opensearch-operator: dnsBase stays cluster.local, so securityadmin never reaches its target on the platform domain #4073

Describe the bug
The vendored opensearch-operator chart sets manager.dnsBase: cluster.local (packages/system/opensearch-operator/charts/opensearch-operator/values.yaml:59, passed to the manager as an env var by the deployment template at line 90). packages/system/opensearch-operator/values.yaml does not override it and the package's only patch is leaderElection.diff. The platform runs on networking.clusterDomain, cozy.local by default (packages/core/platform/values.yaml:62).

At the pinned operator 2.8.0 the securityadmin job targets {svc}.{ns}.svc.{dnsBase}, so on every cluster with the default domain it retries a name that never resolves. Users and roles from the security config never apply, whichever CA signed the admin certificate. #2682 fixes the CA side and states this limitation; the DNS side is this issue.

Environment

• Cozystack main, 2026-09-04
• Any provider with the default cluster domain

To Reproduce

1. Deploy an opensearch application with the security config enabled
2. The securityadmin job in the release namespace retries <release>.<ns>.svc.cluster.local

Expected behaviour
The operator resolves in-cluster names on the platform's domain, and users and roles apply.

Actual behaviour
The job never completes.

Additional context
The platform hands the domain to system packages through the cozystack ConfigMap key cluster-domain (packages/core/platform/templates/apps.yaml:140); the operator package should set manager.dnsBase from it. The SANs of the certificates the operator issues use the same base and need the same fix.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs