[lfrancke]

Description

Part of stackabletech/issues#903

Sets a restricted security context on the operator Deployment (runAsNonRoot, the RuntimeDefault seccomp profile, allowPrivilegeEscalation: false, all capabilities dropped) plus a read-only root filesystem, and updates the defaults in values.schema.json to match.

The security context is the same one I already did for commons-operator: stackabletech/commons-operator#462
It was approved over there already and more details linked there. Not repeating all of that here.

The read-only root filesystem works because file logs are the only thing an operator writes, and those moved to an emptyDir under /var/log with stackabletech/operator-templating#656.

Users can still override all of this.

Note

When this is merged I'll have CLaude open all the remaining ones.

Definition of Done Checklist

Author

• Changes are OpenShift compatible
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)

Reviewer

• Code contains useful comments
• Changelog updated

Acceptance

• Proper release label has been added
• Release note snippet added

[sbernauer]

LGTM, but stackabletech/commons-operator#462 also has a changelog entry, which is missing here.
I think we should also set readOnlyRootFilesystem on commons-operator

[lfrancke]

Yes, commons-operator will get a followup to have the readOnlyRootFilesystem. Nick and I decided during that PR that it makes sense to tackle that.

And changelog: Good catch. I'll add it here.

[lfrancke]

Added the changelog entry. When this is approved I'll put up the remaining PRs.