fix(security): supply the C-0211 baseline context to longhorn-manager and the driver deployer

[devantler]

🤖 Generated by the Agentic Engineer

Why

Kubescape's C-0211 control still flags the Longhorn storage workloads, because Longhorn's namespace is excluded from the cluster-wide security-context mutation and the chart has no setting for these two fields. This is the Longhorn slice of #3239.

What

Adds the two missing security-context fields to the two remaining workloads the Longhorn chart renders: the storage manager and the driver deployer. Neither pod changes file ownership or SELinux behaviour. The other eight flagged Longhorn workloads are created by Longhorn itself at runtime, so a chart patch cannot reach them; they stay open on #3239.

Operational note: the storage manager restarts node by node when this deploys. Volumes stay attached during that restart.

Part of #3239

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

@devantler I will perform a complete review of PR #3876.

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 339c6eb9-08cb-41b2-9ff4-9e55a6f21d49

📥 Commits

Reviewing files that changed from the base of the PR and between aebd44e and ebdba74.

📒 Files selected for processing (2)

• k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml
• scripts/validate-eks-ci-role-policy/main.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (2)

k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml (1)

224-275: LGTM!

scripts/validate-eks-ci-role-policy/main.go (1)

2547-2578: LGTM!

Also applies to: 2591-2591

---

📝 Walkthrough

Walkthrough

The Longhorn HelmRelease adds Kustomize patches for the manager DaemonSet and driver deployer Deployment. The patches set fsGroupChangePolicy: OnRootMismatch and empty seLinuxOptions fields on specified containers. The EKS CI role policy validator updates the expected and previous rendered surface SHA values and documents the resulting baseline comparison.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to ebdba

The Longhorn security-context patches and corresponding approval baseline update have no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the security fix and the two Longhorn workloads receiving the C-0211 baseline context.
Description check	✅ Passed	The description accurately explains the reason, scope, operational impact, and remaining work for the Longhorn security-context changes.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at ebdba74470ace1128305a986b5da1044d51c58ac

1. Programmatically tested. All CI checks green at this head, including 🔐 Validate Production Authorization after the fingerprint re-approval. ksail workload validate passes locally for both the local and prod overlays.

2. Reviewed. CodeRabbit full review completed at 15:41Z for this head with no actionable comments; 0 review threads.

3. Tried as a user (rendered output, no cluster). I rendered Longhorn chart 1.12.1 and applied this HelmRelease's post-renderer patches. Against the unpatched render, the only additions are:

   • longhorn-manager DaemonSet: pod fsGroupChangePolicy: OnRootMismatch; seLinuxOptions: {} on both containers. privileged: true is kept.
   • longhorn-driver-deployer Deployment: pod fsGroupChangePolicy: OnRootMismatch next to the existing runAsUser: 0; seLinuxOptions: {} on the init container and the main container.
   • longhorn-ui output is unchanged.

   Before the change, prod shows both workloads missing both fields. Neither pod sets an fsGroup, so the ownership policy changes no files.

Scope boundary, measured on prod: longhorn-system has 12 workload controllers. After this change, 4 carry both fields. The remaining 8 (csi-attacher, csi-provisioner, csi-resizer, csi-snapshotter, longhorn-csi-plugin, and three engine-image-* DaemonSets) are created by longhorn-manager at runtime, so a chart post-renderer cannot reach them. They stay open on #3239.