VULN-53954 and VULN-53956: Added to enforce a read-only root filesystem and configured the containers to mount to use a temporary place for writing files with emptyDir volume (which acts as a tmpfs) to /tmp.

[jcatera-splunk]

Key Changes Made:

• securityContext.readOnlyRootFilesystem: true: - This directly addresses the vulnerability report. It ensures that the container cannot modify any files in its root filesystem. If a process attempts to write to a directory that isn't explicitly mounted as writable, the operation will fail.

• volumeMounts and volumes: - I added an emptyDir volume named tmp-storage. I mounted this volume at /tmp. This provides the container with a writable space for temporary files (using the node's storage or RAM) without compromising the security of the entire container image.

Additional Hardening (Recommended):

• runAsNonRoot: true: - Ensures the container does not run with root privileges.
• allowPrivilegeEscalation: false: - Prevents a process from gaining more privileges than its parent process.

Added default user to prevent the container running as root: runAsUser: 1001