Set readOnlyRootFilesystem on controller-manager container

[steveb]

Add readOnlyRootFilesystem: true to the manager container's securityContext to complete the restricted Pod Security Standards profile. Mount an emptyDir at /tmp to support controller-runtime metrics cert auto-generation and Go stdlib temporary file needs.

Jira: OSPRH-33373

Checklist before requesting a review

• I have performed a self-review of my code and confirmed it passes tests
• Performed pre-commit run --all
• Tested operator image in a test/dev environment. It can be CRC via install_yamls or a hotstack instance (optional)
• Verified that no failures present in logs(optional):
  • ironic-operator-build-deploy-kuttl
  • podified-multinode-ironic-deployment

[stuggi]

fyi, for the operators deployed via the openstack-operator, we'd have to make the change there, like openstack-k8s-operators/openstack-operator#2008

[steveb]

/retest

[steveb]

I don't think this one needs to be backported to stable. Landing it gives us kuttl coverage that the operator runs with readOnlyRootFilesystem: true, and the product readOnlyRootFilesystem: true is handled by openstack-k8s-operators/openstack-operator#2008

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mumesan, steveb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [steveb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment