Set readOnlyRootFilesystem as true in Controller and Webhook

Setting Controller's Deployment security context readOnlyRootFilesystem to true to increase the security and to avoid being flagged by the security scanner.
tektoncd · Jul 3, 2024 · dd5ea60 · dd5ea60
1 parent 9bc3dd0
commit dd5ea60
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/config/controller.yaml b/config/controller.yaml
@@ -104,6 +104,7 @@ spec:
               value: config-leader-election-triggers-controllers
           securityContext:
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
             capabilities:
               drop:
                 - "ALL"

diff --git a/config/webhook.yaml b/config/webhook.yaml
@@ -76,6 +76,7 @@ spec:
               containerPort: 8443
           securityContext:
             allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
             # User 65532 is the distroless nonroot user ID
             runAsUser: 65532
             runAsGroup: 65532