security(longhorn): retrofit C-0211 onto the longhorn-csi-plugin DaemonSet #3998

🤖 Generated by the Agentic Engineer

Evidence

Measured against live prod on 2026-09-21: the longhorn-csi-plugin DaemonSet's stored template carries an empty pod securityContext and no container seLinuxOptions. It was created on 2026-08-21, before the longhorn-system baseline-context opt-in (2026-09-06). Its managed fields show no template writer since, so the CREATE/UPDATE opt-in rules never reach it. It is one of the four DaemonSets left in #3918's residual. The other three are the engine-image DaemonSets, which #3966 / #3967 handle.

Audience and problem

Whoever reads the platform's C-0211 posture. This DaemonSet keeps a namespace that has already opted in looking unfinished, and it will not change on its own.

Expected behaviour

The stored DaemonSet template carries fsGroupChangePolicy and container-level seLinuxOptions, and no existing security field changes.

Acceptance criteria

• An exact, add-only mutate-existing retrofit reaches only longhorn-system/longhorn-csi-plugin. It reuses the existing resourceNames-pinned grant and adds no new RBAC.
• A regression test pins scope, shape, convergence and the grant, with ablations recorded.
• After deploy, the live stored spec is read back: both fields present, and the privileged containers unchanged.
• No volume is left detached or degraded after the one-node-at-a-time roll.

Size: S. Part of #3918.