feat(operator): delegate paired empty security contexts

deploy/rustfs-operator/crds/tenant-crd.yaml

@@ -58,8 +58,10 @@ spec:
                 x-kubernetes-list-type: map
               containerSecurityContext:
                 description: |-
-                  Override the default RustFS container SecurityContext for every Pool in this Tenant.
-                  Pool-level values take precedence.
+                  RustFS container SecurityContext overrides for every Pool in this Tenant.
+                  Non-empty values merge by field over operator defaults, with Pool-level values taking
+                  precedence. Setting this and `securityContext` to explicit empty objects resets the
+                  defaults and delegates unspecified values to platform admission.
                 nullable: true
                 properties:
                   allowPrivilegeEscalation:
@@ -1204,7 +1206,9 @@ spec:
                     containerSecurityContext:
                       description: |-
                         RustFS container SecurityContext overrides for this Pool.
-                        Values are merged over Tenant-level container settings and operator defaults.
+                        Non-empty values merge by field over Tenant-level settings and operator defaults. An
+                        explicit empty object paired with an empty `securityContext` resets inherited values and
+                        delegates unspecified values to platform admission.
                       nullable: true
                       properties:
                         allowPrivilegeEscalation:
@@ -1500,7 +1504,9 @@ spec:
                     securityContext:
                       description: |-
                         Pod SecurityContext overrides for this Pool.
-                        Values override Tenant-level Pod SecurityContext settings.
+                        Non-empty values merge by field over Tenant-level settings and operator defaults. An
+                        explicit empty object paired with an empty `containerSecurityContext` resets inherited
+                        values and delegates unspecified values to platform admission.
                       nullable: true
                       properties:
                         fsGroup:
@@ -1700,8 +1706,10 @@ spec:
                 type: string
               securityContext:
                 description: |-
-                  Override the default Pod SecurityContext for every Pool in this Tenant.
-                  Pool-level values take precedence.
+                  Pod SecurityContext overrides for every Pool in this Tenant.
+                  Non-empty values merge by field over operator defaults, with Pool-level values taking
+                  precedence. Setting this and `containerSecurityContext` to explicit empty objects resets
+                  the defaults and delegates unspecified values to platform admission.
                 nullable: true
                 properties:
                   fsGroup:

src/types/v1alpha1/pool.rs

@@ -67,12 +67,16 @@ pub struct Pool {
     pub persistence: PersistenceConfig,
 
     /// Pod SecurityContext overrides for this Pool.
-    /// Values override Tenant-level Pod SecurityContext settings.
+    /// Non-empty values merge by field over Tenant-level settings and operator defaults. An
+    /// explicit empty object paired with an empty `containerSecurityContext` resets inherited
+    /// values and delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub security_context: Option<PodSecurityContextOverride>,
 
     /// RustFS container SecurityContext overrides for this Pool.
-    /// Values are merged over Tenant-level container settings and operator defaults.
+    /// Non-empty values merge by field over Tenant-level settings and operator defaults. An
+    /// explicit empty object paired with an empty `securityContext` resets inherited values and
+    /// delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub container_security_context: Option<corev1::SecurityContext>,
 

src/types/v1alpha1/security_context.rs

@@ -29,9 +29,12 @@ pub(crate) fn effective_run_as_non_root(run_as_user: Option<i64>, explicit: Opti
 
 /// Pod SecurityContext overrides for RustFS pods.
 ///
-/// Overrides the operator defaults (`runAsUser` / `runAsGroup` / `fsGroup` = 10001,
-/// `runAsNonRoot` = true, and `seccompProfile.type` = `RuntimeDefault`).
-#[derive(Deserialize, Serialize, Clone, Debug, KubeSchema, Default)]
+/// A non-empty object overrides the operator defaults (`runAsUser` / `runAsGroup` /
+/// `fsGroup` = 10001, `runAsNonRoot` = true, and `seccompProfile.type` =
+/// `RuntimeDefault`). When both the Pod and container security contexts at the same scope are
+/// explicit empty objects, those values are delegated to the platform, for example to an
+/// OpenShift Security Context Constraint.
+#[derive(Deserialize, Serialize, Clone, Debug, KubeSchema, Default, PartialEq)]
 #[serde(rename_all = "camelCase")]
 pub struct PodSecurityContextOverride {
     /// UID to run the container process as.
@@ -58,9 +61,28 @@ pub struct PodSecurityContextOverride {
     pub seccomp_profile: Option<corev1::SeccompProfile>,
 }
 
+impl PodSecurityContextOverride {
+    /// Returns whether the API object was explicitly supplied without any override fields.
+    pub(crate) fn is_empty(&self) -> bool {
+        self == &Self::default()
+    }
+}
+
 #[cfg(test)]
 mod tests {
-    use super::effective_run_as_non_root;
+    use super::{PodSecurityContextOverride, effective_run_as_non_root};
+
+    #[test]
+    fn empty_override_is_distinct_from_a_partial_override() {
+        assert!(PodSecurityContextOverride::default().is_empty());
+        assert!(
+            !PodSecurityContextOverride {
+                run_as_non_root: Some(true),
+                ..Default::default()
+            }
+            .is_empty()
+        );
+    }
 
     #[test]
     fn effective_run_as_non_root_preserves_legacy_uid_zero() {

src/types/v1alpha1/tenant.rs

@@ -231,13 +231,17 @@ pub struct TenantSpec {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub encryption: Option<EncryptionConfig>,
 
-    /// Override the default Pod SecurityContext for every Pool in this Tenant.
-    /// Pool-level values take precedence.
+    /// Pod SecurityContext overrides for every Pool in this Tenant.
+    /// Non-empty values merge by field over operator defaults, with Pool-level values taking
+    /// precedence. Setting this and `containerSecurityContext` to explicit empty objects resets
+    /// the defaults and delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub security_context: Option<PodSecurityContextOverride>,
 
-    /// Override the default RustFS container SecurityContext for every Pool in this Tenant.
-    /// Pool-level values take precedence.
+    /// RustFS container SecurityContext overrides for every Pool in this Tenant.
+    /// Non-empty values merge by field over operator defaults, with Pool-level values taking
+    /// precedence. Setting this and `securityContext` to explicit empty objects resets the
+    /// defaults and delegates unspecified values to platform admission.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub container_security_context: Option<corev1::SecurityContext>,
 }