apiVersion: apps/v1
kind: Deployment
metadata:
  name: pomerium
spec:
  template:
    spec:
      containers:
        - name: pomerium
          securityContext:
            readOnlyRootFilesystem: true