security(kubescape): close the Coroot C-0211 residual through a scoped, convergence-proven admission mutation #3990

🤖 Generated by the Agentic Engineer

Evidence

Six of the 14 remaining C-0211 workloads are the Coroot stack in observability: the server, prometheus, cluster-agent, node-agent, clickhouse and keeper. All six are templates generated by the Coroot operator. The installed Coroot CRD has no pod-level security field for any component and no field at all for node-agent, so the fix can't be supplied through operator configuration the way it was for the Helm-rendered workloads. Measurement and CRD survey: #3239 (comment).

Audience and problem

Until these six stored templates carry fsGroupChangePolicy and seLinuxOptions, the cluster-wide C-0211 exception can't narrow for observability. docs/baseline-context-rollout.md keeps the namespace-wide baseline-context-controllers switch off because admitting fields the operator didn't set could make it rewrite its objects repeatedly.

Hypothesis

Scoping the existing controller mutation to Coroot-owned controllers (not the whole namespace), and gating it on a preflight / after-apply convergence proof, closes all six without an operator write loop. The operator's current write pattern is bounded: its last writes on these objects are days old despite continuous reconciliation.

Success signal

• The observability residual goes from 6 to 0 under the object-presence predicate, measured on the live stored specs.
• Guardrail: the operator's write count on the six objects doesn't grow across a 30-minute window after apply, and every Coroot pod stays Ready.

Acceptance criteria

• The mutation reaches only Coroot-owned Deployments, StatefulSets and DaemonSets, not other observability workloads.
• A test proves it applies with the scope label present and doesn't apply without it.
• A before-publish and after-reconcile guard, like the Longhorn UI canary's, checks the stored fields and flags an owner that keeps rewriting.
• The residual is re-measured after rollout and recorded on security(kubescape): supply fsGroupChangePolicy and seLinuxOptions to the namespaces the security-context mutation excludes #3239.

Size: M.