support restricted option, jolokia agent, rbac, read only root, minimal

[gtully]

No description provided.

[gtully]

this pr includes support for:

• the jolokia client using mtls Enable useClientAuth on console breaks status checks from the operator #1036
• read only root file system support for read only root file-system #1017

[gtully]

I have remove the use of JDK_JAVA_ARGS in restricted mode, possibly, to avoid command line limitations, we may have to push these into a cmd file in the future, but that could also be a secret, as an easy way to supply different values.

[brusdev]

Great work!!! It provides a predictable and secure deployment.

[doxsch]

• the jolokia client using mtls

If I understand the code correctly the mtls jolokia client will only be available in restricted mode. But I think if spec.console.useClientAuth is true, the controller should also use the mtls jolokia client otherwise the issue #1036 won't be fixed.

[gtully]

• the jolokia client using mtls

If I understand the code correctly the mtls jolokia client will only be available in restricted mode. But I think if spec.console.useClientAuth is true, the controller should also use the mtls jolokia client otherwise the issue #1036 won't be fixed.

yes. I think it will be easier to fix #1036 with these changes. But #1036 is not resolved by this change

and thinking some more, maybe the presence of an operator cert and operator trust bundle is sufficient to initiate mtls, if they are present, make use of them.