Merge pull request #809 from TheRealJon/CONSOLE-3791

CONSOLE-3791: Add "readOnlyRootFilesystem" to all console conta…

Author: openshift-merge-bot[bot]

bindata/assets/deployments/console-deployment.yaml

@@ -55,6 +55,7 @@ spec:
                   - "25"
           name: console
           securityContext:
+            readOnlyRootFilesystem: false
             allowPrivilegeEscalation: false
             capabilities:
               drop:

bindata/assets/deployments/downloads-deployment.yaml

@@ -46,6 +46,7 @@ spec:
             failureThreshold: 3
           name: download-server
           securityContext:
+            readOnlyRootFilesystem: false
             allowPrivilegeEscalation: false
             capabilities:
               drop:

manifests/07-operator-ibm-cloud-managed.yaml

@@ -64,6 +64,7 @@ spec:
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/run/configmaps/config
@@ -102,6 +103,7 @@ spec:
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/run/configmaps/config

manifests/07-operator.yaml

@@ -43,6 +43,7 @@ spec:
       containers:
       - name: console-operator
         securityContext:
+          readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
           capabilities:
             drop: ["ALL"]
@@ -92,6 +93,7 @@ spec:
             scheme: HTTPS
       - name: conversion-webhook-server
         securityContext:
+          readOnlyRootFilesystem: true
           allowPrivilegeEscalation: false
           capabilities:
             drop: ["ALL"]

pkg/console/subresource/deployment/deployment_test.go

@@ -1415,6 +1415,7 @@ func TestDefaultDownloadsDeployment(t *testing.T) {
 				},
 				Args: downloadsDeploymentTemplate.Spec.Template.Spec.Containers[0].Args,
 				SecurityContext: &corev1.SecurityContext{
+					ReadOnlyRootFilesystem: utilpointer.Bool(false),
 					Capabilities: &corev1.Capabilities{
 						Drop: []corev1.Capability{
 							"ALL",