[kubernetes] Auto-propagate infrastructure StorageClasses to tenant clusters #2094

Feature request

Problem

Currently, a tenant Kubernetes cluster only exposes a single hardcoded StorageClass named kubevirt, mapped to the replicated infra StorageClass. Users who have multiple StorageClasses on their infrastructure (e.g., replicated, local-ssd, hdd-archive) cannot access them from within tenant clusters.

Related: #1424

Proposed solution

Use Helm lookup in the management cluster templates to automatically discover all infrastructure StorageClasses and propagate them to tenant clusters via the kubevirt-csi-node chart.

Key changes:

• Auto-discovery: The helmreleases/csi.yaml template uses lookup "storage.k8s.io/v1" "StorageClass" to enumerate all infra StorageClasses at reconciliation time
• Same-name mapping: Each infra StorageClass is created in the tenant with the same name (e.g., replicated stays replicated)
• Default propagation: The storageclass.kubernetes.io/is-default-class annotation is preserved
• Security enforcement: An infraStorageClassEnforcement allowList is auto-generated in the driver-config ConfigMap, restricting tenants to only use propagated StorageClasses
• Fallback: When lookup returns empty (e.g., helm template dry-run), defaults to a single replicated StorageClass
• No Go changes: The kubevirt-csi-driver already supports multiple StorageClasses natively via infraStorageClassName

Breaking changes

The storageClass parameter is removed from the kubernetes chart's values.yaml. Existing deployments that relied on overriding this value will need to be aware that all infra StorageClasses are now auto-propagated. The old single kubevirt StorageClass is replaced by per-infra-class entries.

Affected components

• packages/apps/kubernetes (chart values, HelmRelease template, new ConfigMap)
• packages/system/kubevirt-csi-node (values format, StorageClass loop, enforcement ConfigMap)