From 436192a00ee87bdbcd0176efb02ae96ff2c1c63f Mon Sep 17 00:00:00 2001
From: GatewayJ <18332154+GatewayJ@users.noreply.github.com>
Date: Sun, 19 Jul 2026 01:47:06 +0800
Subject: [PATCH 1/2] fix(operator): support restricted pod security

---
 Cargo.lock                                    |   11 +
 Cargo.toml                                    |    1 +
 .../[name]/tenant-detail-client.tsx           |   97 +-
 .../app/(dashboard)/tenants/new/page.tsx      |  227 +--
 console-web/i18n/locales/en-US.json           |    5 +-
 console-web/i18n/locales/zh-CN.json           |    6 +-
 console-web/lib/api.ts                        |    4 +
 console-web/package.json                      |    3 +-
 console-web/pnpm-lock.yaml                    |   10 -
 console-web/types/api.ts                      |   13 +-
 deploy/rustfs-operator/README.md              |   58 +-
 deploy/rustfs-operator/crds/tenant-crd.yaml   |  290 ++-
 deploy/rustfs-operator/crds/tenant.yaml       |  290 ++-
 deploy/rustfs-operator/templates/NOTES.txt    |    2 +-
 docs/operator-user-guide.md                   |  123 +-
 docs/operator-user-guide.zh-CN.md             |  106 +-
 e2e/Cargo.lock                                |   11 +
 e2e/FAULT_TESTING.md                          |    5 +-
 e2e/README.md                                 |   10 +-
 e2e/src/framework/cert_manager_tls.rs         |    2 +-
 e2e/src/framework/config.rs                   |    2 +-
 e2e/src/framework/images.rs                   |    2 +-
 e2e/src/framework/kind.rs                     |   17 +-
 e2e/src/framework/resources.rs                |   59 +-
 e2e/src/framework/tenant_factory.rs           |   33 +-
 examples/README.md                            |    2 +-
 examples/cert-manager-ca-trust-tenant.yaml    |    2 +-
 examples/cluster-expansion-tenant.yaml        |    2 +-
 examples/custom-rbac-tenant.yaml              |    6 +-
 examples/geographic-pools-tenant.yaml         |    2 +-
 examples/hardware-pools-tenant.yaml           |    2 +-
 examples/minimal-dev-tenant.yaml              |    2 +-
 examples/multi-cert-tls-tenant.yaml           |    2 +-
 examples/multi-pool-tenant.yaml               |    2 +-
 examples/production-ha-tenant.yaml            |    2 +-
 examples/provisioning-tenant.yaml             |    2 +-
 examples/secret-credentials-tenant.yaml       |    4 +-
 examples/simple-tenant.yaml                   |   15 +-
 examples/spot-instance-tenant.yaml            |    2 +-
 examples/tenant-4nodes.yaml                   |    4 +-
 src/console/handlers/encryption.rs            |    9 +
 src/console/handlers/mod.rs                   |   17 +
 src/console/handlers/pools.rs                 |   55 +-
 src/console/handlers/security_context.rs      |  239 ++-
 src/console/handlers/tenants.rs               |  904 ++++++++-
 src/console/models/encryption.rs              |  136 +-
 src/console/models/tenant.rs                  |    6 +-
 src/console/openapi.rs                        |   46 +
 src/console/routes/mod.rs                     |    4 +
 src/context.rs                                |    2 +
 src/lib.rs                                    |   17 +
 src/reconcile.rs                              |    8 +
 src/reconcile/phases.rs                       |    7 +
 src/reconcile/pool_lifecycle.rs               |    2 +
 src/status.rs                                 |   56 +
 src/tests.rs                                  |    2 +
 src/types/error.rs                            |    6 +
 src/types/v1alpha1.rs                         |   91 +
 src/types/v1alpha1/encryption.rs              |   26 +-
 src/types/v1alpha1/pool.rs                    |   13 +
 src/types/v1alpha1/security_context.rs        |   77 +
 src/types/v1alpha1/status.rs                  |   18 +
 src/types/v1alpha1/tenant.rs                  |   14 +-
 src/types/v1alpha1/tenant/helper.rs           |    2 +-
 src/types/v1alpha1/tenant/workloads.rs        | 1736 ++++++++++++++++-
 65 files changed, 4438 insertions(+), 493 deletions(-)
 create mode 100644 src/types/v1alpha1/security_context.rs

diff --git a/Cargo.lock b/Cargo.lock
index 2a603c8..4c580cb 100755
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1655,6 +1655,7 @@ dependencies = [
  "rustls-webpki",
  "schemars",
  "serde",
+ "serde_ignored",
  "serde_json",
  "serde_yaml_ng",
  "sha2",
@@ -2307,6 +2308,16 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "serde_ignored"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115dffd5f3853e06e746965a20dcbae6ee747ae30b543d91b0e089668bb07798"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.148"
diff --git a/Cargo.toml b/Cargo.toml
index a28e532..2cc7b66 100755
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,6 +19,7 @@ futures = "0.3.31"
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.22", features = ["env-filter"] }
 serde_json = "1.0.148"
+serde_ignored = "0.1.14"
 serde_yaml_ng = "0.10.0"
 strum = { version = "0.27.2", features = ["derive"] }
 k8s-openapi = { version = "0.26.1", features = ["v1_30", "schemars"] }
diff --git a/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx b/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx
index f3534fe..10468f7 100644
--- a/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx
+++ b/console-web/app/(dashboard)/tenants/[namespace]/[name]/tenant-detail-client.tsx
@@ -33,6 +33,7 @@ import type {
   AddPoolRequest,
   EncryptionInfoResponse,
   UpdateEncryptionRequest,
+  UpdateSecurityContextRequest,
   ProvisioningItemStatus,
 } from "@/types/api"
 import { ApiError } from "@/lib/api-client"
@@ -115,6 +116,42 @@ function provisioningItemDetails(item: ProvisioningItemStatus): string {
   return details.length > 0 ? details.join(" ") : "-"
 }
 
+type RunAsNonRootMode = "default" | "true" | "false"
+
+interface SecurityContextFormState {
+  runAsUser: string
+  runAsGroup: string
+  fsGroup: string
+  runAsNonRoot: RunAsNonRootMode
+}
+
+type SecurityContextDirtyFields = Record<keyof SecurityContextFormState, boolean>
+
+const cleanSecurityContextDirtyFields = (): SecurityContextDirtyFields => ({
+  runAsUser: false,
+  runAsGroup: false,
+  fsGroup: false,
+  runAsNonRoot: false,
+})
+
+function nullableInteger(value: string): number | null {
+  return value.trim() === "" ? null : Number.parseInt(value, 10)
+}
+
+function buildSecurityContextUpdate(
+  form: SecurityContextFormState,
+  dirty: SecurityContextDirtyFields,
+): UpdateSecurityContextRequest {
+  const update: UpdateSecurityContextRequest = {}
+  if (dirty.runAsUser) update.runAsUser = nullableInteger(form.runAsUser)
+  if (dirty.runAsGroup) update.runAsGroup = nullableInteger(form.runAsGroup)
+  if (dirty.fsGroup) update.fsGroup = nullableInteger(form.fsGroup)
+  if (dirty.runAsNonRoot) {
+    update.runAsNonRoot = form.runAsNonRoot === "default" ? null : form.runAsNonRoot === "true"
+  }
+  return update
+}
+
 export function TenantDetailClient({ namespace, name, initialTab, initialYamlEditable }: TenantDetailClientProps) {
   const router = useRouter()
   const { t } = useTranslation()
@@ -173,12 +210,13 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
   const [secCtxLoaded, setSecCtxLoaded] = useState(false)
   const [secCtxLoading, setSecCtxLoading] = useState(false)
   const [secCtxSaving, setSecCtxSaving] = useState(false)
-  const [secCtx, setSecCtx] = useState({
+  const [secCtx, setSecCtx] = useState<SecurityContextFormState>({
     runAsUser: "",
     runAsGroup: "",
     fsGroup: "",
-    runAsNonRoot: true,
+    runAsNonRoot: "default",
   })
+  const [secCtxDirty, setSecCtxDirty] = useState<SecurityContextDirtyFields>(cleanSecurityContextDirtyFields)
 
   const loadTenant = async () => {
     const [detailResult, poolResult, podResult] = await Promise.allSettled([
@@ -297,6 +335,11 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
     loadSecurityContext()
   }, [tab, secCtxLoaded, secCtxLoading]) // eslint-disable-line react-hooks/exhaustive-deps -- only lazy-load once per tenant
 
+  useEffect(() => {
+    setSecCtxLoaded(false)
+    setSecCtxDirty(cleanSecurityContextDirtyFields())
+  }, [namespace, name])
+
   const loadSecurityContext = async () => {
     setSecCtxLoading(true)
     try {
@@ -305,8 +348,9 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
         runAsUser: data.runAsUser?.toString() ?? "",
         runAsGroup: data.runAsGroup?.toString() ?? "",
         fsGroup: data.fsGroup?.toString() ?? "",
-        runAsNonRoot: data.runAsNonRoot ?? true,
+        runAsNonRoot: data.runAsNonRoot === null ? "default" : data.runAsNonRoot ? "true" : "false",
       })
+      setSecCtxDirty(cleanSecurityContextDirtyFields())
     } catch (e) {
       const err = e as ApiError
       toast.error(err.message || t("Failed to load security context"))
@@ -320,12 +364,8 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
     e.preventDefault()
     setSecCtxSaving(true)
     try {
-      await api.updateSecurityContext(namespace, name, {
-        runAsUser: secCtx.runAsUser ? parseInt(secCtx.runAsUser, 10) : undefined,
-        runAsGroup: secCtx.runAsGroup ? parseInt(secCtx.runAsGroup, 10) : undefined,
-        fsGroup: secCtx.fsGroup ? parseInt(secCtx.fsGroup, 10) : undefined,
-        runAsNonRoot: secCtx.runAsNonRoot,
-      })
+      await api.updateSecurityContext(namespace, name, buildSecurityContextUpdate(secCtx, secCtxDirty))
+      await loadSecurityContext()
       toast.success(t("SecurityContext updated"))
     } catch (e) {
       const err = e as ApiError
@@ -1248,7 +1288,7 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
             <CardTitle className="text-base">{t("SecurityContext")}</CardTitle>
             <CardDescription>
               {t(
-                "Override Pod SecurityContext for RustFS pods (runAsUser, runAsGroup, fsGroup). Changes apply after Pods are recreated.",
+                "Override Pod SecurityContext UID/GID fields. Use Raw YAML for seccomp, container, and Pool-level settings. Changes apply after Pods are recreated.",
               )}
             </CardDescription>
           </CardHeader>
@@ -1267,7 +1307,10 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                       type="number"
                       placeholder="10001"
                       value={secCtx.runAsUser}
-                      onChange={(e) => setSecCtx((s) => ({ ...s, runAsUser: e.target.value }))}
+                      onChange={(e) => {
+                        setSecCtx((s) => ({ ...s, runAsUser: e.target.value }))
+                        setSecCtxDirty((dirty) => ({ ...dirty, runAsUser: true }))
+                      }}
                     />
                   </div>
                   <div className="space-y-2">
@@ -1276,7 +1319,10 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                       type="number"
                       placeholder="10001"
                       value={secCtx.runAsGroup}
-                      onChange={(e) => setSecCtx((s) => ({ ...s, runAsGroup: e.target.value }))}
+                      onChange={(e) => {
+                        setSecCtx((s) => ({ ...s, runAsGroup: e.target.value }))
+                        setSecCtxDirty((dirty) => ({ ...dirty, runAsGroup: true }))
+                      }}
                     />
                   </div>
                   <div className="space-y-2">
@@ -1285,20 +1331,29 @@ export function TenantDetailClient({ namespace, name, initialTab, initialYamlEdi
                       type="number"
                       placeholder="10001"
                       value={secCtx.fsGroup}
-                      onChange={(e) => setSecCtx((s) => ({ ...s, fsGroup: e.target.value }))}
+                      onChange={(e) => {
+                        setSecCtx((s) => ({ ...s, fsGroup: e.target.value }))
+                        setSecCtxDirty((dirty) => ({ ...dirty, fsGroup: true }))
+                      }}
                     />
                   </div>
-                  <div className="flex items-end gap-3 pb-2">
-                    <label htmlFor="sec-nonroot" className="text-sm whitespace-nowrap">
+                  <div className="space-y-2">
+                    <label htmlFor="sec-nonroot" className="text-sm font-medium whitespace-nowrap">
                       {t("Do not run as Root")}
                     </label>
-                    <input
+                    <select
                       id="sec-nonroot"
-                      type="checkbox"
-                      checked={secCtx.runAsNonRoot}
-                      onChange={(e) => setSecCtx((s) => ({ ...s, runAsNonRoot: e.target.checked }))}
-                      className="h-4 w-4 rounded border-border"
-                    />
+                      value={secCtx.runAsNonRoot}
+                      onChange={(e) => {
+                        setSecCtx((s) => ({ ...s, runAsNonRoot: e.target.value as RunAsNonRootMode }))
+                        setSecCtxDirty((dirty) => ({ ...dirty, runAsNonRoot: true }))
+                      }}
+                      className="dark:bg-input/30 border-input h-8 w-full rounded-none border bg-transparent px-2.5 text-xs outline-none"
+                    >
+                      <option value="default">{t("Default")}</option>
+                      <option value="true">true</option>
+                      <option value="false">false</option>
+                    </select>
                   </div>
                 </div>
                 <div className="flex gap-2">
diff --git a/console-web/app/(dashboard)/tenants/new/page.tsx b/console-web/app/(dashboard)/tenants/new/page.tsx
index 325bee8..cced639 100644
--- a/console-web/app/(dashboard)/tenants/new/page.tsx
+++ b/console-web/app/(dashboard)/tenants/new/page.tsx
@@ -3,7 +3,6 @@
 import { useState } from "react"
 import { useRouter } from "next/navigation"
 import Link from "next/link"
-import { parse } from "yaml"
 import { useTranslation } from "react-i18next"
 import { toast } from "sonner"
 import { RiArrowLeftLine } from "@remixicon/react"
@@ -16,18 +15,12 @@ import { Label } from "@/components/ui/label"
 import { Spinner } from "@/components/ui/spinner"
 import { routes } from "@/lib/routes"
 import * as api from "@/lib/api"
-import type {
-  CreatePoolRequest,
-  CreateTenantRequest,
-  ProvisioningBucket,
-  ProvisioningPolicy,
-  ProvisioningUser,
-} from "@/types/api"
+import type { CreatePoolRequest, CreateTenantRequest, TenantListItem } from "@/types/api"
 import { ApiError } from "@/lib/api-client"
 
 type CreateMode = "form" | "yaml"
 
-const DEFAULT_RUSTFS_IMAGE = "rustfs/rustfs:latest"
+const DEFAULT_RUSTFS_IMAGE = "rustfs/rustfs:1.0.0-beta.10"
 
 const defaultPool: CreatePoolRequest = {
   name: "pool-0",
@@ -59,37 +52,6 @@ spec:
               storage: 10Gi
 `
 
-function asRecord(value: unknown): Record<string, unknown> | null {
-  if (typeof value !== "object" || value == null || Array.isArray(value)) return null
-  return value as Record<string, unknown>
-}
-
-function asString(value: unknown): string | undefined {
-  if (typeof value !== "string") return undefined
-  const trimmed = value.trim()
-  return trimmed ? trimmed : undefined
-}
-
-function asPositiveInt(value: unknown): number | undefined {
-  if (typeof value === "number" && Number.isInteger(value) && value > 0) return value
-  if (typeof value === "string") {
-    const parsed = Number.parseInt(value, 10)
-    if (Number.isInteger(parsed) && parsed > 0) return parsed
-  }
-  return undefined
-}
-
-function asBoolean(value: unknown): boolean | undefined {
-  if (typeof value === "boolean") return value
-  return undefined
-}
-
-function asStringArray(value: unknown): string[] | undefined {
-  if (!Array.isArray(value)) return undefined
-  const values = value.map(asString)
-  return values.every((item): item is string => !!item) ? values : undefined
-}
-
 export default function TenantCreatePage() {
   const { t } = useTranslation()
   const router = useRouter()
@@ -130,179 +92,15 @@ export default function TenantCreatePage() {
     setPools((prev) => prev.filter((_, i) => i !== index))
   }
 
-  const parseYamlToCreateRequest = (rawYaml: string): CreateTenantRequest => {
-    let doc: unknown
-    try {
-      doc = parse(rawYaml)
-    } catch {
-      throw new Error(t("YAML format is invalid"))
-    }
-
-    const root = asRecord(doc)
-    if (!root) {
-      throw new Error(t("YAML format is invalid"))
-    }
-
-    const metadata = asRecord(root.metadata)
-    const spec = asRecord(root.spec)
-    const apiVersion = asString(root.apiVersion)
-    const kind = asString(root.kind)
-    const parsedName = asString(metadata?.name)
-    const parsedNamespace = asString(metadata?.namespace)
-
-    if (apiVersion !== "rustfs.com/v1alpha1" || kind !== "Tenant") {
-      throw new Error(t("YAML must be a rustfs.com/v1alpha1 Tenant"))
-    }
-
-    if (!parsedName || !parsedNamespace) {
-      throw new Error(t("YAML must include metadata.name and metadata.namespace"))
-    }
-
-    const poolsRaw = spec?.pools
-    if (!Array.isArray(poolsRaw) || poolsRaw.length === 0) {
-      throw new Error(t("YAML must include spec.pools with at least one item"))
-    }
-
-    const parsedPools: CreatePoolRequest[] = poolsRaw.map((poolItem, index) => {
-      const pool = asRecord(poolItem)
-      const persistence = asRecord(pool?.persistence)
-      const volumeClaimTemplate = asRecord(persistence?.volumeClaimTemplate ?? persistence?.volume_claim_template)
-      const resources = asRecord(volumeClaimTemplate?.resources)
-      const requests = asRecord(resources?.requests)
-      const servers = asPositiveInt(pool?.servers)
-      const volumesPerServer = asPositiveInt(
-        pool?.volumesPerServer ??
-          pool?.volumes_per_server ??
-          persistence?.volumesPerServer ??
-          persistence?.volumes_per_server,
-      )
-      const storageSize = asString(pool?.storageSize ?? pool?.storage_size ?? pool?.size ?? requests?.storage)
-
-      if (!pool || !servers || !volumesPerServer || !storageSize) {
-        throw new Error(t("YAML pool fields are invalid"))
-      }
-
-      return {
-        name: asString(pool.name) ?? `pool-${index}`,
-        servers,
-        volumes_per_server: volumesPerServer,
-        storage_size: storageSize,
-        storage_class:
-          asString(
-            pool.storageClass ??
-              pool.storage_class ??
-              volumeClaimTemplate?.storageClassName ??
-              volumeClaimTemplate?.storage_class_name,
-          ) || undefined,
-      }
-    })
-
-    const specSc = asRecord(spec?.securityContext ?? spec?.security_context)
-    const credsSecretRef = asRecord(spec?.credsSecret ?? spec?.creds_secret)
-    const security_context = specSc
-      ? {
-          runAsUser: asPositiveInt(specSc.runAsUser ?? specSc.run_as_user),
-          runAsGroup: asPositiveInt(specSc.runAsGroup ?? specSc.run_as_group),
-          fsGroup: asPositiveInt(specSc.fsGroup ?? specSc.fs_group),
-          runAsNonRoot:
-            typeof specSc.runAsNonRoot === "boolean"
-              ? specSc.runAsNonRoot
-              : typeof specSc.run_as_non_root === "boolean"
-                ? specSc.run_as_non_root
-                : true,
-        }
-      : undefined
-
-    const policiesRaw = spec?.policies
-    const policies = Array.isArray(policiesRaw)
-      ? policiesRaw.map((item): ProvisioningPolicy => {
-          const policy = asRecord(item)
-          const document = asRecord(policy?.document)
-          const configMapKeyRef = asRecord(document?.configMapKeyRef ?? document?.config_map_key_ref)
-          const policyName = asString(policy?.name)
-          const configMapName = asString(configMapKeyRef?.name)
-          const key = asString(configMapKeyRef?.key)
-          if (!policy || !policyName || !configMapName || !key) {
-            throw new Error(t("YAML policy provisioning fields are invalid"))
-          }
-          return {
-            name: policyName,
-            document: {
-              configMapKeyRef: {
-                name: configMapName,
-                key,
-              },
-            },
-          }
-        })
-      : undefined
-
-    const usersRaw = spec?.users
-    const users = Array.isArray(usersRaw)
-      ? usersRaw.map((item): ProvisioningUser => {
-          const user = asRecord(item)
-          const userName = asString(user?.name)
-          const userPolicies = asStringArray(user?.policies)
-          const rawCredsSecret = user?.credsSecret ?? user?.creds_secret
-          const credsSecret = asRecord(rawCredsSecret)
-          const credsSecretName = asString(credsSecret?.name)
-          if (
-            !user ||
-            !userName ||
-            !userPolicies ||
-            userPolicies.length === 0 ||
-            (rawCredsSecret != null && !credsSecretName)
-          ) {
-            throw new Error(t("YAML user provisioning fields are invalid"))
-          }
-          return {
-            name: userName,
-            credsSecret: credsSecretName ? { name: credsSecretName } : undefined,
-            policies: userPolicies,
-          }
-        })
-      : undefined
-
-    const bucketsRaw = spec?.buckets
-    const buckets = Array.isArray(bucketsRaw)
-      ? bucketsRaw.map((item): ProvisioningBucket => {
-          const bucket = asRecord(item)
-          const bucketName = asString(bucket?.name)
-          if (!bucket || !bucketName) {
-            throw new Error(t("YAML bucket provisioning fields are invalid"))
-          }
-          return {
-            name: bucketName,
-            region: asString(bucket.region),
-            objectLock: asBoolean(bucket.objectLock ?? bucket.object_lock),
-          }
-        })
-      : undefined
-
-    return {
-      name: parsedName,
-      namespace: parsedNamespace,
-      pools: parsedPools,
-      image: asString(spec?.image),
-      mount_path: asString(spec?.mountPath ?? spec?.mount_path),
-      creds_secret: asString(spec?.credsSecret ?? spec?.creds_secret) ?? asString(credsSecretRef?.name),
-      policies,
-      users,
-      buckets,
-      security_context,
-    }
-  }
-
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault()
     setLoading(true)
 
     try {
-      let requestBody: CreateTenantRequest
+      let createdTenant: TenantListItem
 
       if (mode === "yaml") {
-        // Create-by-YAML endpoint is pending; convert YAML to current JSON create payload.
-        requestBody = parseYamlToCreateRequest(yamlContent)
+        createdTenant = await api.createTenantYaml({ yaml: yamlContent })
       } else {
         if (!name.trim()) {
           toast.warning(t("Tenant name is required"))
@@ -317,7 +115,7 @@ export default function TenantCreatePage() {
           toast.warning(t("Image is required"))
           return
         }
-        requestBody = {
+        const requestBody: CreateTenantRequest = {
           name: name.trim(),
           namespace: namespace.trim(),
           pools: pools.map((p) => ({
@@ -333,11 +131,11 @@ export default function TenantCreatePage() {
             runAsNonRoot: securityContext.runAsNonRoot,
           },
         }
+        createdTenant = await api.createTenant(requestBody)
       }
 
-      await api.createTenant(requestBody)
       toast.success(t("Tenant created"))
-      router.push(routes.tenantDetail(requestBody.namespace, requestBody.name))
+      router.push(routes.tenantDetail(createdTenant.namespace, createdTenant.name))
     } catch (e) {
       const err = e as ApiError
       const fallback = e instanceof Error ? e.message : t("Create failed")
@@ -411,8 +209,13 @@ export default function TenantCreatePage() {
                     required
                     value={image}
                     onChange={(e) => setImage(e.target.value)}
-                    placeholder="rustfs/rustfs:latest"
+                    placeholder="rustfs/rustfs:1.0.0-beta.10"
                   />
+                  <p className="text-xs text-muted-foreground">
+                    {t(
+                      "Use YAML mode for custom repositories, mutable tags, or digest-qualified images and set runtime-default-image-ack to the exact image reference.",
+                    )}
+                  </p>
                 </div>
                 <div className="space-y-2">
                   <Label htmlFor="creds">
@@ -432,7 +235,9 @@ export default function TenantCreatePage() {
               <CardHeader>
                 <CardTitle className="text-base">{t("SecurityContext")}</CardTitle>
                 <CardDescription>
-                  {t("Override Pod SecurityContext for RustFS pods (default: 10001/10001/10001). Optional.")}
+                  {t(
+                    "Override Pod SecurityContext UID/GID fields (default: 10001/10001/10001). Use YAML mode for seccomp, container, and Pool-level settings. Optional.",
+                  )}
                 </CardDescription>
               </CardHeader>
               <CardContent className="space-y-4">
diff --git a/console-web/i18n/locales/en-US.json b/console-web/i18n/locales/en-US.json
index b426bcd..a2730c7 100755
--- a/console-web/i18n/locales/en-US.json
+++ b/console-web/i18n/locales/en-US.json
@@ -147,6 +147,7 @@
   "Tenant name is required": "Tenant name is required",
   "Namespace is required": "Namespace is required",
   "Image is required": "Image is required",
+  "Use YAML mode for custom repositories, mutable tags, or digest-qualified images and set runtime-default-image-ack to the exact image reference.": "Use YAML mode for custom repositories, mutable tags, or digest-qualified images and set runtime-default-image-ack to the exact image reference.",
   "Delete tenant \"{{name}}\"? This cannot be undone.": "Delete tenant \"{{name}}\"? This cannot be undone.",
   "Overview": "Overview",
   "Events": "Events",
@@ -249,9 +250,11 @@
   "Vault endpoint is required": "Vault endpoint is required",
   "Security": "Security",
   "SecurityContext": "SecurityContext",
-  "Override Pod SecurityContext for RustFS pods (runAsUser, runAsGroup, fsGroup). Changes apply after Pods are recreated.": "Override Pod SecurityContext for RustFS pods (runAsUser, runAsGroup, fsGroup). Changes apply after Pods are recreated.",
+  "Override Pod SecurityContext UID/GID fields (default: 10001/10001/10001). Use YAML mode for seccomp, container, and Pool-level settings. Optional.": "Override Pod SecurityContext UID/GID fields (default: 10001/10001/10001). Use YAML mode for seccomp, container, and Pool-level settings. Optional.",
+  "Override Pod SecurityContext UID/GID fields. Use Raw YAML for seccomp, container, and Pool-level settings. Changes apply after Pods are recreated.": "Override Pod SecurityContext UID/GID fields. Use Raw YAML for seccomp, container, and Pool-level settings. Changes apply after Pods are recreated.",
   "SecurityContext updated": "SecurityContext updated",
   "Failed to load security context": "Failed to load security context",
   "Do not run as Root": "Do not run as Root",
+  "Default": "Default",
   "Loading...": "Loading..."
 }
diff --git a/console-web/i18n/locales/zh-CN.json b/console-web/i18n/locales/zh-CN.json
index a36ca4e..9270ef4 100755
--- a/console-web/i18n/locales/zh-CN.json
+++ b/console-web/i18n/locales/zh-CN.json
@@ -147,6 +147,7 @@
   "Tenant name is required": "请输入租户名称",
   "Namespace is required": "请输入命名空间",
   "Image is required": "请输入镜像名称",
+  "Use YAML mode for custom repositories, mutable tags, or digest-qualified images and set runtime-default-image-ack to the exact image reference.": "自定义仓库、可变标签或 digest 镜像请使用 YAML 模式，并将 runtime-default-image-ack 设置为完全相同的镜像引用。",
   "Delete tenant \"{{name}}\"? This cannot be undone.": "确定删除租户「{{name}}」？此操作不可恢复。",
   "Overview": "概览",
   "Events": "事件",
@@ -248,11 +249,12 @@
   "Health check interval for KMS connectivity.": "KMS 连通性健康检查间隔。",
   "Security": "安全",
   "SecurityContext": "SecurityContext",
-  "Override Pod SecurityContext for RustFS pods (default: 10001/10001/10001).": "覆盖 RustFS Pod 的 SecurityContext（默认：10001/10001/10001）。",
-  "Override Pod SecurityContext for RustFS pods (runAsUser, runAsGroup, fsGroup). Changes apply after Pods are recreated.": "覆盖 RustFS Pod 的 SecurityContext（runAsUser、runAsGroup、fsGroup）。修改后需等 Pod 重建后生效。",
+  "Override Pod SecurityContext UID/GID fields (default: 10001/10001/10001). Use YAML mode for seccomp, container, and Pool-level settings. Optional.": "覆盖 Pod SecurityContext 的 UID/GID 字段（默认：10001/10001/10001）。如需配置 seccomp、容器级和 Pool 级设置，请使用 YAML 模式。可选。",
+  "Override Pod SecurityContext UID/GID fields. Use Raw YAML for seccomp, container, and Pool-level settings. Changes apply after Pods are recreated.": "覆盖 Pod SecurityContext 的 UID/GID 字段。如需配置 seccomp、容器级和 Pool 级设置，请使用原始 YAML。修改将在 Pod 重建后生效。",
   "SecurityContext updated": "SecurityContext 已更新",
   "Failed to load security context": "加载 SecurityContext 失败",
   "Do not run as Root": "禁止以 Root 运行",
+  "Default": "默认值",
   "Custom Certificates": "自定义证书",
   "Vault endpoint is required": "Vault 端点地址不能为空",
   "Secret must contain 'vault-approle-id' and 'vault-approle-secret'.": "Secret 必须包含 'vault-approle-id' 和 'vault-approle-secret'。",
diff --git a/console-web/lib/api.ts b/console-web/lib/api.ts
index 36a690d..1bde767 100644
--- a/console-web/lib/api.ts
+++ b/console-web/lib/api.ts
@@ -70,6 +70,10 @@ export async function createTenant(body: CreateTenantRequest): Promise<TenantLis
   return apiClient.post<TenantListItem>("/tenants", body)
 }
 
