feat(operator): delegate paired empty security contexts

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Part of #206.

Summary of Changes

• implement the MinIO/OpenShift paired empty-object contract at Tenant and Pool scope
• treat securityContext: {} plus containerSecurityContext: {} at the same scope as an explicit platform-admission delegation barrier
• preserve the existing Operator defaults for omitted contexts, lone empty objects, and existing non-empty field-merge overrides
• retain fsGroupChangePolicy: OnRootMismatch while allowing SCC to assign UID, GID, FSGroup, seccomp, and container fields
• keep the conservative RuntimeDefault image compatibility gate when SCC may inject the profile
• report delegated security contexts consistently through the Console security-context and encryption APIs, with an unknown effective runAsNonRoot value
• disable the legacy Console field form for delegated Tenants and reject lossy field-based updates in the backend, directing changes to Raw YAML
• add StatefulSet rendering, inheritance, image-gate, Console API/OpenAPI, compatibility, and rollout tests

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (Rust and e2e fmt/clippy/tests plus Console lint/build/format checks)
• Added/updated necessary tests
• Documentation updated (if needed) — CRD field descriptions, API comments, OpenAPI, and Console guidance are updated
• CHANGELOG.md updated under [Unreleased] (if user-visible change) — N/A; this repository does not currently contain CHANGELOG.md
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: opt-in workload identity migration with a legacy empty-pair compatibility hazard

Update impact

• Unchanged: Tenants that omit both fields continue to receive UID/GID/FSGroup 10001, runAsNonRoot: true, RuntimeDefault, and the existing container hardening defaults.
• Unchanged: A lone historical {} at either Pod or container level keeps the old defaults. Non-empty Tenant/Pool objects keep RustFS field-merge semantics.
• Changed: An existing same-scope {}/{} pair is reinterpreted from inherited Operator defaults to platform delegation on the first reconcile after upgrade. Its StatefulSet Pod template changes and that Pool rolls. This must not be released as an unqualified patch hotfix.
• Before rollout, operators must inventory paired empty objects at both Tenant and Pool scope. Remove both fields when the fixed defaults should remain; keep the pair only for an admission controller such as OpenShift SCC that supplies equivalent values.
• The controller does not rewrite PVC API objects. However, a newly assigned FSGroup can trigger kubelet/CSI ownership work on first mount; large volumes can start slowly, and incompatible fsGroupPolicy, root-squash, or storage permissions can fail to mount or write.
• Single-replica Tenants can be unavailable during the rollout; multi-replica Tenants temporarily run with reduced capacity.
• Downgrading restores the old interpretation and may reintroduce fixed IDs that SCC rejects. Roll forward, or restore a complete SCC-valid security context before downgrade.
• This aligns the MinIO paired empty-object contract, not every MinIO merge rule: RustFS intentionally retains its existing field merge behavior for non-empty overrides.

OpenShift release blockers

• Current RustFS server images keep /data and /logs as 10001:10001 mode 0750; they are not arbitrary-UID compatible. A RustFS image fix and real OpenShift data read/write validation are prerequisites for claiming end-to-end support.
• The current target is restricted-v2. restricted-v3 additionally requires spec.hostUsers: false and is not covered.
• Real API-server create/get and SSA transition validation for {} preservation is still required before a production release. The generated CRD permits empty objects and the repository CRD consistency test passes, but serde/schema tests are not a substitute for that integration evidence.
• No Console Tenant mode switch is included. The Console reports the delegated state, disables its legacy field form, and rejects lossy PUTs; changing the paired objects remains available through Tenant YAML. Pool-aware configuration also remains YAML-only.

Verification

make pre-commit
cargo test security_context --lib
cargo test types::v1alpha1::tenant::workloads::tests --lib
cargo test controller_watch_tests::tracked_crds_match_generated_schema --lib
cargo clippy --all-features -- -D warnings

Additional Notes

The OpenShift Chart profile, example, preflight command, and upgrade guide are split into #216. That PR depends on this controller behavior for Tenant workloads.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.

[GatewayJ]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: b5b42cb329

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".