security(longhorn): enable automatic engine upgrades so stale engine-image DaemonSets can retire #3966

🤖 Generated by the Agentic Engineer

Evidence

Measured against live prod 2026-09-21T02:05Z, after #3953 merged:

• The four CSI sidecar Deployments now carry both C-0211 fields — security(longhorn): clear the C-0211 residual on the four CSI sidecar Deployments #3946 works as intended.
• The remaining longhorn-system residual is four DaemonSets: longhorn-csi-plugin and three engine-image-ei-* DaemonSets, one per engine version (v1.11.1, v1.12.0, v1.12.1).
• Only v1.12.1 is the default engine image. 10 of 14 volumes still run an older engine (1 on v1.11.1, 9 on v1.12.0), all attached and healthy.
• concurrent-automatic-engine-upgrade-per-node-limit is 0 — the Longhorn default, which disables automatic engine upgrades. So nothing will ever move those volumes, and security(longhorn): clear the pre-opt-in C-0211 residual in longhorn-system without detaching volumes unintentionally #3918's acceptance criterion "retire an engine-image DaemonSet whose version no longer backs a volume" can never be met: every version keeps backing a volume.

Audience and problem

Platform operators. Two of the three engine-image DaemonSets exist only because volumes were never upgraded after chart bumps. They keep the C-0211 residual open, and they leave the cluster running three engine versions at once, which is its own maintenance risk.

Expected behaviour

Longhorn upgrades volume engines to the default engine image on its own, one volume per node at a time, so old engine images lose their last reference and Longhorn removes them.

Acceptance criteria

• Automatic engine upgrade is enabled through the Longhorn HelmRelease with a per-node limit of 1.
• After rollout, all volumes run the default engine image and stay healthy.
• The v1.11.1 and v1.12.0 engine images reach zero references and are removed, taking their DaemonSets with them.

Size: small (one setting), plus post-deploy verification.