feat: Run the operator with a read-only root filesystem

CHANGELOG.md

@@ -16,6 +16,7 @@ All notable changes to this project will be documented in this file.
 - Bump stackable-operator to 0.121.0 ([#466]).
 - Extend Helm deployed RBAC permissions to list and watch customresourcedefinitions required for startup condition ([#461]).
 - The operator Deployment runs with a restricted security context, so it can be deployed into namespaces that enforce the `restricted` Pod Security Standard ([#462]).
+- The operator Deployment runs with a read-only root filesystem ([#469]).
 
 ### Fixed
 
@@ -30,6 +31,7 @@ All notable changes to this project will be documented in this file.
 [#461]: https://github.com/stackabletech/commons-operator/pull/461
 [#462]: https://github.com/stackabletech/commons-operator/pull/462
 [#466]: https://github.com/stackabletech/commons-operator/pull/466
+[#469]: https://github.com/stackabletech/commons-operator/pull/469
 
 ## [26.7.0] - 2026-07-21
 

deploy/helm/commons-operator/values.schema.json

@@ -127,7 +127,8 @@
           "drop": [
             "ALL"
           ]
-        }
+        },
+        "readOnlyRootFilesystem": true
       }
     },
     "resources": {
@@ -272,14 +273,14 @@
         },
         "fileLog": {
           "title": "File logs",
-          "description": "Writes logs to /stackable/logs inside the container.",
+          "description": "Writes logs to /var/log/commons-operator inside the container, on an emptyDir volume.",
           "type": "object",
           "additionalProperties": false,
           "properties": {
             "enabled": {
               "type": "boolean",
               "default": false,
-              "description": "Whether the operator also writes logs to /stackable/logs inside the container. Off by default: it needs a volume to be useful, otherwise the logs vanish with the pod."
+              "description": "Whether the operator also writes logs to /var/log/commons-operator inside the container. Off by default. The logs survive container restarts but not the Pod."
             },
             "level": {
               "title": "File log level",

deploy/helm/commons-operator/values.yaml

@@ -44,6 +44,9 @@ securityContext:
   capabilities:
     drop:
       - ALL
+  # Not part of the restricted profile.
+  # Anything the operator writes has to go to a mounted volume.
+  readOnlyRootFilesystem: true
 
 resources:
   limits: