diff --git a/apis/go.mod b/apis/go.mod
index 189076a1..33ad4c5f 100644
--- a/apis/go.mod
+++ b/apis/go.mod
@@ -5,7 +5,7 @@ go 1.26.3
 require (
 	github.com/go-logr/logr v1.4.3
 	github.com/onsi/gomega v1.42.1
-	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67
+	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055
 	k8s.io/api v0.33.13
 	k8s.io/apiextensions-apiserver v0.33.13
 	k8s.io/apimachinery v0.33.13
diff --git a/apis/go.sum b/apis/go.sum
index 07e48a38..279c4779 100644
--- a/apis/go.sum
+++ b/apis/go.sum
@@ -81,8 +81,8 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 h1:YVY7Mb0AdJBbNgC/Zz9R/ZwhixOmZNA8P+6ZPaDW/0M=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67 h1:crgFl4DA5n38huc043ux21jEQM7UaRMXsi+wogDOYn0=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055 h1:aQy9n6lVrxJWF0KA3R7TpD/qfYDJedL5UQJRuS3hm+k=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 1d5ee99e..1da7023b 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -8,7 +8,6 @@ rules:
   - ""
   resources:
   - configmaps
-  - pods
   - secrets
   - serviceaccounts
   - services
@@ -47,6 +46,7 @@ rules:
   - ""
   resources:
   - persistentvolumeclaims
+  - pods
   verbs:
   - delete
   - get
@@ -54,12 +54,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - pods/exec
-  verbs:
-  - create
 - apiGroups:
   - apps
   resources:
@@ -345,7 +339,7 @@ rules:
 - apiGroups:
   - security.openshift.io
   resourceNames:
-  - anyuid
+  - nonroot-v2
   resources:
   - securitycontextconstraints
   verbs:
diff --git a/go.mod b/go.mod
index 9afb0448..8ee99f72 100644
--- a/go.mod
+++ b/go.mod
@@ -11,9 +11,9 @@ require (
 	github.com/onsi/gomega v1.42.1
 	github.com/openshift/api v3.9.0+incompatible
 	github.com/openstack-k8s-operators/infra-operator/apis v0.0.0-00010101000000-000000000000
-	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67
-	github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67
-	github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260717092345-ab1ee7b97c67
+	github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055
+	github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260724091355-a86f6d29e055
+	github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260724091355-a86f6d29e055
 	go.uber.org/zap v1.28.0
 	golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67
 	k8s.io/api v0.33.13
diff --git a/go.sum b/go.sum
index b4b29afd..a91049f4 100644
--- a/go.sum
+++ b/go.sum
@@ -116,12 +116,12 @@ github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4 h1:YVY7Mb0AdJBbNgC/Zz9R/ZwhixOmZNA8P+6ZPaDW/0M=
 github.com/openshift/api v0.0.0-20260710141509-36dec0bfafe4/go.mod h1:SPLf21TYPipzCO67BURkCfK6dcIIxx0oNRVWaOyRcXM=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67 h1:crgFl4DA5n38huc043ux21jEQM7UaRMXsi+wogDOYn0=
-github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260717092345-ab1ee7b97c67/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
-github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67 h1:EoBTLbbfGRC37uA0J6al5zeZfQSxy6XwsUMNZAWCQPA=
-github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260717092345-ab1ee7b97c67/go.mod h1:IN0pCq/v2MsPcXrtcBIqcpVEqyq8oTIbNahmsc3tu28=
-github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260717092345-ab1ee7b97c67 h1:GmakXxpm0scnNPuFDC9fSdhqo8MPyyBqqL0UW8pNh5o=
-github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260717092345-ab1ee7b97c67/go.mod h1:W41icuwPMCo1MlVBwkFTFf5oHEYtV59oT9yKce5fcHI=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055 h1:aQy9n6lVrxJWF0KA3R7TpD/qfYDJedL5UQJRuS3hm+k=
+github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20260724091355-a86f6d29e055/go.mod h1:yA4tbcB62Dml5d0SP3n14hbwLVrKFicm690/eTWvusc=
+github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260724091355-a86f6d29e055 h1:8EKLg+aMklM3kXIjbyhy6Ssvce6dKy+oTT6cUrMTq4A=
+github.com/openstack-k8s-operators/lib-common/modules/edpm v0.0.0-20260724091355-a86f6d29e055/go.mod h1:IN0pCq/v2MsPcXrtcBIqcpVEqyq8oTIbNahmsc3tu28=
+github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260724091355-a86f6d29e055 h1:5efDvK9x0T8C8jEraByDlcroagFMLA9f7zRF9rwG1z4=
+github.com/openstack-k8s-operators/lib-common/modules/test v0.6.1-0.20260724091355-a86f6d29e055/go.mod h1:W41icuwPMCo1MlVBwkFTFf5oHEYtV59oT9yKce5fcHI=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
diff --git a/internal/controller/instanceha/instanceha_controller.go b/internal/controller/instanceha/instanceha_controller.go
index 913335dc..f0b652f1 100644
--- a/internal/controller/instanceha/instanceha_controller.go
+++ b/internal/controller/instanceha/instanceha_controller.go
@@ -95,7 +95,7 @@ func (r *Reconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
@@ -205,7 +205,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
diff --git a/internal/controller/memcached/memcached_controller.go b/internal/controller/memcached/memcached_controller.go
index fe3861d2..34965922 100644
--- a/internal/controller/memcached/memcached_controller.go
+++ b/internal/controller/memcached/memcached_controller.go
@@ -103,8 +103,7 @@ func (r *Reconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
-// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 
 // Reconcile - Memcached
@@ -225,15 +224,10 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
-		{
-			APIGroups: []string{""},
-			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
-		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
 	if err != nil {
@@ -496,8 +490,8 @@ func (r *Reconciler) generateConfigMaps(
 	if instance.Spec.TLS.Enabled() {
 		memcachedTLSListen = "| sed 's/\\(.*\\)/\\1\\nnotls:\\1:11211/'"
 		memcachedTLSOptions = "-Z " +
-			"-o ssl_chain_cert=/etc/pki/tls/certs/memcached.crt " +
-			"-o ssl_key=/etc/pki/tls/private/memcached.key " +
+			"-o ssl_chain_cert=/var/lib/config-data/tls/certs/memcached.crt " +
+			"-o ssl_key=/var/lib/config-data/tls/private/memcached.key " +
 			"-o ssl_ca_cert=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
 
 		switch instance.Spec.TLS.MTLS.SslVerifyMode {
diff --git a/internal/controller/network/dnsmasq_controller.go b/internal/controller/network/dnsmasq_controller.go
index 9630e752..ca78465d 100644
--- a/internal/controller/network/dnsmasq_controller.go
+++ b/internal/controller/network/dnsmasq_controller.go
@@ -97,8 +97,7 @@ func (r *DNSMasqReconciler) GetLogger(ctx context.Context) logr.Logger {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
-// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
@@ -205,15 +204,10 @@ func (r *DNSMasqReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
-		{
-			APIGroups: []string{""},
-			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
-		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
 	if err != nil {
diff --git a/internal/controller/rabbitmq/proxy.go b/internal/controller/rabbitmq/proxy.go
index 51711751..5284ef23 100644
--- a/internal/controller/rabbitmq/proxy.go
+++ b/internal/controller/rabbitmq/proxy.go
@@ -8,6 +8,7 @@ import (
 	rabbitmqv1beta1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1"
 	"github.com/openstack-k8s-operators/infra-operator/internal/rabbitmq"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -153,12 +154,11 @@ func BuildProxySidecarContainer(instance *rabbitmqv1beta1.RabbitMq, IPv6Enabled
 			TimeoutSeconds:      3,
 			FailureThreshold:    3,
 		},
-		SecurityContext: &corev1.SecurityContext{
-			AllowPrivilegeEscalation: ptr.To(false),
-			Capabilities: &corev1.Capabilities{
-				Drop: []corev1.Capability{"ALL"},
-			},
-		},
+		SecurityContext: func() *corev1.SecurityContext {
+			sc := pod.RestrictiveSecurityContext(999)
+			sc.ReadOnlyRootFilesystem = ptr.To(false)
+			return sc
+		}(),
 	}
 
 	// Mount TLS certificates if TLS is enabled
diff --git a/internal/controller/rabbitmq/rabbitmq_controller.go b/internal/controller/rabbitmq/rabbitmq_controller.go
index c862fcdb..6f7108b5 100644
--- a/internal/controller/rabbitmq/rabbitmq_controller.go
+++ b/internal/controller/rabbitmq/rabbitmq_controller.go
@@ -130,13 +130,15 @@ type Reconciler struct {
 // +kubebuilder:rbac:groups=config.openshift.io,resources=networks,verbs=get;list;watch;
 // +kubebuilder:rbac:groups="",resources=nodes,verbs=get;list
 
-// Required to exec into pods
-// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;update;patch;delete;
-// +kubebuilder:rbac:groups=core,resources=pods/exec,verbs=create
+// Required to label and delete pods during CR deletion
+// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;update;delete
 
 // Required to manage PodDisruptionBudgets for multi-replica deployments
 // +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch;create;update;patch;delete
 
+// Required to grant nonroot-v2 SCC to RabbitMQ workload SA
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
+
 // Required to create per-pod LoadBalancer services
 // +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete
 
@@ -577,7 +579,7 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
diff --git a/internal/controller/redis/redis_controller.go b/internal/controller/redis/redis_controller.go
index 5e56e24e..7de71dfb 100644
--- a/internal/controller/redis/redis_controller.go
+++ b/internal/controller/redis/redis_controller.go
@@ -106,8 +106,8 @@ type Reconciler struct {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update
 // service account permissions that are needed to grant permission to the above
-// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
-// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
+// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=nonroot-v2,resources=securitycontextconstraints,verbs=use
+// +kubebuilder:rbac:groups="",resources=pods,verbs=get;list;patch;watch
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 
 // Reconcile - Redis
@@ -212,14 +212,14 @@ func (r *Reconciler) Reconcile(ctx context.Context, req ctrl.Request) (result ct
 	rbacRules := []rbacv1.PolicyRule{
 		{
 			APIGroups:     []string{"security.openshift.io"},
-			ResourceNames: []string{"anyuid"},
+			ResourceNames: []string{"nonroot-v2"},
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
 		{
 			APIGroups: []string{""},
 			Resources: []string{"pods"},
-			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
+			Verbs:     []string{"get", "list", "watch", "patch"},
 		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
diff --git a/internal/dnsmasq/const.go b/internal/dnsmasq/const.go
index d28fc1fd..dc46ec99 100644
--- a/internal/dnsmasq/const.go
+++ b/internal/dnsmasq/const.go
@@ -24,4 +24,7 @@ const (
 	DNSPort int32 = 53
 	// DNSTargetPort - port used the service is listening on in the pod
 	DNSTargetPort int32 = 5353
+
+	// DnsmasqUID - https://github.com/openstack/kolla/blob/master/kolla/common/users.py
+	DnsmasqUID int64 = 42435
 )
diff --git a/internal/dnsmasq/deployment.go b/internal/dnsmasq/deployment.go
index bb637e38..1b79224b 100644
--- a/internal/dnsmasq/deployment.go
+++ b/internal/dnsmasq/deployment.go
@@ -26,6 +26,7 @@ import (
 	common "github.com/openstack-k8s-operators/lib-common/modules/common"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/affinity"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/env"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -121,21 +122,20 @@ func Deployment(
 					Labels:      labels,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: instance.RbacResourceName(),
-					Volumes:            getVolumes(instance.Name, cms),
+					ServiceAccountName:           instance.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
+					Volumes:                      getVolumes(instance.Name, cms),
 					InitContainers: []corev1.Container{
 						{
 							Name:    "init",
 							Command: command,
 							Args:    initArgs,
 							Image:   instance.Spec.ContainerImage,
-							SecurityContext: &corev1.SecurityContext{
-								RunAsNonRoot:             ptr.To(true),
-								AllowPrivilegeEscalation: ptr.To(false),
-								SeccompProfile: &corev1.SeccompProfile{
-									Type: corev1.SeccompProfileTypeRuntimeDefault,
-								},
-							},
+							SecurityContext: func() *corev1.SecurityContext {
+								sc := pod.RestrictiveSecurityContext(DnsmasqUID)
+								sc.ReadOnlyRootFilesystem = ptr.To(false)
+								return sc
+							}(),
 							Env:          env.MergeEnvs([]corev1.EnvVar{}, envVars),
 							VolumeMounts: getVolumeMounts(instance.Name, cms),
 						},
@@ -146,13 +146,11 @@ func Deployment(
 							Command: command,
 							Args:    args,
 							Image:   instance.Spec.ContainerImage,
-							SecurityContext: &corev1.SecurityContext{
-								RunAsNonRoot:             ptr.To(true),
-								AllowPrivilegeEscalation: ptr.To(false),
-								SeccompProfile: &corev1.SeccompProfile{
-									Type: corev1.SeccompProfileTypeRuntimeDefault,
-								},
-							},
+							SecurityContext: func() *corev1.SecurityContext {
+								sc := pod.RestrictiveSecurityContext(DnsmasqUID)
+								sc.ReadOnlyRootFilesystem = ptr.To(false)
+								return sc
+							}(),
 							Env:            env.MergeEnvs([]corev1.EnvVar{}, envVars),
 							VolumeMounts:   getVolumeMounts(instance.Name, cms),
 							ReadinessProbe: readinessProbe,
diff --git a/internal/instanceha/funcs.go b/internal/instanceha/funcs.go
index c993ed08..98c6f151 100644
--- a/internal/instanceha/funcs.go
+++ b/internal/instanceha/funcs.go
@@ -14,16 +14,17 @@ limitations under the License.
 package instanceha
 
 import (
+	"fmt"
+
 	instancehav1 "github.com/openstack-k8s-operators/infra-operator/apis/instanceha/v1beta1"
 	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 	env "github.com/openstack-k8s-operators/lib-common/modules/common/env"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/serviceaccount"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
-
-	"fmt"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
 )
@@ -172,33 +173,23 @@ func Deployment(
 					Annotations: annotations,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: instance.RbacResourceName(),
+					ServiceAccountName:           instance.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
 					SecurityContext: &corev1.PodSecurityContext{
 						FSGroup: ptr.To(instanceHaUID),
 					},
-					Volumes:                       volumes,
+					Volumes:                       append(volumes, serviceaccount.KubeAPIAccessVolume()),
 					TerminationGracePeriodSeconds: ptr.To[int64](45),
 					Containers: []corev1.Container{{
-						Name:    "instanceha",
-						Image:   containerImage,
-						Command: []string{"/usr/bin/python3", "-u", "/var/lib/instanceha/instanceha.py"},
-						SecurityContext: &corev1.SecurityContext{
-							RunAsUser:                ptr.To(instanceHaUID),
-							RunAsGroup:               ptr.To(instanceHaUID),
-							RunAsNonRoot:             ptr.To(true),
-							ReadOnlyRootFilesystem:   ptr.To(true),
-							AllowPrivilegeEscalation: ptr.To(false),
-							Capabilities: &corev1.Capabilities{
-								Drop: []corev1.Capability{
-									"ALL",
-								},
-							},
-						},
-						Env:            env.MergeEnvs([]corev1.EnvVar{}, envVars),
-						Ports:          instancehaPorts(instance),
-						VolumeMounts:   volumeMounts,
-						LivenessProbe:  livenessProbe,
-						ReadinessProbe: readinessProbe,
+						Name:            "instanceha",
+						Image:           containerImage,
+						Command:         []string{"/usr/bin/python3", "-u", "/var/lib/instanceha/instanceha.py"},
+						SecurityContext: pod.RestrictiveSecurityContext(instanceHaUID),
+						Env:             env.MergeEnvs([]corev1.EnvVar{}, envVars),
+						Ports:           instancehaPorts(instance),
+						VolumeMounts:    append(volumeMounts, serviceaccount.KubeAPIAccessVolumeMount()),
+						LivenessProbe:   livenessProbe,
+						ReadinessProbe:  readinessProbe,
 					}},
 				},
 			},
diff --git a/internal/instanceha/funcs_test.go b/internal/instanceha/funcs_test.go
index fe1d412e..b59b39d2 100644
--- a/internal/instanceha/funcs_test.go
+++ b/internal/instanceha/funcs_test.go
@@ -6,6 +6,7 @@ import (
 	. "github.com/onsi/gomega" //revive:disable:dot-imports
 
 	instancehav1 "github.com/openstack-k8s-operators/infra-operator/apis/instanceha/v1beta1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -101,6 +102,51 @@ func TestDeploymentSecurityContext(t *testing.T) {
 	g.Expect(container.SecurityContext.ReadOnlyRootFilesystem).NotTo(BeNil())
 	g.Expect(*container.SecurityContext.ReadOnlyRootFilesystem).To(BeTrue())
 
