Run the OpenFeature operator with an immutable root filesystem #5445

🤖 Generated by the Agentic Engineer

Description

The OpenFeature operator can run with an immutable application filesystem while retaining its existing certificate mounts and restricted execution. Its authored configuration does not yet enable that protection, and the detailed C-0017 result still reports the omission. This is a focused hardening repair; a stored report alone does not establish current workload or scanner freshness.

Steps to Reproduce

1. Render the committed operator release and inspect the manager's container security context.
2. Compare it with the current controller configuration and the detailed C-0017 result.
3. Observe that readOnlyRootFilesystem is absent while the existing non-root, capability and certificate protections remain configured.

Expected Behavior

The actual controller and its admission endpoints operate with an immutable root filesystem and only the explicitly required writable mounts.

Actual Behavior

The immutable-filesystem setting is absent. A source change, deployed behavior and a fresh control result remain unverified.

Acceptance Criteria

• Verify the owning chart and rendered manager configuration, then demonstrate the current omission with a failing regression.
• Enable the protection through the existing declarative owner. Preserve non-root execution, seccomp, dropped capabilities, certificate delivery, leader election and admission availability; add a narrowly scoped writable mount only if native runtime evidence requires it.
• Exercise the actual controller and admission behavior with the filesystem protection enabled. Static YAML alone is insufficient.
• Deliver through current-head CI, substantive review and protected deployment; verify sustained availability and the intended live security context.
• Obtain a fresh, attributable C-0017 result for the deployed workload and retain any missing identity, stale scan or incompatible rule as unresolved. No exception, exclusion or result suppression clears this issue.

Additional Context

Part of #2447.

Priority Low: the existing restricted execution limits the impact, and there is no verified urgent deadline or exploitation evidence. Effort Medium includes native behavior coverage, CI, review, deployment and rescan verification. Service class Risk reduction. Captured in Backlog during stabilization; implementation has not started.