feat(operator): Add explicit manifest workload security profiles

[casey-coreweave]

Server images differ in whether they support non-root execution and a read-only
root filesystem. Add an explicit per-application and per-migration server-manifest
contract so Core can select compatible workloads without changing older releases
based on their version string.

securityProfile.runAsNonRoot and securityProfile.readOnlyRootFilesystem are
optional booleans. Omitted/empty profiles preserve legacy rendering; explicit
false is retained. Application profiles cover all containers and init containers.
Migration profiles apply to newly created Jobs without restarting completed
migrations. No numeric pod identity is introduced.

Application fragments merge profile fields in filename order; later explicit
values win. Migration definitions retain their existing whole-entry replacement
semantics. Documentation includes examples, rollback behavior, and image/runtime
requirements. Current Watchtower triage fields and baseline contexts are preserved.

Validation:

• Clean-main manifest/reconciler baseline passed.
• Focused tests cover omission, empty/partial profiles, explicit false, conflicting
  fragments, sizing merge, version independence, single/multiple/init containers,
  migration rendering, completed migrations, and stable reconciliation/rollback.
• make test and make build passed, including vet. Chart dependencies were
  resolved locally; no Chart.lock or generated API changes.
• Current Core manifest plus sizing bundle: all 14 application and 3 migration
  definitions remain unprofiled; application rendering is unchanged across tested
  server versions.

Test output

Selected excerpts from saved validation logs (not a complete log):

$ go test ./pkg/wandb/manifest ./internal/controller/reconciler
ok  github.com/wandb/operator/pkg/wandb/manifest (cached)
ok  github.com/wandb/operator/internal/controller/reconciler 2.217s

# make test — affected-package excerpts; full repository suite passed
ok  github.com/wandb/operator/internal/controller/reconciler (cached) coverage: 43.3% of statements
ok  github.com/wandb/operator/pkg/wandb/manifest (cached) coverage: 46.5% of statements

# make build — final commands; completed successfully
go fmt ./...
go vet ./...
Synced CRDs into internal/crdinstaller/crds/{operator,redis,clickhouse}/
go build -o bin/manager ./cmd/manager
go build -o bin/crd-installer ./cmd/crd-installer

# Current Core manifest + sizing compatibility check
--- PASS: TestCurrentCoreBundleSecurityCompatibility (0.01s)
PASS

# Assertions against captured live resources
PASS: 13 legacy Applications preserve omission; explicit API Application/Deployment/Pod and successful Gorilla migration apply both flags without numeric identities.

# Disposable WESTest explicit-profile scenario
Destroy complete! Resources: 13 destroyed.
[westest] Scenario local-kind-security-profile finished successfully
Explicit operator image load completed: True

[danielpanzella]

would it make sense to make this not be a pointer, since all the values within are pointers it would reduce the amount of nil checks needed, assuming that new values will be added within the struct those might always need explicit behaviors for nil values, it should reduce the complexity abit to remove the outer nil check.

[j7m4]

I toggled both runAsNonRoot and readOnlyRootFilesystem and saw it pick up successfully via tilt. The frontend deployment did take issue with runAsNonRoot so I got confirmation that the rule has applying:

waiting:     
  message: 'container has runAsNonRoot and image has non-numeric user (nginx),                                                                                                                                                  cannot verify user is non-root (pod: "frontend-7b557b5db6-86z6w_wandb(777cff79-56a6-47e4-b7ea-3c2db2d97df9)",

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Local development manifest lookup fails

The renamed fixture no longer matches the version in wandb-dev-v2. Loading that sample from file:///server-manifest fails because its requested version directory is gone.

Learn more

The checked-in wandb-dev-v2 custom resource selects a local, versioned server manifest. The fixture directory was renamed, but that custom resource still names the removed version. LoadManifestFromFile first searches for a matching version file, then a matching directory, and returns an error when neither exists. Local users applying the sample cannot reconcile the deployment.

Example: Apply wandb-dev-v2 with its existing file:///server-manifest repository. It requests 0.84.0-notifications-security-flags.1, but the fixture now exists only under 0.85.1-rc.1790791511, so manifest loading fails.

Recommended fix: Update the version in the checked-in wandb-dev-v2 sample to match the renamed fixture, or retain the old fixture alongside the new one if the sample must continue using the old version.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[j7m4]

Addressed issues raised and verified CIS intended support for 0.85.1 and 0.86.0-daily.14