+	g.Expect(container.SecurityContext.RunAsNonRoot).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.RunAsNonRoot).To(BeTrue())
+
+	g.Expect(container.SecurityContext.RunAsUser).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.RunAsUser).To(Equal(int64(42401)))
+
+	g.Expect(container.SecurityContext.RunAsGroup).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.RunAsGroup).To(Equal(int64(42401)))
+
+	g.Expect(container.SecurityContext.AllowPrivilegeEscalation).NotTo(BeNil())
+	g.Expect(*container.SecurityContext.AllowPrivilegeEscalation).To(BeFalse())
+
+	g.Expect(container.SecurityContext.Capabilities).NotTo(BeNil())
+	g.Expect(container.SecurityContext.Capabilities.Drop).To(ContainElement(corev1.Capability("ALL")))
+
+	g.Expect(container.SecurityContext.SeccompProfile).NotTo(BeNil())
+	g.Expect(container.SecurityContext.SeccompProfile.Type).To(Equal(corev1.SeccompProfileTypeRuntimeDefault))
+
+	// Verify AutomountServiceAccountToken is disabled
+	g.Expect(dep.Spec.Template.Spec.AutomountServiceAccountToken).NotTo(BeNil())
+	g.Expect(*dep.Spec.Template.Spec.AutomountServiceAccountToken).To(BeFalse())
+
+	// Verify kube-api-access projected volume exists
+	var kubeAPIVolumeFound bool
+	for _, vol := range dep.Spec.Template.Spec.Volumes {
+		if vol.Name == "kube-api-access" {
+			kubeAPIVolumeFound = true
+			g.Expect(vol.VolumeSource.Projected).NotTo(BeNil())
+			g.Expect(vol.VolumeSource.Projected.Sources).To(HaveLen(3))
+			break
+		}
+	}
+	g.Expect(kubeAPIVolumeFound).To(BeTrue(), "kube-api-access projected volume should exist")
+
+	// Verify kube-api-access mount exists
+	var kubeAPIMountFound bool
+	for _, mount := range container.VolumeMounts {
+		if mount.Name == "kube-api-access" && mount.MountPath == "/var/run/secrets/kubernetes.io/serviceaccount" {
+			kubeAPIMountFound = true
+			g.Expect(mount.ReadOnly).To(BeTrue())
+			break
+		}
+	}
+	g.Expect(kubeAPIMountFound).To(BeTrue(), "kube-api-access volume mount should exist")
+
 	// Verify /tmp emptyDir volume exists
 	var tmpVolumeFound bool
 	for _, vol := range dep.Spec.Template.Spec.Volumes {
diff --git a/internal/memcached/statefulset.go b/internal/memcached/statefulset.go
index 27277548..c8ee2ab0 100644
--- a/internal/memcached/statefulset.go
+++ b/internal/memcached/statefulset.go
@@ -6,6 +6,7 @@ import (
 	common "github.com/openstack-k8s-operators/lib-common/modules/common"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/affinity"
 	labels "github.com/openstack-k8s-operators/lib-common/modules/common/labels"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -63,19 +64,21 @@ func StatefulSet(
 					Labels: ls,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: m.RbacResourceName(),
+					ServiceAccountName:           m.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
+					SecurityContext: &corev1.PodSecurityContext{
+						FSGroup: ptr.To(MemcachedUID),
+					},
 					Containers: []corev1.Container{{
 						Image:   m.Spec.ContainerImage,
 						Name:    "memcached",
-						Command: []string{"/usr/bin/dumb-init", "--", "/usr/local/bin/kolla_start"},
-						SecurityContext: &corev1.SecurityContext{
-							RunAsUser:  ptr.To(MemcachedUID),
-							RunAsGroup: ptr.To(MemcachedUID),
-						},
+						Command: []string{"/usr/bin/dumb-init", "--", "bash", "-c", "source /etc/sysconfig/memcached && exec /usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS"},
+						SecurityContext: func() *corev1.SecurityContext {
+							sc := pod.RestrictiveSecurityContext(MemcachedUID)
+							sc.ReadOnlyRootFilesystem = ptr.To(false)
+							return sc
+						}(),
 						Env: []corev1.EnvVar{{
-							Name:  "KOLLA_CONFIG_STRATEGY",
-							Value: "COPY_ALWAYS",
-						}, {
 							Name: "POD_IPS",
 							ValueFrom: &corev1.EnvVarSource{
 								FieldRef: &corev1.ObjectFieldSelector{
diff --git a/internal/memcached/volumes.go b/internal/memcached/volumes.go
index 55d01065..da6fc261 100644
--- a/internal/memcached/volumes.go
+++ b/internal/memcached/volumes.go
@@ -15,22 +15,6 @@ const (
 
 func getVolumes(m *memcachedv1.Memcached) []corev1.Volume {
 	vols := []corev1.Volume{
-		{
-			Name: "kolla-config",
-			VolumeSource: corev1.VolumeSource{
-				ConfigMap: &corev1.ConfigMapVolumeSource{
-					LocalObjectReference: corev1.LocalObjectReference{
-						Name: fmt.Sprintf("%s-config-data", m.Name),
-					},
-					Items: []corev1.KeyToPath{
-						{
-							Key:  "config.json",
-							Path: "config.json",
-						},
-					},
-				},
-			},
-		},
 		{
 			Name: "config-data",
 			VolumeSource: corev1.VolumeSource{
@@ -41,7 +25,7 @@ func getVolumes(m *memcachedv1.Memcached) []corev1.Volume {
 					Items: []corev1.KeyToPath{
 						{
 							Key:  "memcached",
-							Path: "etc/sysconfig/memcached",
+							Path: "memcached",
 						},
 					},
 				},
@@ -67,13 +51,9 @@ func getVolumes(m *memcachedv1.Memcached) []corev1.Volume {
 
 func getVolumeMounts(m *memcachedv1.Memcached) []corev1.VolumeMount {
 	vm := []corev1.VolumeMount{{
-		MountPath: "/var/lib/kolla/config_files/src",
+		MountPath: "/etc/sysconfig",
 		ReadOnly:  true,
 		Name:      "config-data",
-	}, {
-		MountPath: "/var/lib/kolla/config_files",
-		ReadOnly:  true,
-		Name:      "kolla-config",
 	}}
 
 	if m.Spec.TLS.Enabled() {
diff --git a/internal/rabbitmq/statefulset.go b/internal/rabbitmq/statefulset.go
index a8d73848..e9b899e2 100644
--- a/internal/rabbitmq/statefulset.go
+++ b/internal/rabbitmq/statefulset.go
@@ -7,6 +7,8 @@ import (
 	rabbitmqv1 "github.com/openstack-k8s-operators/infra-operator/apis/rabbitmq/v1beta1"
 	topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
 	labels "github.com/openstack-k8s-operators/lib-common/modules/common/labels"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/serviceaccount"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -64,9 +66,14 @@ func StatefulSet(
 		Command:        []string{"rabbitmq-server"},
 		Env:            containerEnv,
 		Ports:          buildContainerPorts(r),
-		VolumeMounts:   getVolumeMounts(r, proxy.IPv6Enabled),
+		VolumeMounts:   append(getVolumeMounts(r, proxy.IPv6Enabled), serviceaccount.KubeAPIAccessVolumeMount()),
 		ReadinessProbe: readinessProbe,
 		Lifecycle:      buildLifecycle(r),
+		SecurityContext: func() *corev1.SecurityContext {
+			sc := pod.RestrictiveSecurityContext(999)
+			sc.ReadOnlyRootFilesystem = ptr.To(false)
+			return sc
+		}(),
 	}
 
 	// When proxy is enabled, RabbitMQ listens on localhost only (backend port).
@@ -159,14 +166,15 @@ func StatefulSet(
 				},
 				Spec: corev1.PodSpec{
 					ServiceAccountName:            r.RbacResourceName(),
-					AutomountServiceAccountToken:  ptr.To(true),
+					AutomountServiceAccountToken:  ptr.To(false),
 					TerminationGracePeriodSeconds: r.Spec.TerminationGracePeriodSeconds,
 					InitContainers:                initContainers,
 					Containers:                    containers,
-					Volumes:                       volumes,
+					Volumes:                       append(volumes, serviceaccount.KubeAPIAccessVolume()),
 					SecurityContext: &corev1.PodSecurityContext{
-						FSGroup:   ptr.To(int64(0)),
-						RunAsUser: ptr.To(int64(999)),
+						FSGroup:             ptr.To(int64(999)),
+						FSGroupChangePolicy: ptr.To(corev1.FSGroupChangeOnRootMismatch),
+						RunAsUser:           ptr.To(int64(999)),
 					},
 				},
 			},
diff --git a/internal/redis/const.go b/internal/redis/const.go
new file mode 100644
index 00000000..97cd433c
--- /dev/null
+++ b/internal/redis/const.go
@@ -0,0 +1,22 @@
+/*
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package redis
+
+const (
+	// RedisUID -
+	// https://github.com/openstack/kolla/blob/master/kolla/common/users.py
+	RedisUID int64 = 42460
+)
diff --git a/internal/redis/statefulset.go b/internal/redis/statefulset.go
index b6e0b12c..6bc10a3c 100644
--- a/internal/redis/statefulset.go
+++ b/internal/redis/statefulset.go
@@ -9,10 +9,13 @@ import (
 	"github.com/openstack-k8s-operators/lib-common/modules/common/affinity"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
 	labels "github.com/openstack-k8s-operators/lib-common/modules/common/labels"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/pod"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/serviceaccount"
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
 )
 
 // StatefulSet returns a StatefulSet resource for the Redis CR
@@ -28,36 +31,36 @@ func StatefulSet(
 	ls := labels.GetLabels(r, "redis", matchls)
 
 	livenessProbe := &corev1.Probe{
-		// TODO might need tuning
 		TimeoutSeconds:      5,
 		PeriodSeconds:       3,
 		InitialDelaySeconds: 3,
+		ProbeHandler: corev1.ProbeHandler{
+			Exec: &corev1.ExecAction{
+				Command: []string{"/var/lib/operator-scripts/redis_probe.sh", "liveness"},
+			},
+		},
 	}
 	readinessProbe := &corev1.Probe{
-		// TODO might need tuning
 		TimeoutSeconds:      5,
 		PeriodSeconds:       5,
 		InitialDelaySeconds: 5,
+		ProbeHandler: corev1.ProbeHandler{
+			Exec: &corev1.ExecAction{
+				Command: []string{"/var/lib/operator-scripts/redis_probe.sh", "readiness"},
+			},
+		},
 	}
 	sentinelLivenessProbe := &corev1.Probe{
-		// TODO might need tuning
 		TimeoutSeconds:      5,
 		PeriodSeconds:       3,
 		InitialDelaySeconds: 3,
 	}
 	sentinelReadinessProbe := &corev1.Probe{
-		// TODO might need tuning
 		TimeoutSeconds:      5,
 		PeriodSeconds:       5,
 		InitialDelaySeconds: 5,
 	}
 
