Enable readOnlyRootFilesystem for operator controller

Author: lunarwhite

bundle/manifests/cert-manager-operator.clusterserviceversion.yaml

@@ -693,15 +693,22 @@ spec:
                     drop:
                     - ALL
                   privileged: false
+                  readOnlyRootFilesystem: true
                   runAsNonRoot: true
                   seccompProfile:
                     type: RuntimeDefault
+                volumeMounts:
+                - mountPath: /tmp
+                  name: tmp
               securityContext:
                 runAsNonRoot: true
                 seccompProfile:
                   type: RuntimeDefault
               serviceAccountName: cert-manager-operator-controller-manager
               terminationGracePeriodSeconds: 10
+              volumes:
+              - emptyDir: {}
+                name: tmp
       permissions:
       - rules:
         - apiGroups:

config/manager/manager.yaml

@@ -105,6 +105,7 @@ spec:
                 - 'ALL'
             privileged: false
             runAsNonRoot: true
+            readOnlyRootFilesystem: true
             seccompProfile:
               type: 'RuntimeDefault'
           ports:
@@ -115,5 +116,11 @@ spec:
             requests:
               cpu: 10m
               memory: 32Mi
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10
+      volumes:
+        - name: tmp
+          emptyDir: {}