We did find this PR using

readOnlyRootFilesystem

as a patch. Does that seem reasonable at a glance? https://github.com/authzed/spicedb-operator/issues/236#issuecomment-1685352934