-	livenessProbe.TCPSocket = &corev1.TCPSocketAction{
-		Port: intstr.IntOrString{Type: intstr.Int, IntVal: int32(6379)},
-	}
-	readinessProbe.TCPSocket = &corev1.TCPSocketAction{
-		Port: intstr.IntOrString{Type: intstr.Int, IntVal: int32(6379)},
-	}
 	sentinelLivenessProbe.TCPSocket = &corev1.TCPSocketAction{
 		Port: intstr.IntOrString{Type: intstr.Int, IntVal: int32(26379)},
 	}
@@ -96,43 +99,45 @@ func StatefulSet(
 					Labels: ls,
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: r.RbacResourceName(),
+					ServiceAccountName:           r.RbacResourceName(),
+					AutomountServiceAccountToken: ptr.To(false),
+					SecurityContext: &corev1.PodSecurityContext{
+						FSGroup: ptr.To(RedisUID),
+					},
 					Containers: []corev1.Container{
 						{
-							Image:        r.Spec.ContainerImage,
-							Command:      []string{"/usr/bin/dumb-init", "--", "/var/lib/operator-scripts/start_redis_replication.sh"},
-							Name:         "redis",
+							Image:   r.Spec.ContainerImage,
+							Command: []string{"/usr/bin/dumb-init", "--", "/var/lib/operator-scripts/start_redis_replication.sh"},
+							Name:    "redis",
+							SecurityContext: func() *corev1.SecurityContext {
+								sc := pod.RestrictiveSecurityContext(RedisUID)
+								sc.ReadOnlyRootFilesystem = ptr.To(false)
+								return sc
+							}(),
 							Env:          commonEnvVars,
 							Resources:    r.Spec.Resources,
-							VolumeMounts: getRedisVolumeMounts(r),
+							VolumeMounts: append(getRedisVolumeMounts(r), serviceaccount.KubeAPIAccessVolumeMount()),
 							Ports: []corev1.ContainerPort{{
 								ContainerPort: 6379,
 								Name:          "redis",
 							}},
-							LivenessProbe: &corev1.Probe{
-								ProbeHandler: corev1.ProbeHandler{
-									Exec: &corev1.ExecAction{
-										Command: []string{"/var/lib/operator-scripts/redis_probe.sh", "liveness"},
-									},
-								},
-							},
-							ReadinessProbe: &corev1.Probe{
-								ProbeHandler: corev1.ProbeHandler{
-									Exec: &corev1.ExecAction{
-										Command: []string{"/var/lib/operator-scripts/redis_probe.sh", "readiness"},
-									},
-								},
-							},
+							LivenessProbe:  livenessProbe,
+							ReadinessProbe: readinessProbe,
 						}, {
 							Image:   r.Spec.ContainerImage,
 							Command: []string{"/usr/bin/dumb-init", "--", "/var/lib/operator-scripts/start_sentinel.sh"},
 							Name:    "sentinel",
+							SecurityContext: func() *corev1.SecurityContext {
+								sc := pod.RestrictiveSecurityContext(RedisUID)
+								sc.ReadOnlyRootFilesystem = ptr.To(false)
+								return sc
+							}(),
 							Env: append(commonEnvVars, corev1.EnvVar{
 								Name:  "SENTINEL_QUORUM",
 								Value: strconv.Itoa((int(*r.Spec.Replicas) / 2) + 1),
 							}),
 							Resources:    r.Spec.SentinelResources,
-							VolumeMounts: getSentinelVolumeMounts(r),
+							VolumeMounts: append(getSentinelVolumeMounts(r), serviceaccount.KubeAPIAccessVolumeMount()),
 							Ports: []corev1.ContainerPort{{
 								ContainerPort: 26379,
 								Name:          "sentinel",
@@ -141,7 +146,7 @@ func StatefulSet(
 							LivenessProbe:  sentinelLivenessProbe,
 						},
 					},
-					Volumes: getVolumes(r),
+					Volumes: append(getVolumes(r), serviceaccount.KubeAPIAccessVolume()),
 				},
 			},
 		},
diff --git a/internal/redis/statefulset_test.go b/internal/redis/statefulset_test.go
new file mode 100644
index 00000000..892f9215
--- /dev/null
+++ b/internal/redis/statefulset_test.go
@@ -0,0 +1,105 @@
+/*
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package redis
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega" //revive:disable:dot-imports
+
+	redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
+)
+
+func TestStatefulSetSecurityContext(t *testing.T) {
+	g := NewWithT(t)
+
+	r := &redisv1.Redis{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-redis",
+			Namespace: "test-namespace",
+		},
+		Spec: redisv1.RedisSpec{
+			RedisSpecCore: redisv1.RedisSpecCore{
+				Replicas: ptr.To[int32](3),
+			},
+			ContainerImage: "test-image:latest",
+		},
+	}
+
+	sts := StatefulSet(r, "hash123", nil)
+
+	// Verify AutomountServiceAccountToken is disabled
+	g.Expect(sts.Spec.Template.Spec.AutomountServiceAccountToken).NotTo(BeNil())
+	g.Expect(*sts.Spec.Template.Spec.AutomountServiceAccountToken).To(BeFalse())
+
+	// Verify redis container SecurityContext
+	redisContainer := sts.Spec.Template.Spec.Containers[0]
+	g.Expect(redisContainer.Name).To(Equal("redis"))
+	g.Expect(redisContainer.SecurityContext).NotTo(BeNil())
+	g.Expect(redisContainer.SecurityContext.RunAsUser).NotTo(BeNil())
+	g.Expect(*redisContainer.SecurityContext.RunAsUser).To(Equal(RedisUID))
+	g.Expect(redisContainer.SecurityContext.RunAsGroup).NotTo(BeNil())
+	g.Expect(*redisContainer.SecurityContext.RunAsGroup).To(Equal(RedisUID))
+	g.Expect(redisContainer.SecurityContext.RunAsNonRoot).NotTo(BeNil())
+	g.Expect(*redisContainer.SecurityContext.RunAsNonRoot).To(BeTrue())
+
+	// Verify sentinel container SecurityContext
+	sentinelContainer := sts.Spec.Template.Spec.Containers[1]
+	g.Expect(sentinelContainer.Name).To(Equal("sentinel"))
+	g.Expect(sentinelContainer.SecurityContext).NotTo(BeNil())
+	g.Expect(sentinelContainer.SecurityContext.RunAsUser).NotTo(BeNil())
+	g.Expect(*sentinelContainer.SecurityContext.RunAsUser).To(Equal(RedisUID))
+	g.Expect(sentinelContainer.SecurityContext.RunAsGroup).NotTo(BeNil())
+	g.Expect(*sentinelContainer.SecurityContext.RunAsGroup).To(Equal(RedisUID))
+	g.Expect(sentinelContainer.SecurityContext.RunAsNonRoot).NotTo(BeNil())
+	g.Expect(*sentinelContainer.SecurityContext.RunAsNonRoot).To(BeTrue())
+
+	// Verify kube-api-access projected volume exists
+	var kubeAPIVolumeFound bool
+	for _, vol := range sts.Spec.Template.Spec.Volumes {
+		if vol.Name == "kube-api-access" {
+			kubeAPIVolumeFound = true
+			g.Expect(vol.VolumeSource.Projected).NotTo(BeNil())
+			g.Expect(vol.VolumeSource.Projected.Sources).To(HaveLen(3))
+			break
+		}
+	}
+	g.Expect(kubeAPIVolumeFound).To(BeTrue(), "kube-api-access projected volume should exist")
+
+	// Verify kube-api-access mount on redis container
+	var redisKubeAPIMountFound bool
+	for _, mount := range redisContainer.VolumeMounts {
+		if mount.Name == "kube-api-access" && mount.MountPath == "/var/run/secrets/kubernetes.io/serviceaccount" {
+			redisKubeAPIMountFound = true
+			g.Expect(mount.ReadOnly).To(BeTrue())
+			break
+		}
+	}
+	g.Expect(redisKubeAPIMountFound).To(BeTrue(), "redis container should mount kube-api-access")
+
+	// Verify kube-api-access mount on sentinel container
+	var sentinelKubeAPIMountFound bool
+	for _, mount := range sentinelContainer.VolumeMounts {
+		if mount.Name == "kube-api-access" && mount.MountPath == "/var/run/secrets/kubernetes.io/serviceaccount" {
+			sentinelKubeAPIMountFound = true
+			g.Expect(mount.ReadOnly).To(BeTrue())
+			break
+		}
+	}
+	g.Expect(sentinelKubeAPIMountFound).To(BeTrue(), "sentinel container should mount kube-api-access")
+}
diff --git a/internal/redis/volumes.go b/internal/redis/volumes.go
index 1d3812bd..64033ce8 100644
--- a/internal/redis/volumes.go
+++ b/internal/redis/volumes.go
@@ -39,38 +39,6 @@ func getVolumes(r *redisv1.Redis) []corev1.Volume {
 	}
 
