests/capcoa/controlplane_install.yaml
@@ -944,6 +944,7 @@ spec:
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
       securityContext:
         runAsNonRoot: true
       serviceAccountName: capoa-controlplane-controller-manager
