Update security-context with readOnlyRootFilesystem: true to Mount root filesystem as read-only in Shared Resources containers

config/sharedresource/node_daemonset.yaml

@@ -33,6 +33,7 @@ spec:
             # non-privileged sidecar containers cannot access unix domain socket
             # created by privileged CSI driver container.
             privileged: true
+            readOnlyRootFilesystem: true
           env:
             - name: KUBE_NODE_NAME
               valueFrom:
@@ -74,6 +75,7 @@ spec:
                   fieldPath: spec.nodeName
           securityContext:
             privileged: true
+            readOnlyRootFilesystem: true
           ports:
             - containerPort: 9898
               name: healthz

config/sharedresource/webhook_deployment.yaml

@@ -35,6 +35,8 @@ spec:
             value: ""
           - name: RESERVED_SHARED_SECRET_NAMES
             value: "openshift-etc-pki-entitlement: openshift-config-managed:etc-pki-entitlement"
+        securityContext:
+          readOnlyRootFilesystem: true
         volumeMounts:
         - name: trusted-ca-bundle
           mountPath: /etc/pki/tls/certs/