Set readOnlyRootFilesystem for deployments to true

[dkwon17]

What does this PR do?

Sets the securityContext.readOnlyRootFilesystem field to true for the controller and webhook deployments.

What issues does this PR fix or reference?

Is it tested? How?

Checkout the PR branch, and run the changes in a cluster:

make install WAIT=true

Verify that the devworkspace-controller-manager and devworkspace-webhook-server deployments have:

securityContext.readOnlyRootFilesystem: true

in their container definitions.

Verify that workspaces can start, stop without issue.

PR Checklist

• E2E tests pass (when PR is ready, comment /test v8-devworkspace-operator-e2e, v8-che-happy-path to trigger)
  • v8-devworkspace-operator-e2e: DevWorkspace e2e test
  • v8-che-happy-path: Happy path for verification integration with Che

[tolusha]

Could you please shed some light on what this fix addresses?

[rohanKanojia]

I tested this PR, and it seems to work as expected.

• devworkspace-webhook-server and devworkspace-controller-manager Deployments have readOnlyRootFilesystem: true ✔️ :

oc get deploy devworkspace-controller-manager -o yaml | grep -A2 readOnlyRootFilesystem    
          readOnlyRootFilesystem: true
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File

 oc get deploy devworkspace-webhook-server -o yaml | grep -A2 readOnlyRootFilesystem       
          readOnlyRootFilesystem: true
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File

• Restarting DevWorkspace multiple times works as expected ✔️

• Basic DevWorkspace testing flow seems to be working ✔️

  • DevWorkspace code-latest applied
  • DevWorkspace code-latest is running
  • Project clone logs are accessible
  • Files modified in workspace
  • Workspace stopped and restarted and is running
  • Changes are still intact after restart
  • Secondary devworkspace created
  • First devworkspace deleted
  • PVC contains only content for second workspace

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dkwon17, rohanKanojia

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dkwon17]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment