I've also noticed that the deployed manifests don't have any Security Context settings, which I suppose I could add using the same patch mechanism, but it'd be nice to have a more first-class way to set that in the CRD