genpolicy: support readonly emptyDir mount

Set emptyDir access based on volume mount readOnly value

Signed-off-by: Saul Paredes <saulparedes@microsoft.com>

src/tools/genpolicy/src/mount_and_storage.rs

@@ -181,6 +181,14 @@ fn get_empty_dir_mount_and_storage(
         &settings_empty_dir.mount_type
     };
 
+    let access = match yaml_mount.readOnly {
+        Some(true) => {
+            debug!("setting read only access for emptyDir mount");
+            "ro"
+        }
+        _ => "rw",
+    };
+
     p_mounts.push(policy::KataMount {
         destination: yaml_mount.mountPath.to_string(),
         type_: mount_type.to_string(),
@@ -188,7 +196,7 @@ fn get_empty_dir_mount_and_storage(
         options: vec![
             "rbind".to_string(),
             "rprivate".to_string(),
-            "rw".to_string(),
+            access.to_string(),
         ],
     });
 }

tests/integration/kubernetes/runtimeclass_workloads/k8s-policy-rc.yaml

@@ -27,6 +27,9 @@ spec:
         volumeMounts:
           - name: host-empty-vol
             mountPath: "/host/cache"
+          - name: host-empty-vol
+            mountPath: "/host/cache-read-only"
+            readOnly: true
           - mountPath: /tmp/results
             name: hostpath-vol
           - mountPath: /tmp/results-read-only