Set readOnlyRootFilesystem as true in Controllers and Webhook

Setting readOnlyRootFilesystem to increase the security and to avoid being flagged by scanner.
tektoncd · May 17, 2024 · 696d6d4 · 696d6d4
1 parent 3dab35e
commit 696d6d4
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/config/controller.yaml b/config/controller.yaml
@@ -112,6 +112,7 @@ spec:
           value: tekton.dev/pipeline
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"

diff --git a/config/events.yaml b/config/events.yaml
@@ -90,6 +90,7 @@ spec:
           value: /etc/ssl/certs
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"

diff --git a/config/webhook.yaml b/config/webhook.yaml
@@ -126,6 +126,7 @@ spec:
           value: tekton.dev/pipeline
         securityContext:
           allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - "ALL"