Use readOnlyRootFilesystem securityContext in data plane pods

[ramperher]

• This intends to fix access-control-security-context-read-only-file-system certsuite test for data plane pods, since this has to fail in controller-manager pods because they require it for reconciliation loop.
• Apart from including readOnlyRootFilesystem securityContext field, it's also needed to define volumes for the directories where there may be modified or newly created files during execution.

Tests:

• Test with loadbalancer only - https://www.distributed-ci.io/jobs/8a1c873b-b672-4134-b2d1-cfecfeabbd95/tests/b5fd50fa-0f4a-46da-87ab-fc48b899bf0b?testcase=access-control-security-context-read-only-file-system
• Test with the other pods - https://www.distributed-ci.io/jobs/fcbf86c6-bdd3-4c9b-9fda-d372b2016f41/tests/75cdc139-9ee7-4ea1-821a-c4dd5e155a59?testcase=access-control-security-context-read-only-file-system

[dcibot]

from change #96:

• FAILURE https://www.distributed-ci.io/jobs/8b5b5dc4-e83b-4dc5-894d-48e217279e7c/jobStates

[dcibot]

from change #96:

• SUCCESS https://www.distributed-ci.io/jobs/8a1c873b-b672-4134-b2d1-cfecfeabbd95/jobStates

[dcibot]

from change #96:

• FAILURE https://www.distributed-ci.io/jobs/6c0005da-7148-4cea-aa6a-206ea89a94e8/jobStates

[ramperher]

from change #96:

• FAILURE https://www.distributed-ci.io/jobs/6c0005da-7148-4cea-aa6a-206ea89a94e8/jobStates

Up to now, testpmd is working but trex is failing. By checking the logs, I've seen the same issue I saw in testpmd logs, complaining about /var/run/dpdk folder:

+ ./_t-rex-64 --cfg /usr/local/bin/example-cnf/trex_cfg.yaml -i --no-hw-flow-stat -c 4                              
Starting  TRex v2.85 please wait  ...
 You might need to run ./trex-cfg  once
EAL: Error creating '/var/run/dpdk': Read-only file system                                                          
EAL: Cannot create runtime directory
EAL: FATAL: Invalid 'command line' arguments.
EAL: Invalid 'command line' arguments.
EAL: Error - exiting with code: 1

So I'll add a volume also in that folder.

[dcibot]

from change #96:

• FAILURE https://www.distributed-ci.io/jobs/115c3535-f992-4512-b8dc-82c543acb1c3/jobStates

[dcibot]

from change #96:

• SUCCESS https://www.distributed-ci.io/jobs/fcbf86c6-bdd3-4c9b-9fda-d372b2016f41/jobStates

[ramperher]

Testing is finished, now the data plane pods are passing this test related to readOnlyRootFilesystem feature, while testpmd is behaving correctly and the result in terms of performance is the same.

I've created this change in dallas-pipelines to reflect this update: https://github.com/dci-labs/dallas-pipelines/pull/1259

[manurodriguez]

LGTM

[manurodriguez]

Here, just for my understanding, I'm curious why you decided to move the trex cfg file to /usr/local/bin/example-cnf/ ?

[ramperher]

Because, if leaving it at /etc/, I would have needed to mount a volume on /etc folder to be able to create that file, and I didn't want to expose the whole /etc directory just for that