apiVersion: apps/v1 kind: Deployment metadata: name: pomerium spec: template: spec: containers: - name: pomerium securityContext: readOnlyRootFilesystem: true