+export async function createTenantYaml(body: TenantYamlPayload): Promise<TenantListItem> {
+  return apiClient.post<TenantListItem>("/tenants/yaml", body)
+}
+
 export async function updateTenant(
   namespace: string,
   name: string,
diff --git a/console-web/package.json b/console-web/package.json
index c86b3f2..7236743 100755
--- a/console-web/package.json
+++ b/console-web/package.json
@@ -32,8 +32,7 @@
     "react-dom": "19.2.3",
     "react-i18next": "^16.5.4",
     "sonner": "^2.0.7",
-    "tailwind-merge": "^3.4.0",
-    "yaml": "^2.8.2"
+    "tailwind-merge": "^3.4.0"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
diff --git a/console-web/pnpm-lock.yaml b/console-web/pnpm-lock.yaml
index 0ea81d7..1f3ebbb 100755
--- a/console-web/pnpm-lock.yaml
+++ b/console-web/pnpm-lock.yaml
@@ -50,9 +50,6 @@ importers:
       tailwind-merge:
         specifier: ^3.4.0
         version: 3.4.0
-      yaml:
-        specifier: ^2.8.2
-        version: 2.8.2
     devDependencies:
       '@tailwindcss/postcss':
         specifier: ^4
@@ -3757,11 +3754,6 @@ packages:
   yallist@3.1.1:
     resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
 
-  yaml@2.8.2:
-    resolution: {integrity: sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==}
-    engines: {node: '>= 14.6'}
-    hasBin: true
-
   yargs-parser@21.1.1:
     resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
     engines: {node: '>=12'}
@@ -7817,8 +7809,6 @@ snapshots:
 
   yallist@3.1.1: {}
 
-  yaml@2.8.2: {}
-
   yargs-parser@21.1.1: {}
 
   yargs@17.7.2:
diff --git a/console-web/types/api.ts b/console-web/types/api.ts
index bb73ef5..4e48ed5 100644
--- a/console-web/types/api.ts
+++ b/console-web/types/api.ts
@@ -413,6 +413,7 @@ export interface SecurityContextInfo {
   runAsGroup: number | null
   fsGroup: number | null
   runAsNonRoot: boolean | null
+  effectiveRunAsNonRoot: boolean
 }
 
 export interface EncryptionInfoResponse {
@@ -449,10 +450,14 @@ export interface EncryptionUpdateResponse {
 }
 
 export interface UpdateSecurityContextRequest {
-  runAsUser?: number
-  runAsGroup?: number
-  fsGroup?: number
-  runAsNonRoot?: boolean
+  /** Omit to preserve, null to clear, or provide a value to set. */
+  runAsUser?: number | null
+  /** Omit to preserve, null to clear, or provide a value to set. */
+  runAsGroup?: number | null
+  /** Omit to preserve, null to clear, or provide a value to set. */
+  fsGroup?: number | null
+  /** Omit to preserve, null to restore the Operator default, or provide a value to set. */
+  runAsNonRoot?: boolean | null
 }
 
 export interface SecurityContextUpdateResponse {
diff --git a/deploy/rustfs-operator/README.md b/deploy/rustfs-operator/README.md
index 978fa7c..85494e5 100755
--- a/deploy/rustfs-operator/README.md
+++ b/deploy/rustfs-operator/README.md
@@ -335,12 +335,62 @@ kubectl apply -f examples/simple-tenant.yaml
 To upgrade the operator:
 
 ```bash
-kubectl apply -f deploy/rustfs-operator/crds/tenant-crd.yaml
-helm upgrade rustfs-operator deploy/rustfs-operator/
+kubectl apply --server-side --force-conflicts \
+  --field-manager=rustfs-operator-crd-upgrade \
+  -f deploy/rustfs-operator/crds/tenant.yaml
+kubectl apply --server-side --force-conflicts \
+  --field-manager=rustfs-operator-crd-upgrade \
+  -f deploy/rustfs-operator/crds/policybinding-crd.yaml
+helm upgrade rustfs-operator deploy/rustfs-operator/ \
+  --namespace rustfs-system
 ```
 
-Helm does not upgrade CRDs from the chart's `crds/` directory. Apply the updated Tenant CRD and wait for the operator rollout before using newly introduced Tenant fields such as `users[].credsSecret`.
-Existing manifests that omit the field remain compatible. Older operator binaries ignore the reference and continue using the same-name Secret convention, so complete the rollout before relying on it.
+Helm does not upgrade existing CRDs from a chart's `crds/` directory. Apply the
+cluster-scoped CRDs first so the API server accepts fields introduced by the
+new Operator version. The dedicated field manager deliberately takes ownership
+of the chart-managed CRD fields, including CRDs originally created by Helm.
+
+This release adds secure defaults to generated RustFS Pods and containers.
+Existing compatible Tenants whose StatefulSet templates do not already contain
+those values will roll on their next reconciliation. Schedule the upgrade in a
+maintenance window: a single-replica Tenant can be unavailable during restart,
+and a multi-replica Tenant temporarily runs with reduced capacity. Verify every
+Tenant image first. Known incompatible images are blocked before rollout, and
+mutable tags, digest references, or custom repositories are blocked under an
+effective `RuntimeDefault` profile unless the Tenant carries an image-bound
+acknowledgement. Before upgrade, either pin a verified RustFS beta.9-or-later
+release tag, or verify the effective image and set
+`operator.rustfs.com/runtime-default-image-ack` to that exact image reference:
+
+```yaml
+metadata:
+  annotations:
+    operator.rustfs.com/runtime-default-image-ack: "registry.example.com/rustfs/rustfs@sha256:<digest>"
+spec:
+  image: "registry.example.com/rustfs/rustfs@sha256:<digest>"
+```
+
+The annotation must change when the image reference changes and cannot override
+a known-incompatible official alpha or beta.1 through beta.8 reference that is
+not digest-qualified. For `tag@digest`, Kubernetes pulls by digest; after
+verifying that exact digest, acknowledge the complete reference. Mutable tags can
+change content without changing the annotation, so prefer an immutable digest
+in production.
+
+The built-in RustFS image fallback also changes from the mutable `latest` tag to
+`rustfs/rustfs:1.0.0-beta.10`. Tenants without `spec.image` and without a
+`TENANT_RUSTFS_IMAGE` Operator environment override roll to that pinned release
+on reconciliation. Set `spec.image` explicitly to control future server upgrades.
+
+Treat this as a one-way workload security migration. Once this Operator has
+reconciled a Tenant, do not downgrade directly to a version that predates the
+restricted defaults: restricted admission rejects the older workload template,
+while clusters without that admission can roll back to weaker settings. Recover
+by rolling forward to this version or a newer fixed version.
+
+Existing manifests that omit `users[].credsSecret` remain compatible. Wait for
+the new Operator rollout to complete before relying on an explicit user Secret
+reference; older binaries continue using the same-name Secret convention.
 
 ## Console UI
 
diff --git a/deploy/rustfs-operator/crds/tenant-crd.yaml b/deploy/rustfs-operator/crds/tenant-crd.yaml
index 0a1bc1f..986f5e5 100644
--- a/deploy/rustfs-operator/crds/tenant-crd.yaml
+++ b/deploy/rustfs-operator/crds/tenant-crd.yaml
@@ -57,6 +57,113 @@ spec:
                 x-kubernetes-list-map-keys:
                 - name
                 x-kubernetes-list-type: map
+              containerSecurityContext:
+                description: |-
+                  Override the default RustFS container SecurityContext for every Pool in this Tenant.
+                  Pool-level values take precedence.
+                nullable: true
+                properties:
+                  allowPrivilegeEscalation:
+                    description: 'AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.'
+                    type: boolean
+                  appArmorProfile:
+                    description: appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of AppArmor profile will be applied. Valid options are:
+                            Localhost - a profile pre-loaded on the node.
+                            RuntimeDefault - the container runtime's default profile.
+                            Unconfined - no AppArmor enforcement.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  capabilities:
+                    description: The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      add:
+                        description: Added capabilities
+                        items:
+                          type: string
+                        type: array
+                      drop:
+                        description: Removed capabilities
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  privileged:
+                    description: Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
+                    type: boolean
+                  procMount:
+                    description: procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
+                    type: string
+                  readOnlyRootFilesystem:
+                    description: Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
+                    type: boolean
+                  runAsGroup:
+                    description: The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  runAsNonRoot:
+                    description: Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                    type: boolean
+                  runAsUser:
+                    description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  seLinuxOptions:
+                    description: The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      level:
+                        description: Level is SELinux level label that applies to the container.
+                        type: string
+                      role:
+                        description: Role is a SELinux role label that applies to the container.
+                        type: string
+                      type:
+                        description: Type is a SELinux type label that applies to the container.
+                        type: string
+                      user:
+                        description: User is a SELinux user label that applies to the container.
+                        type: string
+                    type: object
+                  seccompProfile:
+                    description: The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                          Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  windowsOptions:
+                    description: The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
+                    properties:
+                      gmsaCredentialSpec:
+                        description: GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
+                        type: string
+                      gmsaCredentialSpecName:
+                        description: GMSACredentialSpecName is the name of the GMSA credential spec to use.
+                        type: string
+                      hostProcess:
+                        description: HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
+                        type: boolean
+                      runAsUserName:
+                        description: The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: string
+                    type: object
+                type: object
               createServiceAccountRbac:
                 nullable: true
                 type: boolean
@@ -1092,6 +1199,113 @@ spec:
                               type: array
                           type: object
                       type: object
+                    containerSecurityContext:
+                      description: |-
+                        RustFS container SecurityContext overrides for this Pool.
+                        Values are merged over Tenant-level container settings and operator defaults.
+                      nullable: true
+                      properties:
+                        allowPrivilegeEscalation:
+                          description: 'AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.'
+                          type: boolean
+                        appArmorProfile:
+                          description: appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            localhostProfile:
+                              description: localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
+                              type: string
+                            type:
+                              description: |-
+                                type indicates which kind of AppArmor profile will be applied. Valid options are:
+                                  Localhost - a profile pre-loaded on the node.
+                                  RuntimeDefault - the container runtime's default profile.
+                                  Unconfined - no AppArmor enforcement.
+                              type: string
+                          required:
+                          - type
+                          type: object
+                        capabilities:
+                          description: The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            add:
+                              description: Added capabilities
+                              items:
+                                type: string
+                              type: array
+                            drop:
+                              description: Removed capabilities
+                              items:
+                                type: string
+                              type: array
+                          type: object
+                        privileged:
+                          description: Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
+                          type: boolean
+                        procMount:
+                          description: procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
+                          type: string
+                        readOnlyRootFilesystem:
+                          description: Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
+                          type: boolean
+                        runAsGroup:
+                          description: The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                          format: int64
+                          type: integer
+                        runAsNonRoot:
+                          description: Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          type: boolean
+                        runAsUser:
+                          description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                          format: int64
+                          type: integer
+                        seLinuxOptions:
+                          description: The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            level:
+                              description: Level is SELinux level label that applies to the container.
+                              type: string
+                            role:
+                              description: Role is a SELinux role label that applies to the container.
+                              type: string
+                            type:
+                              description: Type is a SELinux type label that applies to the container.
+                              type: string
+                            user:
+                              description: User is a SELinux user label that applies to the container.
+                              type: string
+                          type: object
+                        seccompProfile:
+                          description: The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            localhostProfile:
+                              description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                              type: string
+                            type:
+                              description: |-
+                                type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                                Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                              type: string
+                          required:
+                          - type
+                          type: object
+                        windowsOptions:
+                          description: The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
+                          properties:
+                            gmsaCredentialSpec:
+                              description: GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
+                              type: string
+                            gmsaCredentialSpecName:
+                              description: GMSACredentialSpecName is the name of the GMSA credential spec to use.
+                              type: string
+                            hostProcess:
+                              description: HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
+                              type: boolean
+                            runAsUserName:
+                              description: The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                              type: string
+                          type: object
+                      type: object
                     name:
                       maxLength: 63
                       minLength: 1
@@ -1281,6 +1495,54 @@ spec:
                           description: 'Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                           type: object
                       type: object
+                    securityContext:
+                      description: |-
+                        Pod SecurityContext overrides for this Pool.
+                        Values override Tenant-level Pod SecurityContext settings.
+                      nullable: true
+                      properties:
+                        fsGroup:
+                          description: GID applied to all volumes mounted in the Pod (`fsGroup`).
+                          format: int64
+                          maximum: 2147483647.0
+                          minimum: 0.0
+                          nullable: true
+                          type: integer
+                        runAsGroup:
+                          description: GID to run the container process as.
+                          format: int64
+                          maximum: 2147483647.0
+                          minimum: 0.0
+                          nullable: true
+                          type: integer
+                        runAsNonRoot:
+                          description: Enforce non-root execution.
+                          nullable: true
+                          type: boolean
+                        runAsUser:
+                          description: UID to run the container process as.
+                          format: int64
+                          maximum: 2147483647.0
+                          minimum: 0.0
+                          nullable: true
+                          type: integer
+                        seccompProfile:
+                          description: Seccomp profile applied to all containers in the Pod.
+                          nullable: true
+                          properties:
+                            localhostProfile:
+                              description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                              type: string
+                            type:
+                              description: |-
+                                type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                                Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                              type: string
+                          required:
+                          - type
+                          type: object
+                      type: object
                     servers:
                       format: int32
                       type: integer
@@ -1437,29 +1699,51 @@ spec:
                 type: string
               securityContext:
                 description: |-
-                  Override the default Pod SecurityContext (runAsUser/runAsGroup/fsGroup = 10001).
-                  Applies to all RustFS pods in this Tenant.
+                  Override the default Pod SecurityContext for every Pool in this Tenant.
+                  Pool-level values take precedence.
                 nullable: true
                 properties:
                   fsGroup:
                     description: GID applied to all volumes mounted in the Pod (`fsGroup`).
                     format: int64
+                    maximum: 2147483647.0
+                    minimum: 0.0
                     nullable: true
                     type: integer
                   runAsGroup:
                     description: GID to run the container process as.
                     format: int64
+                    maximum: 2147483647.0
+                    minimum: 0.0
                     nullable: true
                     type: integer
                   runAsNonRoot:
-                    description: 'Enforce non-root execution (default in the operator: `true` when set).'
+                    description: Enforce non-root execution.
                     nullable: true
                     type: boolean
                   runAsUser:
                     description: UID to run the container process as.
                     format: int64
+                    maximum: 2147483647.0
+                    minimum: 0.0
                     nullable: true
                     type: integer
+                  seccompProfile:
+                    description: Seccomp profile applied to all containers in the Pod.
+                    nullable: true
+                    properties:
+                      localhostProfile:
+                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                          Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                        type: string
+                    required:
+                    - type
+                    type: object
                 type: object
               serviceAccountName:
                 nullable: true
diff --git a/deploy/rustfs-operator/crds/tenant.yaml b/deploy/rustfs-operator/crds/tenant.yaml
index 0a1bc1f..986f5e5 100755
--- a/deploy/rustfs-operator/crds/tenant.yaml
+++ b/deploy/rustfs-operator/crds/tenant.yaml
@@ -57,6 +57,113 @@ spec:
                 x-kubernetes-list-map-keys:
                 - name
                 x-kubernetes-list-type: map
+              containerSecurityContext:
+                description: |-
+                  Override the default RustFS container SecurityContext for every Pool in this Tenant.
+                  Pool-level values take precedence.
+                nullable: true
+                properties:
+                  allowPrivilegeEscalation:
+                    description: 'AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.'
+                    type: boolean
+                  appArmorProfile:
+                    description: appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of AppArmor profile will be applied. Valid options are:
+                            Localhost - a profile pre-loaded on the node.
+                            RuntimeDefault - the container runtime's default profile.
+                            Unconfined - no AppArmor enforcement.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  capabilities:
+                    description: The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      add:
+                        description: Added capabilities
+                        items:
+                          type: string
+                        type: array
+                      drop:
+                        description: Removed capabilities
+                        items:
+                          type: string
+                        type: array
+                    type: object
+                  privileged:
+                    description: Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
+                    type: boolean
+                  procMount:
+                    description: procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
+                    type: string
+                  readOnlyRootFilesystem:
+                    description: Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
+                    type: boolean
+                  runAsGroup:
+                    description: The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  runAsNonRoot:
+                    description: Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                    type: boolean
+                  runAsUser:
+                    description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                    format: int64
+                    type: integer
+                  seLinuxOptions:
+                    description: The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      level:
+                        description: Level is SELinux level label that applies to the container.
+                        type: string
+                      role:
+                        description: Role is a SELinux role label that applies to the container.
+                        type: string
+                      type:
+                        description: Type is a SELinux type label that applies to the container.
+                        type: string
+                      user:
+                        description: User is a SELinux user label that applies to the container.
+                        type: string
+                    type: object
+                  seccompProfile:
+                    description: The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
+                    properties:
+                      localhostProfile:
+                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                          Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                        type: string
+                    required:
+                    - type
+                    type: object
+                  windowsOptions:
+                    description: The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
+                    properties:
+                      gmsaCredentialSpec:
+                        description: GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
+                        type: string
+                      gmsaCredentialSpecName:
+                        description: GMSACredentialSpecName is the name of the GMSA credential spec to use.
+                        type: string
+                      hostProcess:
+                        description: HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
+                        type: boolean
+                      runAsUserName:
+                        description: The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                        type: string
+                    type: object
+                type: object
               createServiceAccountRbac:
                 nullable: true
                 type: boolean
@@ -1092,6 +1199,113 @@ spec:
                               type: array
                           type: object
                       type: object
+                    containerSecurityContext:
+                      description: |-
+                        RustFS container SecurityContext overrides for this Pool.
+                        Values are merged over Tenant-level container settings and operator defaults.
+                      nullable: true
+                      properties:
+                        allowPrivilegeEscalation:
+                          description: 'AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.'
+                          type: boolean
+                        appArmorProfile:
+                          description: appArmorProfile is the AppArmor options to use by this container. If set, this profile overrides the pod's appArmorProfile. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            localhostProfile:
+                              description: localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is "Localhost".
+                              type: string
+                            type:
+                              description: |-
+                                type indicates which kind of AppArmor profile will be applied. Valid options are:
+                                  Localhost - a profile pre-loaded on the node.
+                                  RuntimeDefault - the container runtime's default profile.
+                                  Unconfined - no AppArmor enforcement.
+                              type: string
+                          required:
+                          - type
+                          type: object
+                        capabilities:
+                          description: The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            add:
+                              description: Added capabilities
+                              items:
+                                type: string
+                              type: array
+                            drop:
+                              description: Removed capabilities
+                              items:
+                                type: string
+                              type: array
+                          type: object
+                        privileged:
+                          description: Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
+                          type: boolean
+                        procMount:
+                          description: procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
+                          type: string
+                        readOnlyRootFilesystem:
+                          description: Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
+                          type: boolean
+                        runAsGroup:
+                          description: The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                          format: int64
+                          type: integer
+                        runAsNonRoot:
+                          description: Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                          type: boolean
+                        runAsUser:
+                          description: The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                          format: int64
+                          type: integer
+                        seLinuxOptions:
+                          description: The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container.  May also be set in PodSecurityContext.  If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            level:
+                              description: Level is SELinux level label that applies to the container.
+                              type: string
+                            role:
+                              description: Role is a SELinux role label that applies to the container.
+                              type: string
+                            type:
+                              description: Type is a SELinux type label that applies to the container.
+                              type: string
+                            user:
+                              description: User is a SELinux user label that applies to the container.
+                              type: string
+                          type: object
+                        seccompProfile:
+                          description: The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
+                          properties:
+                            localhostProfile:
+                              description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                              type: string
+                            type:
+                              description: |-
+                                type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                                Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                              type: string
+                          required:
+                          - type
+                          type: object
+                        windowsOptions:
+                          description: The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
+                          properties:
+                            gmsaCredentialSpec:
+                              description: GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
+                              type: string
+                            gmsaCredentialSpecName:
+                              description: GMSACredentialSpecName is the name of the GMSA credential spec to use.
+                              type: string
+                            hostProcess:
+                              description: HostProcess determines if a container should be run as a 'Host Process' container. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
+                              type: boolean
+                            runAsUserName:
+                              description: The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
+                              type: string
+                          type: object
+                      type: object
                     name:
                       maxLength: 63
                       minLength: 1
@@ -1281,6 +1495,54 @@ spec:
                           description: 'Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                           type: object
                       type: object
+                    securityContext:
+                      description: |-
+                        Pod SecurityContext overrides for this Pool.
+                        Values override Tenant-level Pod SecurityContext settings.
+                      nullable: true
+                      properties:
+                        fsGroup:
+                          description: GID applied to all volumes mounted in the Pod (`fsGroup`).
+                          format: int64
+                          maximum: 2147483647.0
+                          minimum: 0.0
+                          nullable: true
+                          type: integer
+                        runAsGroup:
+                          description: GID to run the container process as.
+                          format: int64
+                          maximum: 2147483647.0
+                          minimum: 0.0
+                          nullable: true
+                          type: integer
+                        runAsNonRoot:
+                          description: Enforce non-root execution.
+                          nullable: true
+                          type: boolean
+                        runAsUser:
+                          description: UID to run the container process as.
+                          format: int64
+                          maximum: 2147483647.0
+                          minimum: 0.0
+                          nullable: true
+                          type: integer
+                        seccompProfile:
+                          description: Seccomp profile applied to all containers in the Pod.
+                          nullable: true
+                          properties:
+                            localhostProfile:
+                              description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                              type: string
+                            type:
+                              description: |-
+                                type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                                Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                              type: string
+                          required:
+                          - type
+                          type: object
+                      type: object
                     servers:
                       format: int32
                       type: integer
@@ -1437,29 +1699,51 @@ spec:
                 type: string
               securityContext:
                 description: |-
-                  Override the default Pod SecurityContext (runAsUser/runAsGroup/fsGroup = 10001).
-                  Applies to all RustFS pods in this Tenant.
+                  Override the default Pod SecurityContext for every Pool in this Tenant.
+                  Pool-level values take precedence.
                 nullable: true
                 properties:
                   fsGroup:
                     description: GID applied to all volumes mounted in the Pod (`fsGroup`).
                     format: int64
+                    maximum: 2147483647.0
+                    minimum: 0.0
                     nullable: true
                     type: integer
                   runAsGroup:
                     description: GID to run the container process as.
                     format: int64
+                    maximum: 2147483647.0
+                    minimum: 0.0
                     nullable: true
                     type: integer
                   runAsNonRoot:
-                    description: 'Enforce non-root execution (default in the operator: `true` when set).'
+                    description: Enforce non-root execution.
                     nullable: true
                     type: boolean
                   runAsUser:
                     description: UID to run the container process as.
                     format: int64
+                    maximum: 2147483647.0
+                    minimum: 0.0
                     nullable: true
                     type: integer
+                  seccompProfile:
+                    description: Seccomp profile applied to all containers in the Pod.
+                    nullable: true
+                    properties:
+                      localhostProfile:
+                        description: localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must be set if type is "Localhost". Must NOT be set for any other type.
+                        type: string
+                      type:
+                        description: |-
+                          type indicates which kind of seccomp profile will be applied. Valid options are:
+
+                          Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.
+                        type: string
+                    required:
+                    - type
+                    type: object
                 type: object
               serviceAccountName:
                 nullable: true
diff --git a/deploy/rustfs-operator/templates/NOTES.txt b/deploy/rustfs-operator/templates/NOTES.txt
index 614126e..91c3351 100755
--- a/deploy/rustfs-operator/templates/NOTES.txt
+++ b/deploy/rustfs-operator/templates/NOTES.txt
@@ -21,7 +21,7 @@ To create a Tenant resource:
     name: example-tenant
     namespace: default
   spec:
-    image: rustfs/rustfs:latest
+    image: rustfs/rustfs:1.0.0-beta.10
     pools:
       - name: pool-0
         servers: 2
diff --git a/docs/operator-user-guide.md b/docs/operator-user-guide.md
index 8d3bc3b..4dd4bb0 100644
--- a/docs/operator-user-guide.md
+++ b/docs/operator-user-guide.md
@@ -90,13 +90,51 @@ kubectl logs -n rustfs-system \
 Upgrade an existing installation:
 
 ```bash
-kubectl apply -f deploy/rustfs-operator/crds/tenant-crd.yaml
+# Helm does not upgrade CRDs stored in a chart's crds/ directory.
+kubectl apply --server-side --force-conflicts \
+  --field-manager=rustfs-operator-crd-upgrade \
+  -f deploy/rustfs-operator/crds/tenant.yaml
+kubectl apply --server-side --force-conflicts \
+  --field-manager=rustfs-operator-crd-upgrade \
+  -f deploy/rustfs-operator/crds/policybinding-crd.yaml
 helm upgrade rustfs-operator deploy/rustfs-operator/ \
   --namespace rustfs-system
 ```
 