 	vols := []corev1.Volume{
-		{
-			Name: "kolla-config",
-			VolumeSource: corev1.VolumeSource{
-				ConfigMap: &corev1.ConfigMapVolumeSource{
-					LocalObjectReference: corev1.LocalObjectReference{
-						Name: fmt.Sprintf("%s-config-data", r.Name),
-					},
-					Items: []corev1.KeyToPath{
-						{
-							Key:  "config.json",
-							Path: "config.json",
-						},
-					},
-				},
-			},
-		},
-		{
-			Name: "kolla-config-sentinel",
-			VolumeSource: corev1.VolumeSource{
-				ConfigMap: &corev1.ConfigMapVolumeSource{
-					LocalObjectReference: corev1.LocalObjectReference{
-						Name: fmt.Sprintf("%s-config-data", r.Name),
-					},
-					Items: []corev1.KeyToPath{
-						{
-							Key:  "config-sentinel.json",
-							Path: "config.json",
-						},
-					},
-				},
-			},
-		},
 		{
 			Name: "generated-config-data",
 			VolumeSource: corev1.VolumeSource{
@@ -172,10 +140,6 @@ func getRedisVolumeMounts(r *redisv1.Redis) []corev1.VolumeMount {
 		MountPath: "/var/lib/operator-scripts",
 		ReadOnly:  true,
 		Name:      "operator-scripts",
-	}, {
-		MountPath: "/var/lib/kolla/config_files",
-		ReadOnly:  true,
-		Name:      "kolla-config",
 	}}
 	vm = append(vm, getTLSVolumeMounts(r)...)
 	return vm
@@ -193,10 +157,6 @@ func getSentinelVolumeMounts(r *redisv1.Redis) []corev1.VolumeMount {
 		MountPath: "/var/lib/operator-scripts",
 		ReadOnly:  true,
 		Name:      "operator-scripts",
-	}, {
-		MountPath: "/var/lib/kolla/config_files",
-		ReadOnly:  true,
-		Name:      "kolla-config-sentinel",
 	}}
 	vm = append(vm, getTLSVolumeMounts(r)...)
 	return vm
diff --git a/templates/memcached/config/config.json b/templates/memcached/config/config.json
deleted file mode 100644
index 70320f3f..00000000
--- a/templates/memcached/config/config.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "command": "bash -c $* -- eval source /etc/sysconfig/memcached; exec /usr/bin/memcached -p ${PORT} -u ${USER} -m ${CACHESIZE} -c ${MAXCONN} $OPTIONS",
-  "config_files": [
-    {
-      "dest": "/",
-      "merge": true,
-      "preserve_properties": true,
-      "source": "/var/lib/kolla/config_files/src/*"
-    },
-    {
-      "source": "/var/lib/config-data/tls/private/memcached.key",
-      "dest": "/etc/pki/tls/private/memcached.key",
-      "owner": "memcached",
-      "perm": "0600",
-      "optional": true
-    },
-    {
-      "source": "/var/lib/config-data/tls/certs/memcached.crt",
-      "dest": "/etc/pki/tls/certs/memcached.crt",
-      "owner": "memcached",
-      "perm": "0755",
-      "optional": true
-    }
-  ]
-}
diff --git a/templates/redis/bin/common.sh b/templates/redis/bin/common.sh
index c9730baa..26fe3a26 100644
--- a/templates/redis/bin/common.sh
+++ b/templates/redis/bin/common.sh
@@ -15,12 +15,12 @@ POD_IP=$(grep "$HOSTNAME" /etc/hosts | awk '{print $1}' | head -1)
 
 if test -d /var/lib/config-data/tls; then
     REDIS_CLI_CMD="redis-cli --tls"
-    REDIS_CONFIG=/var/lib/redis/redis-tls.conf
-    SENTINEL_CONFIG=/var/lib/redis/sentinel-tls.conf
+    REDIS_CONFIG=/var/lib/config-data/generated/var/lib/redis/redis-tls.conf
+    SENTINEL_CONFIG=/var/lib/config-data/generated/var/lib/redis/sentinel-tls.conf
 else
     REDIS_CLI_CMD=redis-cli
-    REDIS_CONFIG=/var/lib/redis/redis.conf
-    SENTINEL_CONFIG=/var/lib/redis/sentinel.conf
+    REDIS_CONFIG=/var/lib/config-data/generated/var/lib/redis/redis.conf
+    SENTINEL_CONFIG=/var/lib/config-data/generated/var/lib/redis/sentinel.conf
 fi
 
