Add readOnly to volumes

charts/hail-search/Chart.yaml

@@ -19,7 +19,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.42
+version: 0.1.43
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.

charts/hail-search/templates/deployment.yaml

@@ -28,6 +28,7 @@ spec:
       - name: ssd-datasets
       {{- if .Values.persistentVolume.enabled }}
         persistentVolumeClaim:
+          readOnly: true
           claimName: {{ include "hail-search.fullname" . }}-pvc
       {{- else }}
         emptyDir: {}
@@ -71,6 +72,7 @@ spec:
               name: datasets
             - mountPath: {{ .Values.environment.SSD_DATASETS_DIR }}
               name: ssd-datasets
+              readOnly: true
       restartPolicy: Always
       dnsPolicy: ClusterFirst
       {{- with .Values.initContainers}}

charts/hail-search/values.yaml

@@ -53,6 +53,7 @@ initContainers: |-
     volumeMounts:
       - mountPath: {{ $.Values.environment.SSD_DATASETS_DIR }}
         name: ssd-datasets
+        readOnly: true
   {{ end -}}
   {{ end }}
   {{- range $path, $queries := $.Values.cachedReferenceDatasetQueries -}}