Added ReadOnlyRootFileSystem to the Argo CD components

[anandf]

What type of PR is this?

What does this PR do / why we need it:
Upstream Argo CD has all components running with readOnlyRootFileSystem set to true. For security reasons this needs to be enabled even for the components that are created by the operator.

Application Controller:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/application-controller-deployment/argocd-application-controller-deployment.yaml#L263
Note: Stateful set based application controller does not have this flag set. So need to validate if enabling it will cause any breaking change
https://github.com/argoproj/argo-cd/blob/master/manifests/base/application-controller-deployment/argocd-application-controller-statefulset.yaml
AppSet Controller: https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/applicationset-controller/argocd-applicationset-controller-deployment.yaml#L202
Notification Controller :
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/notification/argocd-notifications-controller-deployment.yaml#L92
Dex:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/dex/argocd-dex-server-deployment.yaml#L34
Redis:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/redis/argocd-redis-deployment.yaml#L31
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/redis/argocd-redis-deployment.yaml#L60
RepoServer:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/repo-server/argocd-repo-server-deployment.yaml#L261
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/repo-server/argocd-repo-server-deployment.yaml#L295
Server:
https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/server/argocd-server-deployment.yaml#L340

Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:

Fixes #?

How to test changes / Special notes to the reviewer:

[svghadi]

Note: Stateful set based application controller does not have this flag set. So need to validate if enabling it will cause any breaking change
https://github.com/argoproj/argo-cd/blob/master/manifests/base/application-controller-deployment/argocd-application-controller-statefulset.yaml

The readonlyfs flag is set for statefulset in install.yaml from github release page. I think it will work, we just need to add some volumes which operator doesn't setup for application-controller.

• readonlyflag: https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/install.yaml#L26179
• additional vols: https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/install.yaml#L26196-L26200

Also, for argocd-server we are missing some mounts

• https://github.com/argoproj/argo-cd/blob/d183d9c614d05979f1327a554942a9e656f1c2ec/manifests/base/server/argocd-server-deployment.yaml#L348-L351

[jgwest]

I have reviewed and the changes LGTM! Nothing jumped out at me as incorrect, and I verified that the volumes/paths we are adding are consistent with what is upstream.

If you haven't already, you may want to run the upstream Argo CD E2E tests (in remote mode[1]) against the argocd-operator, to ensure that we've not regressed any upstream features.

Since this is potentially a risky change, I recommmend NOT backporting this to 1.15.x, and only supporting it in 1.16.x. (Or, at least, not backporting it YET, until it soaks)

[1] https://github.com/argoproj/argo-cd/blob/master/test/remote/README.md or https://gitlab.cee.redhat.com/gitops/gitops-components-automated-testing

[anandf]

/retest

[jgwest]

The latest ApplicationSet updates on PR re: removing unused repo server TLS volume LGTM!

[anandf]

I have reviewed and the changes LGTM! Nothing jumped out at me as incorrect, and I verified that the volumes/paths we are adding are consistent with what is upstream.

If you haven't already, you may want to run the upstream Argo CD E2E tests (in remote mode[1]) against the argocd-operator, to ensure that we've not regressed any upstream features.

Since this is potentially a risky change, I recommmend NOT backporting this to 1.15.x, and only supporting it in 1.16.x. (Or, at least, not backporting it YET, until it soaks)

[1] https://github.com/argoproj/argo-cd/blob/master/test/remote/README.md or https://gitlab.cee.redhat.com/gitops/gitops-components-automated-testing

There is no plan to backport this PR to 1.15.x. It will be only for 1.16.x and future versions.

[svghadi]

Found some issues during testing. I feel we should push this change for 1.17. There could be other issues that crop up after integrating the change with gitops-operator.

[svghadi]

Ran basic upgrade test. Looks good. Thanks @anandf.