config: set readOnlyRootFilesystem on Database container

readOnlyRootFilesystem prevents writing to any part of the
container’s root filesystem, not just the root directory (/)

Signed-off-by: Shiv Verma <shverma@redhat.com>

Author: pratap0007

config/00-init/03-db-deployment.yaml

@@ -49,6 +49,7 @@ spec:
               protocol: TCP
           securityContext:
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
             runAsUser: 65532
             capabilities:
               drop:
@@ -74,6 +75,10 @@ spec:
           volumeMounts:
             - name: tekton-hub-db
               mountPath: /var/lib/postgresql/data
+            - name: pg-run
+              mountPath: /var/run/postgresql
+            - name: pg-tmp
+              mountPath: /tmp
           readinessProbe:
             exec:
               command: [bash, -c, "psql -w -U ${POSTGRES_USER} -d ${POSTGRES_DB} -c 'SELECT 1'"]
@@ -90,4 +95,8 @@ spec:
         - name: tekton-hub-db
           persistentVolumeClaim:
             claimName: tekton-hub-db
+        - name: pg-run
+          emptyDir: {}
+        - name: pg-tmp
+          emptyDir: {}
       restartPolicy: Always