From b1f0d67799d529b505f528057e78a24036a88bb1 Mon Sep 17 00:00:00 2001
From: Jefferson Ramos <jeramos@redhat.com>
Date: Wed, 19 Aug 2026 17:51:01 -0300
Subject: [PATCH] pkg/agenticrun: set readOnlyRootFilesystem on console plugin
 container

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 pkg/agenticrun/bindata/assets/deployment.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkg/agenticrun/bindata/assets/deployment.yaml b/pkg/agenticrun/bindata/assets/deployment.yaml
index dcbc46ae90..3522e4ea76 100644
--- a/pkg/agenticrun/bindata/assets/deployment.yaml
+++ b/pkg/agenticrun/bindata/assets/deployment.yaml
@@ -40,6 +40,7 @@ spec:
           capabilities:
             drop:
             - ALL
+          readOnlyRootFilesystem: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
         - mountPath: /var/cert
@@ -49,6 +50,14 @@ spec:
           name: nginx-conf
           readOnly: true
           subPath: nginx.conf
+        - mountPath: /tmp
+          name: tmp
+        - mountPath: /var/cache/nginx
+          name: cache-nginx
+        - mountPath: /var/lib/nginx/tmp
+          name: lib-nginx-tmp
+        - mountPath: /run
+          name: run
       dnsPolicy: ClusterFirst
       hostUsers: false
       nodeSelector:
@@ -72,3 +81,11 @@ spec:
         configMap:
           name: cluster-update-console-plugin
           defaultMode: 420
+      - name: tmp
+        emptyDir: {}
+      - name: cache-nginx
+        emptyDir: {}
+      - name: lib-nginx-tmp
+        emptyDir: {}
+      - name: run
+        emptyDir: {}