security(kubescape): activate the Coroot baseline context with an admission write per template #4028

🤖 Generated by the Agentic Engineer

Evidence

#4007 scoped the controller baseline-context rules to Coroot-generated templates behind the baseline-context-coroot namespace label, and #4016 made every production deploy re-prove convergence while that label is set. The label is still off, so the six Coroot templates still lack both C-0211 fields (#3990).

Switching the label on is not enough by itself, measured against prod on 2026-09-21:

• The rules act on CREATE/UPDATE only, and the operator's last writes to the six templates are 2–7 days old (coroot-operator:Update managed-field times). Nothing writes them during a deploy, so admission never runs and the after-reconcile guard would fail on missing fields.
• Once a write does land, the pods roll. Measured previous rollouts: the node-agent DaemonSet took about 5 minutes across its nodes and the coroot-coroot StatefulSet about 85 seconds. The guard waits only 60 seconds for fields plus a complete rollout.
• coroot-prometheus uses the Recreate strategy, so it has a short gap while it restarts.

Audience and problem

The platform owner's C-0211 exception cannot narrow for observability until these six stored templates carry both fields.

Hypothesis

Setting the label, plus a deploy step that makes one metadata-only write per template still lacking the fields (so admission supplies them) and waits for each rollout, closes all six. The existing guard then proves the operator does not loop.

Success signal

• Observability's C-0211 residual goes from 6 to 0 on the live stored specs.
• Guardrail: the existing guard passes (no repeated owner writes, every Coroot pod Ready), and a later deploy with the fields already present makes no write and restarts nothing.

Acceptance criteria

• The write step only touches templates that lack a field, and a test proves it makes no write when all six already carry them.
• It fails when admission did not add the fields after the write, and when a rollout does not finish within its bound.
• The observability namespace declares the label, and the inventory pin is updated.
• The residual is re-measured after rollout and recorded on security(kubescape): close the Coroot C-0211 residual through a scoped, convergence-proven admission mutation #3990.

The disaster-recovery rebuild is out of scope here: on a fresh cluster the label exists before the operator creates the templates, so CREATE admission applies without a write. Wiring the guard into that workflow stays a separate change.

Size: S.