Set readOnlyRootFilesystem for deployments to true

Signed-off-by: David Kwon <[email protected]>

Author: dkwon17

deploy/bundle/manifests/devworkspace-operator.clusterserviceversion.yaml

@@ -51,6 +51,8 @@ spec:
             requests:
               cpu: 250m
               memory: 100Mi
+          securityContext:
+            readOnlyRootFilesystem: true
           env:
             - name: WATCH_NAMESPACE
               value: ""

deploy/deployment/kubernetes/combined.yaml

@@ -187,6 +187,9 @@ func getSpecDeployment(webhooksSecretName, namespace string) (*appsv1.Deployment
 									Name: "WATCH_NAMESPACE",
 								},
 							},
+							SecurityContext: &corev1.SecurityContext{
+								ReadOnlyRootFilesystem: pointer.Bool(true),
+							},
 						},
 					},
 					RestartPolicy:                 "Always",