-Helm does not upgrade CRDs from a chart's `crds/` directory. Apply the updated Tenant CRD before using fields introduced by a newer operator version, then wait for the operator rollout to complete.
-Existing Tenant manifests that omit newer optional fields require no migration. Do not rely on `users[].credsSecret` while any older operator binary is still reconciling the Tenant, because older versions use the same-name Secret convention.
+Apply the CRDs before upgrading the Operator so the API server accepts fields
+introduced by the new controller version. Review CRD changes carefully; CRDs
+are cluster-scoped and shared by all Tenant namespaces. The dedicated field
+manager deliberately takes ownership of the chart-managed CRD fields so this
+upgrade also works for CRDs originally created by Helm.
+
+Existing manifests that omit `users[].credsSecret` remain compatible. Wait for
+the new Operator rollout to complete before relying on an explicit user Secret
+reference; older binaries continue using the same-name Secret convention.
+
+This release adds secure defaults to generated RustFS Pods and containers.
+Existing compatible Tenants whose StatefulSet templates do not already contain
+those values will roll on their next reconciliation. Schedule the upgrade in a
+maintenance window: a single-replica Tenant can be unavailable during restart,
+and a multi-replica Tenant temporarily runs with reduced capacity. Verify every
+Tenant image first. Known incompatible images are blocked before rollout, and
+mutable tags, digest references, or custom repositories are blocked whenever
+the effective profile is `RuntimeDefault` unless the Tenant carries an
+image-bound acknowledgement. Before upgrade, either pin a verified RustFS
+beta.9-or-later release tag, or verify the effective image and set
+`operator.rustfs.com/runtime-default-image-ack` to that exact image reference.
+
+The built-in RustFS image fallback also changes from the mutable `latest` tag to
+`rustfs/rustfs:1.0.0-beta.10`. A Tenant that omits `spec.image` and has no
+`TENANT_RUSTFS_IMAGE` Operator environment override will therefore roll to that
+pinned release on reconciliation. Set `spec.image` explicitly when you want to
+control future RustFS upgrades independently of the Operator default.
+
+Treat this as a one-way workload security migration. After the new Operator has
+reconciled a Tenant, do not downgrade directly to an Operator version that
+predates these restricted defaults. An older controller omits the new seccomp
+and container security fields: restricted admission rejects that update, while
+a cluster without restricted admission can roll the workload back to weaker
+settings. Recover by rolling forward to this version or a newer fixed version.
 
 Uninstall:
 
@@ -186,7 +224,7 @@ metadata:
   name: dev-minimal
   namespace: default
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
   pools:
     - name: dev-pool
       servers: 1
@@ -371,7 +409,7 @@ Useful Tenant-level fields:
 
 | Field | Purpose |
 |-------|---------|
-| `image` | RustFS server image. Defaults to the operator's configured fallback. |
+| `image` | RustFS server image. Defaults to `TENANT_RUSTFS_IMAGE`, then the pinned fallback `rustfs/rustfs:1.0.0-beta.10`. |
 | `imagePullSecret` | Image pull Secret reference. |
 | `imagePullPolicy` | RustFS image pull policy. |
 | `scheduler` | Custom scheduler name. |
@@ -382,7 +420,78 @@ Useful Tenant-level fields:
 | `lifecycle` | Kubernetes container lifecycle hooks. |
 | `podManagementPolicy` | StatefulSet pod management policy. |
 | `podDeletionPolicyWhenNodeIsDown` | Node-down pod deletion behavior. |
-| `securityContext` | Pod SecurityContext override for RustFS pods. |
+| `securityContext` | Pod SecurityContext overrides for all RustFS Pools. |
+| `containerSecurityContext` | RustFS container SecurityContext overrides for all Pools. |
+
+Both fields are also available on each `spec.pools[]` entry. Pool values are
+merged over Tenant values, which are merged over the Operator's defaults. By
+default, generated workloads set `runAsNonRoot: true`, use the
+`RuntimeDefault` seccomp profile, disable privilege escalation, and drop all
+Linux capabilities. These defaults satisfy the corresponding Kubernetes Pod
+Security `restricted` controls. Explicit overrides can relax them and may then
+be rejected by cluster admission policy. For legacy compatibility, an explicit
+`runAsUser: 0` without an explicit `runAsNonRoot` derives `runAsNonRoot: false`;
+that configuration cannot run in a `restricted` namespace.
+
+`RuntimeDefault` also requires a RustFS image that can run under the runtime's
+default seccomp profile. `rustfs/rustfs:1.0.0-beta.8` is not compatible because
+its Tokio runtime enables io_uring; use a build containing
+[rustfs/rustfs#4364](https://github.com/rustfs/rustfs/pull/4364) or later.
+The Operator conservatively blocks official RustFS `1.0.0-alpha.*` images and
+beta.1 through beta.8, including their `-glibc` variants, when the effective
+seccomp profile is `RuntimeDefault`, before it creates or rolls a StatefulSet.
+This gate covers the official Docker Hub, GHCR, and Quay repositories. A
+compatible `Localhost` profile remains an explicit advanced override. Mutable
+official tags such as `latest`, untagged images, custom repositories, and every
+digest reference (including `tag@digest`) cannot be version-verified. The
+Operator blocks those references under `RuntimeDefault` unless the Tenant
+annotation `operator.rustfs.com/runtime-default-image-ack` exactly matches the
+effective image reference. This dedicated acknowledgement is bound to the
+reference and must be updated whenever the reference changes; an existing
+seccomp setting is not treated as image approval. For example:
+
+```yaml
+metadata:
+  annotations:
+    operator.rustfs.com/runtime-default-image-ack: "registry.example.com/rustfs/rustfs@sha256:<digest>"
+spec:
+  image: "registry.example.com/rustfs/rustfs@sha256:<digest>"
+```
+
+Use the raw YAML editor or `kubectl` to set the annotation after verifying the
+image. A matching acknowledgement may also be used with a mutable tag, but the
+tag can later resolve to different content without changing the annotation;
+that is an explicit acceptance of the residual risk. Prefer an immutable digest
+in production. The acknowledgement never overrides a known-incompatible
+official alpha or beta.1 through beta.8 reference without a digest. For
+`tag@digest`, Kubernetes pulls by digest, so the digest is authoritative and the
+complete reference may be acknowledged after that exact digest is verified.
+
+Install the profile on every node where RustFS can be scheduled, then configure
+the runtime-relative profile path. For example:
+
+```yaml
+spec:
+  securityContext:
+    seccompProfile:
+      type: Localhost
+      localhostProfile: profiles/rustfs-io-uring.json
+```
+
+Valid seccomp and AppArmor profile types are `RuntimeDefault`, `Localhost`, and
+`Unconfined`. `Localhost` requires a non-empty `localhostProfile`; the other
+types must not set it. A seccomp Localhost profile must be a relative descending
+path with no `..` component. An AppArmor Localhost profile must have no leading
+or trailing whitespace and must not exceed 4095 bytes. The Operator rejects an
+invalid value before creating or rolling a StatefulSet.
+
+`readOnlyRootFilesystem` is supported as an override but is not enabled by
+default; users enabling it must provide writable runtime paths such as `/logs`
+and `/tmp` as required by their image configuration.
+
+The dedicated Console security form manages the legacy Pod-level UID/GID fields
+only. Configure `seccompProfile`, `containerSecurityContext`, and Pool-level
+overrides through the Console raw YAML editor or `kubectl`.
 
 The operator reserves these environment variables and manages them automatically:
 
@@ -901,6 +1010,8 @@ Common blocked reasons:
 | `CredentialSecretTooShort` | Both credential values are at least 8 characters. |
 | `KmsSecretNotFound` / `KmsSecretMissingKey` | KMS Secret exists and contains required keys, such as Vault `vault-token` or the Local KMS `masterKeySecretRef.key`. |
 | `CertManagerCrdMissing` / `CertManagerIssuerNotFound` | cert-manager is installed and the issuer exists. |
+| `InvalidWorkloadSecurityProfile` | Fix the seccomp or AppArmor profile type and its `localhostProfile` pairing. |
+| `WorkloadSecurityIncompatible` | Upgrade a known legacy image or use a compatible `Localhost` profile. For an unverifiable reference, pin a verified release tag or set `operator.rustfs.com/runtime-default-image-ack` to the exact effective image reference after verification; prefer a digest. |
 | `StatefulSetUpdateValidationFailed` | An immutable StatefulSet or pool-shape field was changed. |
 | `ProvisioningFailed` | Check `status.provisioning`, policy ConfigMaps, user Secrets, and RustFS admin credentials. |
 
diff --git a/docs/operator-user-guide.zh-CN.md b/docs/operator-user-guide.zh-CN.md
index 55cd34e..617ff37 100644
--- a/docs/operator-user-guide.zh-CN.md
+++ b/docs/operator-user-guide.zh-CN.md
@@ -92,13 +92,45 @@ kubectl logs -n rustfs-system \
 升级已有安装：
 
 ```bash
-kubectl apply -f deploy/rustfs-operator/crds/tenant-crd.yaml
+# Helm 不会升级 Chart crds/ 目录中已经存在的 CRD。
+kubectl apply --server-side --force-conflicts \
+  --field-manager=rustfs-operator-crd-upgrade \
+  -f deploy/rustfs-operator/crds/tenant.yaml
+kubectl apply --server-side --force-conflicts \
+  --field-manager=rustfs-operator-crd-upgrade \
+  -f deploy/rustfs-operator/crds/policybinding-crd.yaml
 helm upgrade rustfs-operator deploy/rustfs-operator/ \
   --namespace rustfs-system
 ```
 
-Helm 不会升级 Chart `crds/` 目录中的已有 CRD。使用新版本 Operator 引入的字段前，请先应用更新后的 Tenant CRD，并等待 Operator rollout 完成。
-未配置新版可选字段的已有 Tenant manifest 无需迁移。如果仍有旧版 Operator binary 在 reconcile Tenant，请勿依赖 `users[].credsSecret`，因为旧版本仍会按 user 同名规则读取 Secret。
+请先更新 CRD，再升级 Operator，确保 API Server 能接受新版本 Controller
+引入的字段。CRD 是集群级资源，并由所有 Tenant namespace 共享，升级前应审查变更。
+专用 field manager 会显式接管 Chart 管理的 CRD 字段，因此也适用于最初由 Helm
+创建的 CRD。
+
+未配置 `users[].credsSecret` 的已有 manifest 保持兼容。只有在新 Operator rollout
+全部完成后，才能依赖显式的 user Secret 引用；旧 binary 仍会按 user 同名规则读取
+Secret。
+
+此版本会为生成的 RustFS Pod 和容器补充安全默认值。已有兼容 Tenant 的
+StatefulSet template 如果尚未包含这些值，会在下一次 reconcile 时发生滚动更新。
+请在维护窗口内升级：单副本 Tenant 在重启期间可能不可用，多副本 Tenant 会暂时以
+较低容量运行。应先核对每个 Tenant 的镜像。已知不兼容镜像会在 rollout 前被阻断；
+只要最终生效的 profile 为 `RuntimeDefault`，可变 tag、digest 引用或自定义仓库都需要
+与镜像绑定的确认注解。
+升级前应固定到已验证的 RustFS beta.9 或更高 release tag；也可先验证实际生效的镜像，
+再将 `operator.rustfs.com/runtime-default-image-ack` 设置为完全相同的镜像引用。
+
+内置 RustFS 镜像 fallback 也会从可变的 `latest` 改为
+`rustfs/rustfs:1.0.0-beta.10`。未设置 `spec.image`，且 Operator 没有配置
+`TENANT_RUSTFS_IMAGE` 环境变量覆盖的 Tenant，会在 reconcile 时滚动到该固定版本。
+若希望 RustFS 升级节奏独立于 Operator 默认值，应显式设置 `spec.image`。
+
+应将此次变更视为单向 workload security migration。新版本 Operator 完成 Tenant
+reconcile 后，不要直接降级到尚未提供这些 restricted 默认值的旧版本。旧 Controller
+会省略新增的 seccomp 和容器安全字段：restricted 准入会拒绝该更新；未启用
+restricted 准入的集群则可能把 workload 滚动回较弱配置。故障恢复应向前升级到当前
+版本或更新的修复版本。
 
 卸载：
 
@@ -188,7 +220,7 @@ metadata:
   name: dev-minimal
   namespace: default
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
   pools:
     - name: dev-pool
       servers: 1
@@ -371,7 +403,7 @@ spec:
 
 | 字段 | 用途 |
 |------|------|
-| `image` | RustFS server 镜像。未配置时使用 Operator fallback。 |
+| `image` | RustFS server 镜像。未配置时依次使用 `TENANT_RUSTFS_IMAGE` 和固定 fallback `rustfs/rustfs:1.0.0-beta.10`。 |
 | `imagePullSecret` | 镜像拉取 Secret。 |
 | `imagePullPolicy` | RustFS 镜像拉取策略。 |
 | `scheduler` | 自定义 scheduler 名称。 |
@@ -382,7 +414,67 @@ spec:
 | `lifecycle` | Kubernetes 容器 lifecycle hook。 |
 | `podManagementPolicy` | StatefulSet pod management policy。 |
 | `podDeletionPolicyWhenNodeIsDown` | 节点 NotReady/Unknown 时的 Pod 删除策略。 |
-| `securityContext` | RustFS Pod 的 Pod SecurityContext 覆盖。 |
+| `securityContext` | 所有 RustFS Pool 的 Pod SecurityContext 覆盖。 |
+| `containerSecurityContext` | 所有 Pool 的 RustFS 容器 SecurityContext 覆盖。 |
+
+这两个字段也可配置在每个 `spec.pools[]` 条目上。Pool 级字段会按字段覆盖
+Tenant 级字段，Tenant 级字段再覆盖 Operator 默认值。Operator 默认设置
+`runAsNonRoot: true`、`RuntimeDefault` seccomp、禁止权限提升并丢弃全部 Linux
+capabilities，满足 Kubernetes Pod Security `restricted` 对应要求。显式覆盖可以
+放宽这些默认值，因此可能被集群准入策略拒绝。为兼容存量配置，如果显式配置
+`runAsUser: 0`、但没有显式配置 `runAsNonRoot`，Operator 会推导
+`runAsNonRoot: false`；该配置不能用于 `restricted` namespace。
+
+`RuntimeDefault` 还要求 RustFS 镜像能够在容器运行时默认 seccomp 下启动。
+`rustfs/rustfs:1.0.0-beta.8` 的 Tokio runtime 启用了 io_uring，因此不兼容；
+请使用包含 [rustfs/rustfs#4364](https://github.com/rustfs/rustfs/pull/4364)
+或更高版本的构建。当有效 seccomp profile 为 `RuntimeDefault` 时，Operator 会在
+创建或滚动 StatefulSet 前保守阻止官方 RustFS `1.0.0-alpha.*` 以及 beta.1 至
+beta.8 镜像（包括对应的 `-glibc` 变体）。兼容的 `Localhost` profile 仍可作为高级
+显式覆盖。该门禁覆盖官方 Docker Hub、GHCR 和 Quay 仓库。官方 `latest` 等可变 tag、
+无 tag 镜像、自定义仓库以及所有 digest 引用（包括 `tag@digest`）都无法进行版本验证。
+在 `RuntimeDefault` 下，Operator 会阻止这些引用，除非 Tenant 注解
+`operator.rustfs.com/runtime-default-image-ack` 与实际生效的镜像引用完全一致。该专用
+确认与镜像引用绑定，引用变化时必须同步更新；已有 seccomp 配置不会被当作镜像确认。
+例如：
+
+```yaml
+metadata:
+  annotations:
+    operator.rustfs.com/runtime-default-image-ack: "registry.example.com/rustfs/rustfs@sha256:<digest>"
+spec:
+  image: "registry.example.com/rustfs/rustfs@sha256:<digest>"
+```
+
+验证镜像后，可通过原始 YAML 编辑器或 `kubectl` 设置该注解。可变 tag 也可以使用匹配
+注解，但 tag 后续可能在注解不变的情况下指向不同内容，这表示用户明确接受该剩余风险；
+生产环境应优先使用不可变 digest。该注解不能覆盖没有 digest 的已知不兼容官方
+alpha 或 beta.1 至 beta.8 引用。对于 `tag@digest`，Kubernetes 实际按 digest
+拉取镜像，因此 digest 具有决定性；验证该精确 digest 后，可以确认完整镜像引用。
+
+请先在 RustFS 可能调度到的每个节点上安装 profile，再配置相对于容器运行时的路径，
+例如：
+
+```yaml
+spec:
+  securityContext:
+    seccompProfile:
+      type: Localhost
+      localhostProfile: profiles/rustfs-io-uring.json
+```
+
+seccomp 与 AppArmor profile 的合法类型为 `RuntimeDefault`、`Localhost` 和
+`Unconfined`。`Localhost` 必须设置非空 `localhostProfile`，其他类型不得设置该字段。
+seccomp Localhost profile 必须是相对向下路径，且不能包含 `..` 路径段；AppArmor
+Localhost profile 不能包含首尾空白，长度不能超过 4095 字节。Operator 会在创建或
+滚动 StatefulSet 前拒绝无效值。
+
+`readOnlyRootFilesystem` 可配置但默认不启用；启用时需要根据镜像配置为 `/logs`、
+`/tmp` 等运行路径提供可写卷。
+
+Console 的专用安全配置表单仅管理存量 Pod 级 UID/GID 字段。请通过 Console 原始
+YAML 编辑器或 `kubectl` 配置 `seccompProfile`、`containerSecurityContext` 和
+Pool 级覆盖。
 
 Operator 会自动管理以下环境变量：
 
@@ -900,6 +992,8 @@ kubectl logs -n rustfs-system \
 | `CredentialSecretTooShort` | 两个凭据值是否都至少 8 个字符。 |
 | `KmsSecretNotFound` / `KmsSecretMissingKey` | KMS Secret 是否存在，并包含必要 key，例如 Vault 的 `vault-token` 或 Local KMS 的 `masterKeySecretRef.key`。 |
 | `CertManagerCrdMissing` / `CertManagerIssuerNotFound` | cert-manager 是否安装，issuer 是否存在。 |
+| `InvalidWorkloadSecurityProfile` | 修正 seccomp 或 AppArmor profile 类型及其与 `localhostProfile` 的组合。 |
+| `WorkloadSecurityIncompatible` | 对已知旧镜像进行升级，或使用兼容的 `Localhost` profile。对于无法验证的引用，应固定到已验证的 release tag；也可在验证后将 `operator.rustfs.com/runtime-default-image-ack` 设置为完全相同的实际镜像引用，并优先使用 digest。 |
 | `StatefulSetUpdateValidationFailed` | 是否修改了不可变 StatefulSet 字段或 pool 形态字段。 |
 | `ProvisioningFailed` | 检查 `status.provisioning`、policy ConfigMap、user Secret 和 RustFS 管理员凭据。 |
 
diff --git a/e2e/Cargo.lock b/e2e/Cargo.lock
index 8ca0435..366d339 100644
--- a/e2e/Cargo.lock
+++ b/e2e/Cargo.lock
@@ -2542,6 +2542,7 @@ dependencies = [
  "rustls-webpki 0.103.13",
  "schemars",
  "serde",
+ "serde_ignored",
  "serde_json",
  "serde_yaml_ng",
  "sha2 0.10.9",
@@ -3401,6 +3402,16 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "serde_ignored"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115dffd5f3853e06e746965a20dcbae6ee747ae30b543d91b0e089668bb07798"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.149"
diff --git a/e2e/FAULT_TESTING.md b/e2e/FAULT_TESTING.md
index 3f18cba..d2b6710 100644
--- a/e2e/FAULT_TESTING.md
+++ b/e2e/FAULT_TESTING.md
@@ -70,7 +70,10 @@ export RUSTFS_FAULT_TEST_SERVER_IMAGE='docker.io/rustfs/rustfs@sha256:<digest>'
 ```
 
 `RUSTFS_FAULT_TEST_SERVER_IMAGE` must be explicit. Prefer a pinned digest so a
-failed run can be reproduced.
+failed run can be reproduced. For a non-default or otherwise unverifiable
+image, the harness binds the required
+`operator.rustfs.com/runtime-default-image-ack` Tenant annotation to this exact
+reference; changing the image therefore requires a new acknowledgement.
 
 `RUSTFS_FAULT_TEST_EXPECTED_CONTEXT` is optional. When set, both the shell
 runner and Rust test entrypoint require the current context to match it exactly.
diff --git a/e2e/README.md b/e2e/README.md
index d9198e8..e157de1 100644
--- a/e2e/README.md
+++ b/e2e/README.md
@@ -86,12 +86,20 @@ operator ns:      rustfs-system
 test namespace:   rustfs-e2e-smoke
 tenant name:      e2e-tenant
 console URL:      http://127.0.0.1:19090
-rustfs image:      rustfs/rustfs:latest
+rustfs image:      rustfs/rustfs:1.0.0-beta.10
 storage class:    local-storage
 PV count:         12
 kind config:      e2e/manifests/kind-rustfs-e2e.yaml
 ```
 
+Set `RUSTFS_E2E_SERVER_IMAGE` to exercise a branch or custom RustFS image. The
+harness writes `operator.rustfs.com/runtime-default-image-ack` with that exact
+reference so the Tenant can use the Operator's `RuntimeDefault` seccomp default.
+A mutable override can drift while the annotation stays unchanged; use a digest
+when reproducibility matters. The built-in default does not receive the
+annotation, so the smoke suite continues to test the normal implicit-default
+path.
+
 Live tests are `#[ignore]` and run through the reduced Make workflow. The Makefile injects `RUSTFS_E2E_LIVE=1` internally, so the common flow does not need the environment prefix:
 
 ```bash
diff --git a/e2e/src/framework/cert_manager_tls.rs b/e2e/src/framework/cert_manager_tls.rs
index acf108e..c5c1965 100644
--- a/e2e/src/framework/cert_manager_tls.rs
+++ b/e2e/src/framework/cert_manager_tls.rs
@@ -686,7 +686,7 @@ fn apply_positive_case_base_resources(
 fn apply_shared_namespace_resources(config: &E2eConfig) -> Result<()> {
     apply_yaml(
         config,
-        resources::namespace_manifest(&config.test_namespace),
+        resources::restricted_namespace_manifest(&config.test_namespace),
     )?;
     apply_yaml(config, resources::credential_secret_manifest(config))?;
     Ok(())
diff --git a/e2e/src/framework/config.rs b/e2e/src/framework/config.rs
index 89161b4..21df04f 100644
--- a/e2e/src/framework/config.rs
+++ b/e2e/src/framework/config.rs
@@ -20,7 +20,7 @@ use std::time::Duration;
 
 pub const DEFAULT_CLUSTER_NAME: &str = "rustfs-e2e";
 pub const DEFAULT_STORAGE_HOST_DIR_PREFIX: &str = "/tmp/rustfs-e2e-storage";
-pub const DEFAULT_RUSTFS_IMAGE: &str = "rustfs/rustfs:latest";
+pub const DEFAULT_RUSTFS_IMAGE: &str = "rustfs/rustfs:1.0.0-beta.10";
 pub const DEFAULT_CERT_MANAGER_VERSION: &str = "v1.16.2";
 pub const KIND_WORKER_COUNT: usize = 3;
 
diff --git a/e2e/src/framework/images.rs b/e2e/src/framework/images.rs
index 73c754a..b7eeb1f 100644
--- a/e2e/src/framework/images.rs
+++ b/e2e/src/framework/images.rs
@@ -74,7 +74,7 @@ mod tests {
             [
                 "rustfs/operator:e2e",
                 "rustfs/console-web:e2e",
-                "rustfs/rustfs:latest",
+                "rustfs/rustfs:1.0.0-beta.10",
                 "quay.io/jetstack/cert-manager-controller:v1.16.2",
                 "quay.io/jetstack/cert-manager-webhook:v1.16.2",
                 "quay.io/jetstack/cert-manager-cainjector:v1.16.2",
diff --git a/e2e/src/framework/kind.rs b/e2e/src/framework/kind.rs
index 805fe1c..7c725a2 100644
--- a/e2e/src/framework/kind.rs
+++ b/e2e/src/framework/kind.rs
@@ -25,7 +25,7 @@ use crate::framework::{
 
 const RUSTFS_FORMAT_MARKER_PATHS: [&str; 2] = [".rustfs.sys/format.json", ".minio.sys/format.json"];
 const DOCKER_ROOT_UID: u32 = 0;
-const CLEANUP_HELPER_FALLBACK_IMAGES: [&str; 2] = ["rustfs/rustfs:latest", "busybox:latest"];
+const CLEANUP_HELPER_FALLBACK_IMAGES: [&str; 2] = ["rustfs/rustfs:1.0.0-beta.10", "busybox:latest"];
 
 #[derive(Debug, Clone)]
 pub struct KindCluster {
@@ -151,7 +151,7 @@ impl KindCluster {
 
         Err(last_error.unwrap_or_else(|| {
             anyhow::anyhow!(
-                "no local Docker cleanup helper image is available; build rustfs/operator:e2e or ensure rustfs/rustfs:latest is present"
+                "no local Docker cleanup helper image is available; build rustfs/operator:e2e or ensure the configured RustFS image is present"
             )
         }))
     }
@@ -395,11 +395,12 @@ mod tests {
     #[test]
     fn ctr_import_image_command_streams_docker_archive_to_node_containerd() {
         let kind = KindCluster::new(E2eConfig::defaults());
-        let command = kind.ctr_import_image_command("rustfs/rustfs:latest", "rustfs-e2e-worker");
+        let command =
+            kind.ctr_import_image_command("rustfs/rustfs:1.0.0-beta.10", "rustfs-e2e-worker");
 
         assert_eq!(
             command.display(),
-            "sh -c docker save \"$1\" | docker exec --privileged -i \"$2\" ctr --namespace=k8s.io images import --digests --snapshotter=overlayfs - sh rustfs/rustfs:latest rustfs-e2e-worker"
+            "sh -c docker save \"$1\" | docker exec --privileged -i \"$2\" ctr --namespace=k8s.io images import --digests --snapshotter=overlayfs - sh rustfs/rustfs:1.0.0-beta.10 rustfs-e2e-worker"
         );
     }
 
@@ -474,7 +475,7 @@ mod tests {
         let command = kind
             .docker_clean_host_storage_command(
                 std::path::Path::new("/tmp/rustfs-e2e-storage-1"),
-                "rustfs/rustfs:latest",
+                "rustfs/rustfs:1.0.0-beta.10",
                 1000,
                 1000,
             )
@@ -482,12 +483,12 @@ mod tests {
 
         assert_eq!(
             command.display(),
-            "docker run --rm --pull never --user 0:0 --entrypoint /bin/sh -v /tmp/rustfs-e2e-storage-1:/e2e-storage rustfs/rustfs:latest -c find /e2e-storage -mindepth 1 -maxdepth 1 -exec rm -rf -- {} + && chown 1000:1000 /e2e-storage"
+            "docker run --rm --pull never --user 0:0 --entrypoint /bin/sh -v /tmp/rustfs-e2e-storage-1:/e2e-storage rustfs/rustfs:1.0.0-beta.10 -c find /e2e-storage -mindepth 1 -maxdepth 1 -exec rm -rf -- {} + && chown 1000:1000 /e2e-storage"
         );
         assert!(
             kind.docker_clean_host_storage_command(
                 std::path::Path::new("/tmp/other"),
-                "rustfs/rustfs:latest",
+                "rustfs/rustfs:1.0.0-beta.10",
                 1000,
                 1000,
             )
@@ -527,7 +528,7 @@ mod tests {
             kind.cleanup_helper_images(),
             vec![
                 "rustfs/operator:e2e".to_string(),
-                "rustfs/rustfs:latest".to_string(),
+                "rustfs/rustfs:1.0.0-beta.10".to_string(),
                 "busybox:latest".to_string(),
             ]
         );
diff --git a/e2e/src/framework/resources.rs b/e2e/src/framework/resources.rs
index a1119c3..ebdee50 100644
--- a/e2e/src/framework/resources.rs
+++ b/e2e/src/framework/resources.rs
@@ -54,6 +54,23 @@ metadata:
     )
 }
 
+pub fn restricted_namespace_manifest(namespace: &str) -> String {
+    format!(
+        r#"apiVersion: v1
+kind: Namespace
+metadata:
+  name: {namespace}
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: latest
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: latest
+"#
+    )
+}
+
 pub fn credential_secret_manifest(config: &ClusterTestConfig) -> String {
     format!(
         r#"apiVersion: v1
@@ -126,7 +143,7 @@ pub fn smoke_tenant_manifest(config: &ClusterTestConfig) -> Result<String> {
 pub fn apply_smoke_tenant_resources(config: &ClusterTestConfig) -> Result<()> {
     let kubectl = Kubectl::new(config);
     kubectl
-        .apply_yaml_command(namespace_manifest(&config.test_namespace))
+        .apply_yaml_command(restricted_namespace_manifest(&config.test_namespace))
         .run_checked()?;
     kubectl
         .apply_yaml_command(credential_secret_manifest(config))
@@ -340,8 +357,8 @@ fn is_not_found(output: &CommandOutput) -> bool {
 #[cfg(test)]
 mod tests {
     use super::{
-        credential_secret_manifest, credential_secret_name, rpc_secret_manifest, rpc_secret_name,
-        smoke_tenant_manifest,
+        credential_secret_manifest, credential_secret_name, namespace_manifest,
+        restricted_namespace_manifest, rpc_secret_manifest, rpc_secret_name, smoke_tenant_manifest,
     };
     use crate::framework::config::E2eConfig;
 
@@ -352,7 +369,9 @@ mod tests {
 
         assert!(manifest.contains("kind: Tenant"));
         assert!(manifest.contains("namespace: rustfs-e2e-smoke"));
-        assert!(manifest.contains("image: rustfs/rustfs:latest"));
+        assert!(manifest.contains("image: rustfs/rustfs:1.0.0-beta.10"));
+        assert!(!manifest.contains("seccompProfile:"));
+        assert!(!manifest.contains("operator.rustfs.com/runtime-default-image-ack"));
         assert!(manifest.contains("storageClassName: local-storage"));
         assert!(manifest.contains("name: e2e-tenant-credentials"));
         assert!(manifest.contains("rpcSecret:"));
@@ -360,6 +379,38 @@ mod tests {
         assert!(manifest.contains("key: rpc-secret"));
     }
 
+    #[test]
+    fn smoke_tenant_manifest_acknowledges_a_custom_branch_image() {
+        let mut config = E2eConfig::defaults();
+        config.rustfs_image = "registry.example.com/rustfs/rustfs:e2e".to_string();
+        let tenant = super::smoke_tenant_template(&config).build();
+        tenant
+            .validate_workload_security_compatibility()
+            .expect("the E2E template should acknowledge its custom branch image");
+
+        let manifest = serde_yaml_ng::to_string(&tenant).expect("tenant manifest");
+        assert!(!manifest.contains("seccompProfile:"));
+        assert!(manifest.contains("operator.rustfs.com/runtime-default-image-ack:"));
+        assert!(manifest.contains("registry.example.com/rustfs/rustfs:e2e"));
+    }
+
+    #[test]
+    fn smoke_namespace_enforces_latest_restricted_pod_security() {
+        let manifest = restricted_namespace_manifest("rustfs-e2e-smoke");
+
+        assert!(manifest.contains("pod-security.kubernetes.io/enforce: restricted"));
+        assert!(manifest.contains("pod-security.kubernetes.io/enforce-version: latest"));
+        assert!(manifest.contains("pod-security.kubernetes.io/audit: restricted"));
+        assert!(manifest.contains("pod-security.kubernetes.io/warn: restricted"));
+    }
+
+    #[test]
+    fn operator_namespace_does_not_enable_restricted_admission() {
+        let manifest = namespace_manifest("rustfs-operator-system");
+
+        assert!(!manifest.contains("pod-security.kubernetes.io/"));
+    }
+
     #[test]
     fn credential_secret_uses_e2e_tenant_scope() {
         let config = E2eConfig::defaults();
diff --git a/e2e/src/framework/tenant_factory.rs b/e2e/src/framework/tenant_factory.rs
index 8328e58..3f72321 100644
--- a/e2e/src/framework/tenant_factory.rs
+++ b/e2e/src/framework/tenant_factory.rs
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use crate::framework::config::DEFAULT_RUSTFS_IMAGE;
 use k8s_openapi::api::core::v1::{
     Affinity, EnvVar, LocalObjectReference, PersistentVolumeClaimSpec, PodAffinityTerm,
     PodAntiAffinity, VolumeResourceRequirements,
@@ -22,7 +23,9 @@ use operator::types::v1alpha1::k8s::ImagePullPolicy;
 use operator::types::v1alpha1::k8s::PodManagementPolicy;
 use operator::types::v1alpha1::persistence::PersistenceConfig;
 use operator::types::v1alpha1::pool::{Pool, SchedulingConfig};
-use operator::types::v1alpha1::tenant::{RpcSecretRef, Tenant, TenantSpec};
+use operator::types::v1alpha1::tenant::{
+    RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION, RpcSecretRef, Tenant, TenantSpec,
+};
 use std::collections::BTreeMap;
 
 #[derive(Debug, Clone)]
@@ -120,6 +123,8 @@ impl TenantTemplate {
                 }),
                 ..PersistenceConfig::default()
             },
+            security_context: None,
+            container_security_context: None,
             scheduling: SchedulingConfig {
                 node_selector: self.node_selector.clone(),
                 affinity: self.affinity.clone(),
@@ -156,6 +161,15 @@ impl TenantTemplate {
 
         let mut tenant = Tenant::new(&self.name, spec);
         tenant.metadata.namespace = Some(self.namespace.clone());
+        // Live E2E frequently injects a branch image from a custom registry. Bind that
+        // acknowledgement to the exact reference while the pinned default smoke case keeps
+        // exercising the Operator's implicit image and security defaults.
+        if self.image != DEFAULT_RUSTFS_IMAGE {
+            tenant.metadata.annotations.get_or_insert_default().insert(
+                RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION.to_string(),
+                self.image.clone(),
+            );
+        }
         tenant
     }
 }
@@ -183,7 +197,7 @@ fn fault_tenant_pod_anti_affinity(tenant_name: &str) -> Affinity {
 
 #[cfg(test)]
 mod tests {
-    use super::TenantTemplate;
+    use super::{RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION, TenantTemplate};
 
     #[test]
     fn kind_local_tenant_uses_local_image_policy_and_disk_bypass() {
@@ -215,6 +229,19 @@ mod tests {
             Some("local-storage")
         );
         assert!(tenant.spec.image_pull_policy.is_some());
+        assert!(tenant.spec.security_context.is_none());
+        assert_eq!(
+            tenant
+                .metadata
+                .annotations
+                .as_ref()
+                .and_then(|annotations| annotations.get(RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION))
+                .map(String::as_str),
+            Some("rustfs/rustfs:e2e")
+        );
+        tenant
+            .validate_workload_security_compatibility()
+            .expect("the image-bound E2E acknowledgement should allow a branch image");
         assert!(
             tenant
                 .spec
@@ -239,7 +266,7 @@ mod tests {
         let tenant = TenantTemplate::real_cluster(
             "rustfs-fault-test",
             "fault-test-tenant",
-            "rustfs/rustfs:latest",
+            "rustfs/rustfs:1.0.0-beta.10",
             "fast-csi",
             "fault-test-tenant-credentials",
         )
diff --git a/examples/README.md b/examples/README.md
index a1c1790..b1338a7 100755
--- a/examples/README.md
+++ b/examples/README.md
@@ -365,7 +365,7 @@ metadata:
   namespace: <namespace>
 spec:
   # Container image (optional)
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # Storage pools (required, at least one)
   pools:
diff --git a/examples/cert-manager-ca-trust-tenant.yaml b/examples/cert-manager-ca-trust-tenant.yaml
index 5fa32c0..a2998de 100644
--- a/examples/cert-manager-ca-trust-tenant.yaml
+++ b/examples/cert-manager-ca-trust-tenant.yaml
@@ -19,7 +19,7 @@ metadata:
   name: cert-manager-ca-trust
   namespace: rustfs-system
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   tls:
     mode: certManager
diff --git a/examples/cluster-expansion-tenant.yaml b/examples/cluster-expansion-tenant.yaml
index 8a8e162..2a4f8a5 100755
--- a/examples/cluster-expansion-tenant.yaml
+++ b/examples/cluster-expansion-tenant.yaml
@@ -20,7 +20,7 @@ metadata:
   labels:
     phase: expansion
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   pools:
     # ORIGINAL POOL (v1): Existing deployment
diff --git a/examples/custom-rbac-tenant.yaml b/examples/custom-rbac-tenant.yaml
index 1de3fe2..c6f33cd 100755
--- a/examples/custom-rbac-tenant.yaml
+++ b/examples/custom-rbac-tenant.yaml
@@ -83,7 +83,7 @@ metadata:
   name: custom-rbac-tenant-1
   namespace: default
