Set readOnlyRootFilesystem as true in Controllers and Webhook

Setting readOnlyRootFilesystem to increase the security and to avoid being flagged by scanner.
tektoncd · Jul 11, 2024 · d56c192 · d56c192
1 parent 0f6c973
commit d56c192
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/config/controller.yaml b/config/controller.yaml
@@ -112,6 +112,7 @@ spec:
           value: tekton.dev/pipeline
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"

diff --git a/config/events.yaml b/config/events.yaml
@@ -90,6 +90,7 @@ spec:
           value: /etc/ssl/certs
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"

diff --git a/config/webhook.yaml b/config/webhook.yaml
@@ -126,6 +126,7 @@ spec:
           value: tekton.dev/pipeline
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"