From 010517ca4d77895e7b4b11582e13c8d75cd60b81 Mon Sep 17 00:00:00 2001 From: Martin Schuppert Date: Fri, 31 Jul 2026 07:58:29 +0200 Subject: [PATCH] Set readOnlyRootFilesystem on service operator controller-manager containers Harden the manager container securityContext by adding readOnlyRootFilesystem: true and dropping ALL capabilities. Mount an emptyDir at /tmp to support controller-runtime cert auto-generation and Go stdlib temporary file needs. Co-Authored-By: Claude Opus 4.6 Signed-off-by: Martin Schuppert --- bindata/operator/managers.yaml | 8 ++++++++ config/operator/managers.yaml | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/bindata/operator/managers.yaml b/bindata/operator/managers.yaml index e892da757c..08f26dd3cb 100644 --- a/bindata/operator/managers.yaml +++ b/bindata/operator/managers.yaml @@ -67,7 +67,13 @@ spec: memory: {{ .Deployment.Manager.Resources.Requests.Memory }} securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + readOnlyRootFilesystem: true volumeMounts: + - mountPath: /tmp + name: tmp {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }} - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert @@ -99,6 +105,8 @@ spec: {{- end }} {{- end }} volumes: + - emptyDir: {} + name: tmp {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }} - name: cert secret: diff --git a/config/operator/managers.yaml b/config/operator/managers.yaml index e892da757c..08f26dd3cb 100644 --- a/config/operator/managers.yaml +++ b/config/operator/managers.yaml @@ -67,7 +67,13 @@ spec: memory: {{ .Deployment.Manager.Resources.Requests.Memory }} securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - "ALL" + readOnlyRootFilesystem: true volumeMounts: + - mountPath: /tmp + name: tmp {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }} - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert @@ -99,6 +105,8 @@ spec: {{- end }} {{- end }} volumes: + - emptyDir: {} + name: tmp {{- if isEnvVarTrue .Deployment.Manager.Env "ENABLE_WEBHOOKS" }} - name: cert secret: