Merge "readOnlyRootFilesystem: true for Calico chart"

calico/templates/daemonset-calico-etcd.yaml

@@ -50,6 +50,8 @@ spec:
         # a failure.  This annotation works in tandem with the toleration below.
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
+      securityContext:
+        readOnlyRootFilesystem: true
       serviceAccountName: {{ $serviceAccountName }}
       tolerations:
         # This taint is set by all kubelets running `--cloud-provider=external`

calico/templates/daemonset-calico-node.yaml

@@ -118,6 +118,8 @@ spec:
 {{ tuple $prometheus_annotations | include "helm-toolkit.snippets.prometheus_pod_annotations" | indent 8 }}
 {{- end }}
     spec:
+      securityContext:
+        readOnlyRootFilesystem: true
       nodeSelector:
         beta.kubernetes.io/os: linux
       hostNetwork: true

calico/templates/deployment-calico-kube-controllers.yaml

@@ -92,6 +92,8 @@ spec:
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
     spec:
+      securityContext:
+        readOnlyRootFilesystem: true
       nodeSelector:
         beta.kubernetes.io/os: linux
       # The controllers must run in the host network namespace so that