Allow passthrough of securityContext.readOnlyRootFilesystem in Helm chart

[tnichols89]

Issue

Closes #43330

Description

This PR allows self-hosted, Kubernetes-based Fleet users to configure securityContext.readOnlyRootFilesystem in values.yaml, which is then propagated down to the deployment.yaml template.

This change provides a convenient mechanism for users to fix a known issue while preserving the current default behavior.

Testing

The underlying deployment.yaml change has been tested in a standard Google Kubernetes Engine cluster, and is confirmed to fix the linked issue when using either Ubuntu-based or Container-Optimized OS (COS)-based containerd container runtimes in GKE.

Summary by CodeRabbit

Release Notes

• Chores
  • Enhanced fleet container security by making the read-only root filesystem setting configurable. Deployments can now customize this security parameter to meet specific requirements, while secure defaults are automatically applied for standard installations that don't require custom configuration.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 953813d9-05a4-4c40-8191-b728e7cb47e5

📥 Commits

Reviewing files that changed from the base of the PR and between 11aa1c1 and 98b17c3.

📒 Files selected for processing (2)

• charts/fleet/templates/deployment.yaml
• charts/fleet/values.yaml

---

Walkthrough

The changes make the readOnlyRootFilesystem security context setting configurable in the Fleet Helm chart. Previously hardcoded as true in the deployment template, this setting now accepts a value from the Helm values configuration with a default fallback to true. The values file was updated to include this new configuration option with the same default value, enabling users to override the read-only filesystem behavior when deploying Fleet via Helm.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and accurately describes the main change: allowing configuration of securityContext.readOnlyRootFilesystem in the Helm chart.
Description check	✅ Passed	The description adequately covers the issue, solution, and testing performed, though it does not follow the full template structure which appears optional for infrastructure changes.
Linked Issues check	✅ Passed	The PR directly addresses the requirements from issue #43330 by adding values.yaml configuration for securityContext.readOnlyRootFilesystem and propagating it to deployment.yaml as proposed.
Out of Scope Changes check	✅ Passed	All changes are directly related to the stated objective: updating Helm chart files to allow configuration and passthrough of the readOnlyRootFilesystem setting.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BCTBB]

@tnichols89 Thanks for your contribution! I've just merged the change in. Additionally, I'm going to work on getting the changes referenced in the issue into place as well as bump the Chart version

[tnichols89]

Thank you so much! @BCTBB