From c5c77e3ef6dddd429724806751867769cb2efd8b Mon Sep 17 00:00:00 2001
From: Tyler Nichols <tyler.n.89@gmail.com>
Date: Thu, 23 Apr 2026 10:22:22 -0700
Subject: [PATCH] Allow passthrough of securityContext.readOnlyRootFilesystem
 in Helm chart (#43332)

## Issue
Closes #43330

## Description
This PR allows self-hosted, Kubernetes-based Fleet users to configure
`securityContext.readOnlyRootFilesystem` in `values.yaml`, which is then
propagated down to the `deployment.yaml` template.

This change provides a convenient mechanism for users to fix a known
issue while preserving the current default behavior.

## Testing
The underlying `deployment.yaml` change has been tested in a standard
Google Kubernetes Engine cluster, and is confirmed to fix the linked
issue when using either Ubuntu-based or Container-Optimized OS
(COS)-based `containerd` container runtimes in GKE.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Chores**
* Enhanced fleet container security by making the read-only root
filesystem setting configurable. Deployments can now customize this
security parameter to meet specific requirements, while secure defaults
are automatically applied for standard installations that don't require
custom configuration.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 charts/fleet/templates/deployment.yaml | 4 ++++
 charts/fleet/values.yaml               | 3 ++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/charts/fleet/templates/deployment.yaml b/charts/fleet/templates/deployment.yaml
index edf681fcb7..04e1ac6cbe 100644
--- a/charts/fleet/templates/deployment.yaml
+++ b/charts/fleet/templates/deployment.yaml
@@ -448,7 +448,11 @@ spec:
           capabilities:
             drop: [ALL]
           privileged: false
+          {{- if hasKey .Values.fleet.securityContext "readOnlyRootFilesystem" }}
+          readOnlyRootFilesystem: {{ .Values.fleet.securityContext.readOnlyRootFilesystem }}
+          {{- else }}
           readOnlyRootFilesystem: true
+          {{- end }}
           {{- if .Values.fleet.securityContext.runAsGroup }}
           runAsGroup: {{ int64 .Values.fleet.securityContext.runAsGroup }}
           {{- end }}
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index 72a405f92f..6311462282 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -125,8 +125,9 @@ fleet:
     licenseKey: license-key
   extraVolumes: []
   extraVolumeMounts: []
-  # Currently only passes runAsNonRoot, runAsUser, runAsGroup
+  # Currently only passes readOnlyRootFilesystem, runAsNonRoot, runAsUser, runAsGroup
   securityContext:
+    readOnlyRootFilesystem: true
     runAsNonRoot: true
     runAsUser: 3333
     runAsGroup: 3333