From 2c3bbbc9c9ac6aaa157b5d977e1a12017b5bb656 Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Wed, 21 Oct 2026 16:24:07 +0200
Subject: [PATCH 1/2] feat: Harden the operator Deployment

---
 .../zookeeper-operator/values.schema.json     | 21 +++++++++++++---
 deploy/helm/zookeeper-operator/values.yaml    | 25 +++++++++++--------
 2 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/deploy/helm/zookeeper-operator/values.schema.json b/deploy/helm/zookeeper-operator/values.schema.json
index 32ca6674..ce050ecb 100644
--- a/deploy/helm/zookeeper-operator/values.schema.json
+++ b/deploy/helm/zookeeper-operator/values.schema.json
@@ -115,13 +115,26 @@
       "title": "Pod security context",
       "description": "Pod-level security context for the operator pod, for example fsGroup. Passed through to Kubernetes unchanged. Applies to the operator pod only.",
       "type": "object",
-      "default": {}
+      "default": {
+        "runAsNonRoot": true,
+        "seccompProfile": {
+          "type": "RuntimeDefault"
+        }
+      }
     },
     "securityContext": {
       "title": "Container security context",
       "description": "Container-level security context for the operator container, for example readOnlyRootFilesystem or runAsNonRoot. Passed through to Kubernetes unchanged. Applies to the operator container only.",
       "type": "object",
-      "default": {}
+      "default": {
+        "allowPrivilegeEscalation": false,
+        "capabilities": {
+          "drop": [
+            "ALL"
+          ]
+        },
+        "readOnlyRootFilesystem": true
+      }
     },
     "resources": {
       "title": "Resource requests and limits",
@@ -265,14 +278,14 @@
         },
         "fileLog": {
           "title": "File logs",
-          "description": "Writes logs to /stackable/logs inside the container.",
+          "description": "Writes logs to /var/log/zookeeper-operator inside the container, on an emptyDir volume.",
           "type": "object",
           "additionalProperties": false,
           "properties": {
             "enabled": {
               "type": "boolean",
               "default": false,
-              "description": "Whether the operator also writes logs to /stackable/logs inside the container. Off by default: it needs a volume to be useful, otherwise the logs vanish with the pod."
+              "description": "Whether the operator also writes logs to /var/log/zookeeper-operator inside the container. Off by default. The logs survive container restarts but not the Pod."
             },
             "level": {
               "title": "File log level",
diff --git a/deploy/helm/zookeeper-operator/values.yaml b/deploy/helm/zookeeper-operator/values.yaml
index f822560b..36926436 100644
--- a/deploy/helm/zookeeper-operator/values.yaml
+++ b/deploy/helm/zookeeper-operator/values.yaml
@@ -37,16 +37,21 @@ podAnnotations: {}
 labels:
   stackable.tech/vendor: Stackable
 
-podSecurityContext: {}
-  # fsGroup: 2000
-
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+# Satisfies the restricted Pod Security Standard.
+# Already standard on OpenShift.
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  # Not part of the restricted profile.
+  # Anything the operator writes has to go to a mounted volume.
+  readOnlyRootFilesystem: true
 
 resources:
   limits:

From 52b638f1fc7105a89be7e8d169cf4759aa44be77 Mon Sep 17 00:00:00 2001
From: Lars Francke <git@lars-francke.de>
Date: Thu, 22 Oct 2026 13:00:05 +0200
Subject: [PATCH 2/2] chore: Add changelog entry

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fbf9c68a..947a3ecf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,6 +42,7 @@ All notable changes to this project will be documented in this file.
 - Support Vector 0.58.0 ([#1093], [#1098], [#1099], [#1100]).
 - All pods now set `securityContext.seccompProfile.type` to `RuntimeDefault` ([#1097]).
 - Replace the unmaintained `serde_yaml` with `yaml_serde` ([#1097]).
+- The operator Deployment runs with a restricted security context and a read-only root filesystem, so it can be deployed into namespaces that enforce the `restricted` Pod Security Standard ([#1101]).
 
 ### Fixed
 
@@ -67,6 +68,7 @@ All notable changes to this project will be documented in this file.
 [#1098]: https://github.com/stackabletech/zookeeper-operator/pull/1098
 [#1099]: https://github.com/stackabletech/zookeeper-operator/pull/1099
 [#1100]: https://github.com/stackabletech/zookeeper-operator/pull/1100
+[#1101]: https://github.com/stackabletech/zookeeper-operator/pull/1101
 
 ## [26.7.0] - 2026-07-21