Remove kolla entrypoint pattern, harden SecurityContext

[stuggi]

Eliminate kolla_start/kolla_set_configs and the config.json staging pattern across all 4 cinder workloads (api, scheduler, volume, backup). Configs are now mounted directly to final paths via SubPath volume mounts, removing the need for root privilege escalation at container startup. Cinder's Pattern A conf.d-overlay config mechanism (parent Cinder CR renders global config, each child merges its own snippets into cinder.conf.d) is native to cinder/oslo.config and untouched by this change.

Key changes:

• Replace kolla_start with direct commands per workload (httpd -DFOREGROUND, cinder-scheduler/-volume/-backup --config-dir)
• Remove all KOLLA_CONFIG_STRATEGY env vars and the 5 kolla config.json templates
• Mount configs via SubPath to /etc/cinder/, /etc/httpd/, /etc/my.cnf
• Mount ssl.conf from lib-common CommonTemplates at /etc/httpd/conf.d/ssl.conf to override the RPM-shipped default (which references the non-existent localhost.crt)
• Replace kolla's run-on-host shim copy (multipath/iscsi/lvm tooling for cinder-volume/backup) with SubPath mounts of the existing scripts secret at each host-binary destination path
• Use pod.RestrictiveSecurityContext and RestrictivePodSecurityContext from lib-common for cinder-api/scheduler and both probe sidecars; cinder-volume/backup keep Privileged: true (genuine LVM/iSCSI/ multipath device access need) but now pin RunAsUser/RunAsGroup/ RunAsNonRoot instead of defaulting to root
• Set AutomountServiceAccountToken=false on all workloads
• Import CinderUID from lib-common modules/serviceuser, drop the now-unused local CinderUserID/CinderGroupID constants
• Override TLS CertMount/KeyMount to /etc/pki/tls/ for cinder-api
• Migrate SCC rbacRules from [anyuid, privileged] to [privileged, nonroot-v2] — anyuid is no longer needed anywhere in this repo
• Harden the db-sync/online-data-migrations Job (previously RunAsUser: 0) and db-purge CronJob to the same restrictive context
• Standardize all config-data secret DefaultMode to 0440 (owner-read + group-read) across every volume definition
• Adopt lib-common volume.WritableDirVolume/WritableDirVolumeMount helpers for all emptyDir volumes (tmp, run-httpd, logs), replacing inline EmptyDir constructions with standardized constants
• Update httpd.conf: User/Group cinder, PidFile /run/httpd/httpd.pid, ErrorLog to stderr
• Update functional and kuttl tests

Jira: OSPRH-33504
Jira: OSPRH-33503

Depends-On: openstack-k8s-operators/lib-common#728

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [stuggi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/f499dc51b4404c338a321d654570fa73

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 45m 09s
❌ cinder-operator-kuttl FAILURE in 42m 46s
❌ cinder-operator-tempest FAILURE in 1h 54m 50s