Epic - Extend readOnlyRootFileSystem to include NAP WAF when present

[brianehlert]

Discussed in #5156

^{Originally posted by brianehlert February 22, 2024}
Customers use the readOnlyRootFileSystem capability to align with security policy and customers would like to also use this when NAP WAF is included with NIC.

The current implementation of readOnlyRootFileSystem does not support the NAP WAF module and thus the capability needs to be extended to support NAP WAF module behavior and paths necessary.

Notes:

• this can take the v4 / v5 work into consideration
• when originally written the focus was v4
• unknown how this impacts v5 considering new enforcer container is introduced

Tasks

Beta Give feedback

1. POC - readOnlyRootFileSystem to include NAP WAF

WAF v5 considerations

Beta Give feedback

1. Investigate impact of readOnlyRootFileSystem=true now that waf-enforcer and waf-config-mgr are separated from deployments