remove xtables.lock and privileged=true from node-local-dns example

[ghouscht]

As discussed in slack, the node-local-dns cache container does not need the iptables xtables.lock mount and can thus be run unprivileged. This PR fixes the example deployment by removing the mount of the lock and the privileged: true directive.

\cc @Weil0ng

[brb]

Thanks!

[Weil0ng]

Thanks!

[joestringer]

Before we merge, I would like to understand the testing of these changes.

@Weil0ng @aditighag I couldn't find this file being used in CI, do we do integration/regression testing automatically?

@ghouscht what kind of manual testing have you performed while preparing the PR?

[ghouscht]

Probably the only use of this file is here https://docs.cilium.io/en/v1.9/gettingstarted/local-redirect-policy/#node-local-dns-cache. We're currently evaluating node-local-dns in our environment and during review I noticed that the container ran priviledged. This is not necessary since cilium handles traffic redirection (by a local redirect policy) to node-local-dns cache containers and due to that, the container does not need to write iptables rules itself (see also the -setupiptables=false flag). So there is simply no need to mount xtables.lock and running in priviledged mode.

This is also the setup we're currently still testing on our infrastructure and by the time of writing it works as expected.