All cert-manager operands containers are applied with "readOnlyRootFilesystem: true" in their securityContext (aligned with upstream natively):

• cert-manager-controller https://github.com/openshift/cert-manager-operator/blob/bb69f735ac8611d97b02d012d6f99f0184a567a4/bindata/cert-manager-deployment/controller/cert-manager-deployment.yaml#L71
• cainjector https://github.com/openshift/cert-manager-operator/blob/bb69f735ac8611d97b02d012d6f99f0184a567a4/bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml#L55
• webhook https://github.com/openshift/cert-manager-operator/blob/bb69f735ac8611d97b02d012d6f99f0184a567a4/bindata/cert-manager-deployment/webhook/cert-manager-webhook-deployment.yaml#L84
• istio-csr https://github.com/openshift/cert-manager-operator/blob/bb69f735ac8611d97b02d012d6f99f0184a567a4/bindata/istio-csr/cert-manager-istio-csr-deployment.yaml#L81

But the operator controller-manager is not:

https://github.com/openshift/cert-manager-operator/blob/bb69f735ac8611d97b02d012d6f99f0184a567a4/config/manager/manager.yaml#L101-L109

As called out in OCPSTRAT-2045, it's a common hardening recommendation to set readOnlyRootFilesystem to true, which ensures that the container's root filesystem is mounted as read-only.

Acceptance criteria

• Validate the operator pod container if has this field set correctly after installation.
• Verify effective behavior inside the running container. (oc exec -it – touch /etc/testfile should error out).
• Ensure existing e2es in operator repo and QE CI not being broken.