security(longhorn): retrofit C-0211 onto the default engine-image DaemonSet #4025

🤖 Generated by the Agentic Engineer

Evidence

Measured against live prod on 2026-09-21 at about 16:10Z. The CSI sidecar Deployments (#3953) and the longhorn-csi-plugin DaemonSet (#3999) now carry both C-0211 fields. Since #3967 turned on automatic engine upgrades, the two older engine images lost their last volume reference and Longhorn removed them. Their DaemonSets went with them.

One longhorn-system controller is still missing both fields: DaemonSet/engine-image-ei-493e04e7. That is the default engine image (longhorn-engine v1.12.1), and 70 engines and replicas reference it. Longhorn-manager created it on 2026-08-21, before the namespace opted in, and has not written to it since. So the CREATE and UPDATE opt-in rules never reach it.

Audience and problem

Kubescape scores the stored controller spec. Until this DaemonSet carries both fields, longhorn-system stays in the C-0211 residual.

Expected behaviour

The stored template carries fsGroupChangePolicy and an empty seLinuxOptions on its container. Every existing field stays as it is, and no volume is detached or degraded.

Acceptance criteria

• A mutate-existing retrofit targets exactly this DaemonSet, using its own background-controller grant pinned by resourceNames.
• A regression test pins its scope, its add-only shape, convergence and the grant, and CI runs it.
• After deploy, a live read shows both fields on the stored spec, 4/4 pods ready, and every volume still healthy.

Size

Small. It follows the same pattern as #3999.