Support security context for enabling readOnlyRootFilesystem across all components

[srinivasmummareddy]

Summary

Add first-class support for configuring securityContext.readOnlyRootFilesystem: true across all GreptimeDB Helm chart components (cluster, standalone, operator) to meet container security best practices and pass security compliance scans.

Problem

Security scanning tools are flagging GreptimeDB pods for not having a read-only root filesystem enabled. The following components are affected:

Affected GreptimeDB components:

• greptimedb-dev-datanode-0
• greptimedb-dev-datanode-1
• greptimedb-dev-datanode-2
• greptimedb-dev-flownode-0
• greptimedb-dev-greptimedb-frontend
• greptimedb-dev-greptimedb-operator

The remediation guidance is: "Handle according to remediation steps and re-deploy."

Current State

The charts currently expose securityContext as an empty object {} in values.yaml for the standalone chart and via podTemplate.main.securityContext for the cluster chart. While users can technically set readOnlyRootFilesystem: true, there is:

• No documentation or guidance on which paths need to remain writable (via emptyDir or persistent volumes).
• No pre-configured tmpDir or writable volume mounts for directories that GreptimeDB needs to write to (e.g., /tmp, log directories, data directories).
• Risk of breaking the application if readOnlyRootFilesystem is enabled without the correct writable volume mounts.

Expected Behavior

• Users should be able to set readOnlyRootFilesystem: true via Helm values for all components (frontend, datanode, flownode, meta, standalone).
• The chart should automatically mount writable emptyDir volumes for paths that require write access (e.g., /tmp, log directories) when readOnlyRootFilesystem is enabled.
• Documentation should clearly describe how to enable this feature and any implications.

Acceptance Criteria

• securityContext.readOnlyRootFilesystem can be set to true for all components without breaking functionality.
• Necessary writable paths are mounted as emptyDir or persistent volumes when readonly filesystem is enabled.
• README / values.yaml documentation updated with examples for enabling readonly root filesystem.
• Default behavior remains unchanged (no breaking change for existing deployments).

References

• Kubernetes Security Context Documentation
• CIS Kubernetes Benchmark - 5.2.4