readOnlyRootFilesystem: always on the busybox init containers, opt-in for the Solr pods #884

#875 makes the generated pods satisfy the Pod Security Standards "restricted" profile by default. readOnlyRootFilesystem is outside that profile, so the PR leaves it as it was: only the setup-zk init container has it, with an emptyDir at /tmp so the Solr CLI has somewhere to write. #801 asks for it on the cp-solr-xml init container, which #874 renamed to volume-prep. This issue covers both the init containers and the Solr pods themselves.

Always set it on the busybox init containers

volume-prep, initdb and create-tls-wrapper-script are busybox sh -c one-liners whose only writes go to mounted volumes, so readOnlyRootFilesystem: true is free for them. The operatorContainers map in controllers/util/security_context_util.go already has a per-container readOnlyRootFilesystem flag, so this is a one-line change per container, and the existing unit tests guard it. gen-pkcs12-keystore runs openssl in the Solr image and writes to a mounted emptyDir; it probably qualifies too, but should be verified against the Solr image's OpenSSL version before it is turned on. This part closes #801.

Opt-in for the Solr pods

The Solr container cannot be made read-only without preparation: only /var/solr/data is a volume, so Solr writes its logs to /var/solr/logs on the root filesystem, and the JVM and Jetty need a temp directory. Custom images and init scripts may write elsewhere under /opt/solr or /var/solr, so this has to be an opt-in rather than a default.

Proposed: a new option in the SolrCloud CRD, e.g. podOptions.readOnlyRootFilesystem: true, exposed as a value in the solr Helm chart. When set, the operator

• sets readOnlyRootFilesystem: true on the Solr container, and
• adds emptyDir volumes for the directories Solr writes to outside the data volume, at least /var/solr/logs, /tmp and whatever Jetty uses for its temp directory, to be determined by running Solr with a read-only root and watching what fails.

The same option should cover the SolrPrometheusExporter, whose container is a JVM with the same /tmp need. Setting containerSecurityContext.readOnlyRootFilesystem: true by hand already works today for users who mount those directories themselves; the option exists so the operator does that for them, and so the combination is tested.

Related: #801, #873, #875.