Operators want to stop the app from accidentally rewriting mounted ConfigMap files at runtime. What volumeMount setting helps?
Select an answer to reveal the explanation.
Short Explanation
Treat config like a laminated cheat sheet—look, don’t scribble. readOnly: true on the volumeMount keeps the app from corrupting those files. Wide-open modes and bidirectional propagation are the opposite of hardening.
Full Explanation
Mounting configuration volumes with volumeMounts.readOnly set to true prevents the container process from modifying projected ConfigMap (or similar) files in place. That is a common application hardening practice. Looser permissions or mountPropagation changes do not achieve a read-only config mount.