diff --git a/nova/templates/daemonset-compute.yaml b/nova/templates/daemonset-compute.yaml
index 850f0b00a8..aa4b27ccc6 100644
--- a/nova/templates/daemonset-compute.yaml
+++ b/nova/templates/daemonset-compute.yaml
@@ -248,6 +248,7 @@ spec:
               mountPath: /run
             - name: cgroup
               mountPath: /sys/fs/cgroup
+              readOnly: true
             - name: pod-shared
               mountPath: /tmp/pod-shared
             - name: machine-id