fix(security): supply the C-0211 baseline context to the kubescape workloads

[devantler]

🤖 Generated by the Agentic Engineer

Why

The Kubescape namespace is excluded from the automatic security-context policy, so its seven workloads never received the two C-0211 fields that every other namespace gets. They are among the last gaps keeping the C-0211 population from closing.

What

Adds the two fields to the Kubescape scanner, vulnerability scanner, operator, storage, both scan schedulers and the node agent. The node agent keeps the SELinux type it needs to watch host processes. Nothing else about the workloads changes, and the pods roll once.

Part of #3239

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review the changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0aa9e4c2-e5f1-490e-8342-63a67021ce62

📥 Commits

Reviewing files that changed from the base of the PR and between bc65ed8 and 3af2e57.

📒 Files selected for processing (2)

• k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml
• scripts/validate-eks-ci-role-policy/main.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (2)

k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml (1)

323-359: LGTM!

scripts/validate-eks-ci-role-policy/main.go (1)

2515-2547: LGTM!

Also applies to: 2560-2560

---

📝 Walkthrough

Walkthrough

The Kubescape HelmRelease adds security-context patches for Deployments, scheduler CronJobs, and the node-agent DaemonSet. Deployments and CronJobs receive fsGroupChangePolicy: OnRootMismatch and empty seLinuxOptions. The node-agent retains its chart-defined spc_t configuration. The EKS CI role policy validator updates the expected and previous rendered-surface fingerprints for this baseline.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 3af2e

The PR applies the intended Kubescape security-context baseline and preserves the node-agent SELinux type. No actionable deployment or policy failure is established; normal validator and CI checks should confirm the updated aggregate.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description directly explains the C-0211 security-context changes for the seven Kubescape workloads and matches the changeset.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding the C-0211 baseline context to Kubescape workloads.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at head 3af2e57843ea209c2e0628bce53b9400070367dc

• Tested: CI green (23 passed, 7 skipped), including production authorization after the fingerprint re-approval. ksail workload validate passes for both local and prod.
• Reviewed: CodeRabbit reviewed this head and posted no actionable comments. 0 review threads.
• Tried as a user: there is no cluster to run, so I inspected the rendered output. I rendered chart kubescape-operator 1.40.4 with this HelmRelease's values and applied its post-renderer patches with kubectl kustomize. All seven workloads now carry fsGroupChangePolicy: OnRootMismatch. The four Deployments and both scheduler CronJobs also carry seLinuxOptions: {}, and node-agent keeps spc_t. The authorization conservation check shows the only rendered difference is these patches: 569 identities, and grant documents hash identically to main.
• Post-deploy: I will confirm the live workload templates and rollout health after merge.