feat(operator): delegate paired empty security contexts

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Part of #206.

Summary of Changes

• implement the MinIO/OpenShift paired empty-object contract at Tenant and Pool scope
• treat securityContext: {} plus containerSecurityContext: {} at the same scope as an explicit platform-admission delegation barrier
• preserve the existing Operator defaults for omitted contexts, lone empty objects, and existing non-empty field-merge overrides
• retain fsGroupChangePolicy: OnRootMismatch while allowing SCC to assign UID, GID, FSGroup, seccomp, and container fields
• keep the conservative RuntimeDefault image compatibility gate when SCC may inject the profile
• add StatefulSet rendering, inheritance, image-gate, compatibility, and rollout tests

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed) — CRD field descriptions and API comments are updated
• CHANGELOG.md updated under [Unreleased] (if user-visible change) — N/A; this repository does not currently contain CHANGELOG.md
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: opt-in workload identity migration with a legacy empty-pair compatibility hazard

Update impact

• Unchanged: Tenants that omit both fields continue to receive UID/GID/FSGroup 10001, runAsNonRoot: true, RuntimeDefault, and the existing container hardening defaults.
• Unchanged: A lone historical {} at either Pod or container level keeps the old defaults. Non-empty Tenant/Pool objects keep RustFS field-merge semantics.
• Changed: An existing same-scope {}/{} pair is reinterpreted from inherited Operator defaults to platform delegation on the first reconcile after upgrade. Its StatefulSet Pod template changes and that Pool rolls. This must not be released as an unqualified patch hotfix.
• Before rollout, operators must inventory paired empty objects at both Tenant and Pool scope. Remove both fields when the fixed defaults should remain; keep the pair only for an admission controller such as OpenShift SCC that supplies equivalent values.
• The controller does not rewrite PVC API objects. However, a newly assigned FSGroup can trigger kubelet/CSI ownership work on first mount; large volumes can start slowly, and incompatible fsGroupPolicy, root-squash, or storage permissions can fail to mount or write.
• Single-replica Tenants can be unavailable during the rollout; multi-replica Tenants temporarily run with reduced capacity.
• Downgrading restores the old interpretation and may reintroduce fixed IDs that SCC rejects. Roll forward, or restore a complete SCC-valid security context before downgrade.
• This aligns the MinIO paired empty-object contract, not every MinIO merge rule: RustFS intentionally retains its existing field merge behavior for non-empty overrides.

OpenShift release blockers

• Current RustFS server images keep /data and /logs as 10001:10001 mode 0750; they are not arbitrary-UID compatible. A RustFS image fix and real OpenShift data read/write validation are prerequisites for claiming end-to-end support.
• The current target is restricted-v2. restricted-v3 additionally requires spec.hostUsers: false and is not covered.
• Real API-server create/get and SSA transition validation for {} preservation is still required before a production release. The generated CRD permits empty objects and the repository CRD consistency test passes, but serde/schema tests are not a substitute for that integration evidence.
• No Console Tenant mode switch is included. Pool-aware configuration remains available through Tenant YAML, avoiding lossy replacement of advanced security fields.

Verification

make pre-commit
cargo test types::v1alpha1::tenant::workloads::tests --lib
cargo test controller_watch_tests::tracked_crds_match_generated_schema --lib
cargo clippy --all-features -- -D warnings

Additional Notes

The OpenShift Chart profile, example, preflight command, and upgrade guide are split into #216. That PR depends on this controller behavior for Tenant workloads.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.