OpenSearch fails to start in tenant namespaces: privileged init-sysctl violates default baseline PodSecurity #3022

What happens

Deploying the OpenSearch application into a tenant namespace never starts — the opensearch-*-nodes StatefulSet cannot create its pod:

FailedCreate: pods "opensearch-...-nodes-0" is forbidden:
violates PodSecurity "baseline:latest":
privileged (container "init-sysctl" must not set securityContext.privileged=true)

The OpenSearch CR template hardcodes spec.general.setVMMaxMapCount: true (packages/apps/opensearch/templates/opensearch.yaml). The opster operator then injects a privileged init-sysctl initContainer to raise vm.max_map_count. Tenant namespaces enforce PodSecurity baseline by default (no pod-security.kubernetes.io/enforce label on the namespace, so the cluster-wide PSA default applies), which forbids privileged containers.

Result: zero OpenSearch master/data pods. The *-external / *-dashboards-external LoadBalancer services get IPs but their EndpointSlices stay empty, so OpenSearch and Dashboards are unreachable (a plain telnet to the LB port hangs on "Trying"). The OpenSearchCluster CR misleadingly reports Ready: True / PHASE: RUNNING because only the non-privileged securityconfig job runs.

This is an internal contradiction: Cozystack enforces baseline PSA on tenant namespaces but ships an app that requires a privileged initContainer.

Reproduction

On a clean Cozystack 1.4.2 cluster (Kubernetes 1.34), create an OpenSearch app in any tenant namespace:

apiVersion: apps.cozystack.io/v1alpha1
kind: OpenSearch
metadata:
  name: repro-psa
  namespace: tenant-demo
spec:
  replicas: 1
  size: 2Gi
  resourcesPreset: c1.small
  dashboards:
    enabled: true

The opensearch-repro-psa-nodes StatefulSet immediately logs the FailedCreate above and never creates a pod.

Environment

• Reproduced on Cozystack v1.4.2 and v1.4.4
• OpenSearch app (opster operator), default tenant namespace
• Nodes have vm.max_map_count = 65530 (Linux default), so the sysctl init genuinely is needed — it cannot simply be disabled without setting the sysctl elsewhere

Possible fixes

• Set vm.max_map_count=262144 at the node level (Talos sysctl via the Cozystack node config) and set setVMMaxMapCount: false in the package — removes the privileged init entirely.
• Or run the OpenSearch app in a namespace permitted to run privileged.

Workaround (verified)

Raise the tenant namespace PSA to privileged (weakens tenant isolation, per-namespace):

kubectl label ns tenant-demo pod-security.kubernetes.io/enforce=privileged --overwrite

After labelling, the node pod passes Init (the privileged init-sysctl runs), the PVC binds, and the cluster comes up. The label is not reconciled away by the tenant chart (it does not template any pod-security.kubernetes.io/* label).