fix: read/write mount mode for init / wait containers. Fixes argoproj…

…#7755

As discussed in argoproj#7755, the `init` / `wait` containers surrounding a
workflow container mount the same volumes as the `main` container, but
without respecting their read/write mode. For environments using PSPs
with read-only allowed host paths, it becomes impossible to run workflows
that use volume mounts (as sidecar containers will violate the PSP).

The original code author (@jessesuen) claims that mounts need to be
read/write to allow overlapping mount paths. However, the `main`
container will already need to mount paths in read/write mode if they
overlap, so there does not seem to be a good reason for keeping this.

Fixes argoproj#7755

Signed-off-by: louisblin <[email protected]>

workflow/controller/workflowpod.go

@@ -1018,8 +1018,6 @@ func addOutputArtifactsVolumes(pod *apiv1.Pod, tmpl *wfv1.Template) {
 				continue
 			}
 			mnt.MountPath = filepath.Join(common.ExecutorMainFilesystemDir, mnt.MountPath)
-			// ReadOnly is needed to be false for overlapping volume mounts
-			mnt.ReadOnly = false
 			waitCtr.VolumeMounts = append(waitCtr.VolumeMounts, mnt)
 		}
 	}