 function log() {
diff --git a/templates/redis/bin/start_redis_replication.sh b/templates/redis/bin/start_redis_replication.sh
index edad01da..fd38fe3d 100755
--- a/templates/redis/bin/start_redis_replication.sh
+++ b/templates/redis/bin/start_redis_replication.sh
@@ -3,7 +3,6 @@
 . /var/lib/operator-scripts/common.sh
 
 generate_configs
-sudo -E kolla_set_configs
 
 # 1. check if a redis cluster is already running by contacting sentinel
 output=$(timeout ${TIMEOUT} $REDIS_CLI_CMD -h ${SVC_FQDN} -p 26379 sentinel master redis)
diff --git a/templates/redis/bin/start_sentinel.sh b/templates/redis/bin/start_sentinel.sh
index 91cebd1f..58945562 100755
--- a/templates/redis/bin/start_sentinel.sh
+++ b/templates/redis/bin/start_sentinel.sh
@@ -3,7 +3,6 @@
 . /var/lib/operator-scripts/common.sh
 
 generate_configs
-sudo -E kolla_set_configs
 
 # 1. check if a redis cluster is already running by contacting sentinel
 output=$(timeout ${TIMEOUT} $REDIS_CLI_CMD -h ${SVC_FQDN} -p 26379 sentinel master redis)
diff --git a/templates/redis/config/config-sentinel.json b/templates/redis/config/config-sentinel.json
deleted file mode 100644
index 3b750fd7..00000000
--- a/templates/redis/config/config-sentinel.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "command": "redis-sentinel /var/lib/redis/sentinel.conf",
-  "config_files": [
-    {
-      "dest": "/",
-      "merge": true,
-      "preserve_properties": true,
-      "optional": true,
-      "source": "/var/lib/config-data/generated/*"
-    },
-    {
-      "source": "/var/lib/config-data/tls/private/redis.key",
-      "dest": "/etc/pki/tls/private/redis.key",
-      "owner": "redis",
-      "perm": "0600",
-      "optional": true
-    },
-    {
-      "source": "/var/lib/config-data/tls/certs/redis.crt",
-      "dest": "/etc/pki/tls/certs/redis.crt",
-      "owner": "redis",
-      "perm": "0755",
-      "optional": true
-    }
-  ],
-  "permissions": [
-    {
-      "owner": "redis:redis",
-      "perm": "0755",
-      "path": "/var/lib/redis",
-      "recursive": true
-    }
-  ]
-}
diff --git a/templates/redis/config/config.json b/templates/redis/config/config.json
deleted file mode 100644
index e92c06b0..00000000
--- a/templates/redis/config/config.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "command": "redis-server /var/lib/redis/redis.conf",
-  "config_files": [
-    {
-      "dest": "/",
-      "merge": true,
-      "preserve_properties": true,
-      "optional": true,
-      "source": "/var/lib/config-data/generated/*"
-    },
-    {
-      "source": "/var/lib/config-data/tls/private/redis.key",
-      "dest": "/etc/pki/tls/private/redis.key",
-      "owner": "redis",
-      "perm": "0600",
-      "optional": true
-    },
-    {
-      "source": "/var/lib/config-data/tls/certs/redis.crt",
-      "dest": "/etc/pki/tls/certs/redis.crt",
-      "owner": "redis",
-      "perm": "0755",
-      "optional": true
-    }
-  ],
-  "permissions": [
-    {
-      "owner": "redis:redis",
-      "path": "/var/lib/redis",
-      "recursive": true
-    }
-  ]
-}
diff --git a/templates/redis/config/redis-tls.conf.in b/templates/redis/config/redis-tls.conf.in
index d39f1532..58bc3420 100644
--- a/templates/redis/config/redis-tls.conf.in
+++ b/templates/redis/config/redis-tls.conf.in
@@ -1,9 +1,9 @@
-include /var/lib/redis/redis.conf
+include /var/lib/config-data/generated/var/lib/redis/redis.conf
 
 port 0
 tls-port 6379
-tls-cert-file /etc/pki/tls/certs/redis.crt
-tls-key-file /etc/pki/tls/private/redis.key
+tls-cert-file /var/lib/config-data/tls/certs/redis.crt
+tls-key-file /var/lib/config-data/tls/private/redis.key
 tls-ca-cert-file /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
 tls-replication yes
 tls-auth-clients optional
diff --git a/templates/redis/config/sentinel-tls.conf.in b/templates/redis/config/sentinel-tls.conf.in
index b68ecca1..e2caea96 100644
--- a/templates/redis/config/sentinel-tls.conf.in
+++ b/templates/redis/config/sentinel-tls.conf.in
@@ -1,9 +1,9 @@
-include /var/lib/redis/sentinel.conf
+include /var/lib/config-data/generated/var/lib/redis/sentinel.conf
 
 port 0
 tls-port 26379
-tls-cert-file /etc/pki/tls/certs/redis.crt
-tls-key-file /etc/pki/tls/private/redis.key
+tls-cert-file /var/lib/config-data/tls/certs/redis.crt
+tls-key-file /var/lib/config-data/tls/private/redis.key
 tls-ca-cert-file /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
 tls-replication yes
 tls-auth-clients optional
diff --git a/test/functional/dnsmasq_controller_test.go b/test/functional/dnsmasq_controller_test.go
index 5d9f88af..d0450a7d 100644
--- a/test/functional/dnsmasq_controller_test.go
+++ b/test/functional/dnsmasq_controller_test.go
@@ -112,9 +112,8 @@ var _ = Describe("DNSMasq controller", func() {
 				corev1.ConditionTrue,
 			)
 			role := th.GetRole(dnsMasqRoleName)
-			Expect(role.Rules).To(HaveLen(2))
+			Expect(role.Rules).To(HaveLen(1))
 			Expect(role.Rules[0].Resources).To(Equal([]string{"securitycontextconstraints"}))
-			Expect(role.Rules[1].Resources).To(Equal([]string{"pods"}))
 
 			th.ExpectCondition(
 				dnsMasqName,