Require read-only runtime cache delegates

Author: MaxRink

controllers/container_image/runtime_cache/resources.go

@@ -442,6 +442,9 @@ func Validate(cache v1alpha2.RuntimeCacheScanner) error {
 		if !strings.HasPrefix(delegate.HostPath, "/") {
 			return fmt.Errorf("containers.runtimeCache.delegates[%s].hostPath must be absolute", delegate.Name)
 		}
+		if delegate.ReadOnly != nil && !*delegate.ReadOnly {
+			return fmt.Errorf("containers.runtimeCache.delegates[%s].readOnly must be true", delegate.Name)
+		}
 	}
 	return nil
 }

controllers/container_image/runtime_cache/resources_test.go

@@ -60,6 +60,10 @@ func TestValidateRuntimeCache(t *testing.T) {
 	cfg.Delegates[0].HostPath = "relative.sock"
 	assert.ErrorContains(t, Validate(cfg), "hostPath must be absolute")
 
+	cfg = runtimeCacheAuditConfig().Spec.Containers.RuntimeCache
+	cfg.Delegates[0].ReadOnly = ptr.To(false)
+	assert.ErrorContains(t, Validate(cfg), "readOnly must be true")
+
 	cfg = runtimeCacheAuditConfig().Spec.Containers.RuntimeCache
 	cfg.Delegates[0].Name = strings.Repeat("a", 64)
 	assert.ErrorContains(t, Validate(cfg), "must be a valid DNS label")