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # Use custom ServiceAccount
   serviceAccountName: my-custom-sa
@@ -125,7 +125,7 @@ metadata:
   name: custom-rbac-tenant-2
   namespace: default
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # Use custom ServiceAccount (with cloud identity annotations)
   serviceAccountName: cloud-identity-sa
@@ -184,7 +184,7 @@ spec:
 #     name: custom-rbac-tenant-2
 #     namespace: default
 #   spec:
-#     image: rustfs/rustfs:latest
+#     image: rustfs/rustfs:1.0.0-beta.10
 #     serviceAccountName: cloud-identity-sa
 #     createServiceAccountRbac: true
 #     pools:
diff --git a/examples/geographic-pools-tenant.yaml b/examples/geographic-pools-tenant.yaml
index a3ffc83..83a6fbc 100755
--- a/examples/geographic-pools-tenant.yaml
+++ b/examples/geographic-pools-tenant.yaml
@@ -37,7 +37,7 @@ metadata:
     architecture: multi-region
     compliance: gdpr-ready
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   pools:
     # US REGION POOL
diff --git a/examples/hardware-pools-tenant.yaml b/examples/hardware-pools-tenant.yaml
index 4b0001d..fdc06d7 100755
--- a/examples/hardware-pools-tenant.yaml
+++ b/examples/hardware-pools-tenant.yaml
@@ -37,7 +37,7 @@ metadata:
     architecture: heterogeneous-disks
     environment: production
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   pools:
     # LARGE DISK POOL: Nodes with large SSD disks
diff --git a/examples/minimal-dev-tenant.yaml b/examples/minimal-dev-tenant.yaml
index b95b6a1..4f7e1a9 100755
--- a/examples/minimal-dev-tenant.yaml
+++ b/examples/minimal-dev-tenant.yaml
@@ -20,7 +20,7 @@ metadata:
     environment: development
 spec:
   # Container image (optional - uses operator default if not specified)
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # Minimal pool configuration.
   # A single-node single-disk Tenant is expressed as 1 server × 1 volume.
diff --git a/examples/multi-cert-tls-tenant.yaml b/examples/multi-cert-tls-tenant.yaml
index ceb45ee..a885797 100644
--- a/examples/multi-cert-tls-tenant.yaml
+++ b/examples/multi-cert-tls-tenant.yaml
@@ -9,7 +9,7 @@ metadata:
   name: multi-cert-tls
   namespace: rustfs-system
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   tls:
     mode: certManager
diff --git a/examples/multi-pool-tenant.yaml b/examples/multi-pool-tenant.yaml
index 01defb7..c80166b 100755
--- a/examples/multi-pool-tenant.yaml
+++ b/examples/multi-pool-tenant.yaml
@@ -4,7 +4,7 @@ metadata:
   name: multi-pool-tenant
   namespace: rustfs-system
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # Multiple pools for distributed storage
   pools:
diff --git a/examples/production-ha-tenant.yaml b/examples/production-ha-tenant.yaml
index dd08749..c34f7ce 100755
--- a/examples/production-ha-tenant.yaml
+++ b/examples/production-ha-tenant.yaml
@@ -26,7 +26,7 @@ metadata:
     criticality: high
 spec:
   # Use specific version tag for production (check latest at https://github.com/rustfs/rustfs/releases)
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # Production pool configuration
   pools:
diff --git a/examples/provisioning-tenant.yaml b/examples/provisioning-tenant.yaml
index 99bc3c9..045a1d9 100644
--- a/examples/provisioning-tenant.yaml
+++ b/examples/provisioning-tenant.yaml
@@ -63,7 +63,7 @@ metadata:
   name: provisioning-demo
   namespace: default
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
   credsSecret:
     name: provisioning-admin-creds
   pools:
diff --git a/examples/secret-credentials-tenant.yaml b/examples/secret-credentials-tenant.yaml
index 84c36ee..a60fac2 100755
--- a/examples/secret-credentials-tenant.yaml
+++ b/examples/secret-credentials-tenant.yaml
@@ -40,7 +40,7 @@ metadata:
   namespace: default
 spec:
   # RustFS container image
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # ✅ RECOMMENDED: Reference Secret containing credentials (OPTIONAL)
   # The Secret must contain 'accesskey' and 'secretkey' keys
@@ -79,7 +79,7 @@ spec:
 #  name: secure-tenant-alt
 #  namespace: default
 #spec:
-#  image: rustfs/rustfs:latest
+#  image: rustfs/rustfs:1.0.0-beta.10
 #
 #  # Reference Secret via environment variables
 #  # Note: When using this approach, you must manually specify RUSTFS_ACCESS_KEY
diff --git a/examples/simple-tenant.yaml b/examples/simple-tenant.yaml
index 1eec68c..d00e7e7 100755
--- a/examples/simple-tenant.yaml
+++ b/examples/simple-tenant.yaml
@@ -5,12 +5,25 @@ metadata:
   namespace: rustfs-system
 spec:
   # Container image for RustFS (optional, defaults to a specific version)
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   # Pod management policy for StatefulSet (defaults to Parallel)
   # Parallel is recommended for multi-node RustFS deployments
   podManagementPolicy: Parallel
 
+  # The operator applies Pod Security "restricted" compatible defaults.
+  # Optional Tenant-level overrides apply to every pool; pool-level values win.
+  # securityContext:
+  #   runAsNonRoot: true
+  #   seccompProfile:
+  #     type: RuntimeDefault
+  # containerSecurityContext:
+  #   allowPrivilegeEscalation: false
+  #   capabilities:
+  #     drop: ["ALL"]
+  #   # Not enabled by default because RustFS may need writable runtime paths.
+  #   readOnlyRootFilesystem: false
+
   # Pool configuration - at least one pool is required
   # RustFS validates whether the requested storage layout is supported at startup.
   pools:
diff --git a/examples/spot-instance-tenant.yaml b/examples/spot-instance-tenant.yaml
index e2c80ba..5730ee1 100755
--- a/examples/spot-instance-tenant.yaml
+++ b/examples/spot-instance-tenant.yaml
@@ -39,7 +39,7 @@ metadata:
     cost-profile: optimized
     environment: production
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
 
   pools:
     # CRITICAL POOL: On-demand instances
diff --git a/examples/tenant-4nodes.yaml b/examples/tenant-4nodes.yaml
index 34d442a..2b46cfc 100644
--- a/examples/tenant-4nodes.yaml
+++ b/examples/tenant-4nodes.yaml
@@ -9,9 +9,9 @@ metadata:
   labels:
     app: rustfs
 spec:
-  image: rustfs/rustfs:latest
+  image: rustfs/rustfs:1.0.0-beta.10
   # Kind demos load the server image into node-local containerd. Avoid forcing
-  # Docker Hub access for the `latest` tag when the image is already present.
+  # Docker Hub access when the pinned image is already present.
   imagePullPolicy: IfNotPresent
   podManagementPolicy: Parallel
 
diff --git a/src/console/handlers/encryption.rs b/src/console/handlers/encryption.rs
index ad819be..266654f 100644
--- a/src/console/handlers/encryption.rs
+++ b/src/console/handlers/encryption.rs
@@ -20,6 +20,7 @@ use crate::console::{
 use crate::types::v1alpha1::encryption::{
     EncryptionConfig, KmsBackendType, LocalKmsConfig, LocalKmsMasterKeySecretRef, VaultKmsConfig,
 };
+use crate::types::v1alpha1::security_context::effective_run_as_non_root;
 use crate::types::v1alpha1::tenant::Tenant;
 use axum::{Extension, Json, extract::Path};
 use k8s_openapi::api::core::v1 as corev1;
@@ -73,6 +74,10 @@ pub async fn get_encryption(
                         run_as_group: sc.run_as_group,
                         fs_group: sc.fs_group,
                         run_as_non_root: sc.run_as_non_root,
+                        effective_run_as_non_root: effective_run_as_non_root(
+                            sc.run_as_user,
+                            sc.run_as_non_root,
+                        ),
                     }
                 }),
             },
@@ -89,6 +94,10 @@ pub async fn get_encryption(
                         run_as_group: sc.run_as_group,
                         fs_group: sc.fs_group,
                         run_as_non_root: sc.run_as_non_root,
+                        effective_run_as_non_root: effective_run_as_non_root(
+                            sc.run_as_user,
+                            sc.run_as_non_root,
+                        ),
                     }
                 }),
             },
diff --git a/src/console/handlers/mod.rs b/src/console/handlers/mod.rs
index a31d144..f397b30 100755
--- a/src/console/handlers/mod.rs
+++ b/src/console/handlers/mod.rs
@@ -21,3 +21,20 @@ pub mod pools;
 pub mod security_context;
 pub mod tenants;
 pub mod topology;
+
+use crate::console::error::{Error, Result};
+use crate::types::v1alpha1::tenant::Tenant;
+
+/// Apply the complete domain validation contract before any Console Tenant write.
+pub(super) fn validate_tenant_for_write(tenant: &Tenant) -> Result<()> {
+    tenant.validate_pools().map_err(|error| Error::BadRequest {
+        message: error.to_string(),
+    })?;
+    tenant
+        .validate_workload_security_compatibility()
+        .map_err(|error| Error::BadRequest {
+            message: error.to_string(),
+        })?;
+
+    Ok(())
+}
diff --git a/src/console/handlers/pools.rs b/src/console/handlers/pools.rs
index cfd07b9..a413ceb 100755
--- a/src/console/handlers/pools.rs
+++ b/src/console/handlers/pools.rs
@@ -24,7 +24,7 @@ use crate::console::{
 };
 use crate::types::v1alpha1::{
     persistence::PersistenceConfig,
-    pool::{Pool, SchedulingConfig, validate_pool_collection, validate_pool_name},
+    pool::{Pool, SchedulingConfig, validate_pool_name},
     pool_lifecycle::{
         DecommissionAction, DecommissionRequest, PoolLifecycleSpec, PvcRetentionPolicy,
     },
@@ -33,6 +33,11 @@ use crate::types::v1alpha1::{
     tenant::Tenant,
 };
 
+fn push_pool_and_validate_tenant(tenant: &mut Tenant, pool: Pool) -> Result<()> {
+    tenant.spec.pools.push(pool);
+    super::validate_tenant_for_write(tenant)
+}
+
 /// Loose validation for a Kubernetes resource quantity (e.g. `10Gi`, `100M`, `1`).
 fn is_valid_k8s_quantity(s: &str) -> bool {
     if s.is_empty() || s.len() > 32 {
@@ -599,6 +604,8 @@ pub async fn add_pool(
             labels: None,
             annotations: None,
         },
+        security_context: None,
+        container_security_context: None,
         scheduling: SchedulingConfig {
             node_selector: req.node_selector,
             resources: req.resources.map(|r| corev1::ResourceRequirements {
@@ -659,10 +666,7 @@ pub async fn add_pool(
         }
 
         remove_decommission_request(&mut tenant, pool_name);
-        tenant.spec.pools.push(new_pool.clone());
-        if let Err(message) = validate_pool_collection(&tenant.name_any(), &tenant.spec.pools) {
-            return Err(Error::BadRequest { message });
-        }
+        push_pool_and_validate_tenant(&mut tenant, new_pool.clone())?;
 
         match tenant_api
             .replace(&tenant_name, &Default::default(), &tenant)
@@ -974,13 +978,15 @@ mod tests {
         decommission_request_can_replace, has_recorded_pool_status_requiring_decommission,
         is_managed_pool_statefulset, is_pool_observation_current,
         pool_delete_observation_pending_error, pool_delete_requires_decommission_error,
-        remove_decommission_request, upsert_decommission_request, validate_lifecycle_request_id,
+        push_pool_and_validate_tenant, remove_decommission_request, upsert_decommission_request,
+        validate_lifecycle_request_id,
     };
     use crate::console::error::Error;
     use crate::types::v1alpha1::{
         pool_lifecycle::{
             DecommissionAction, DecommissionRequest, PoolLifecycleSpec, PvcRetentionPolicy,
         },
+        security_context::PodSecurityContextOverride,
         status::{
             Status,
             pool::{
@@ -990,7 +996,8 @@ mod tests {
         },
         tenant::TenantSpec,
     };
-    use axum::http::StatusCode;
+    use axum::{http::StatusCode, response::IntoResponse};
+    use k8s_openapi::api::core::v1 as corev1;
     use std::collections::BTreeMap;
 
     fn tenant_with_generations(
@@ -1012,6 +1019,40 @@ mod tests {
         }
     }
 
+    #[test]
+    fn pool_addition_rejects_legacy_images_that_would_inherit_runtime_default_seccomp() {
+        for image in ["rustfs/rustfs:1.0.0-alpha.99", "rustfs/rustfs:1.0.0-beta.8"] {
+            let mut tenant = crate::tests::create_test_tenant(None, None);
+            tenant.spec.image = Some(image.to_string());
+            tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride {
+                seccomp_profile: Some(corev1::SeccompProfile {
+                    localhost_profile: Some("profiles/rustfs-io-uring.json".to_string()),
+                    type_: "Localhost".to_string(),
+                }),
+                ..Default::default()
+            });
+            tenant
+                .validate_workload_security_compatibility()
+                .expect("existing Localhost pool should remain compatible");
+
+            let mut new_pool = tenant.spec.pools[0].clone();
+            new_pool.name = "pool-1".to_string();
+            new_pool.security_context = None;
+            new_pool.container_security_context = None;
+
+            let error = push_pool_and_validate_tenant(&mut tenant, new_pool)
+                .expect_err("new RuntimeDefault pool must be rejected before replace");
+            assert!(
+                matches!(&error, Error::BadRequest { message }
+                    if message.contains(image)
+                        && message.contains("pool-1")
+                        && message.contains("Tokio io_uring")),
+                "unexpected error: {error}"
+            );
+            assert_eq!(error.into_response().status(), StatusCode::BAD_REQUEST);
+        }
+    }
+
     #[test]
     fn pool_delete_requires_decommission_error_contract() {
         let error = pool_delete_requires_decommission_error(
diff --git a/src/console/handlers/security_context.rs b/src/console/handlers/security_context.rs
index e03020b..258ed55 100644
--- a/src/console/handlers/security_context.rs
+++ b/src/console/handlers/security_context.rs
@@ -12,18 +12,20 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use super::validate_tenant_for_write;
 use crate::console::{
     error::{self, Error, Result},
-    models::encryption::{SecurityContextInfo, UpdateSecurityContextRequest},
+    models::encryption::{PatchField, SecurityContextInfo, UpdateSecurityContextRequest},
     state::Claims,
 };
-use crate::types::v1alpha1::encryption::PodSecurityContextOverride;
+use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
 use crate::types::v1alpha1::tenant::Tenant;
 use axum::{Extension, Json, extract::Path};
-use kube::api::{Patch, PatchParams};
 use kube::{Api, Client};
 
 /// GET /namespaces/:namespace/tenants/:name/security-context
+///
+/// Returns the legacy Console form subset. Advanced settings remain available via raw YAML.
 pub async fn get_security_context(
     Path((namespace, name)): Path<(String, String)>,
     Extension(claims): Extension<Claims>,
@@ -36,25 +38,50 @@ pub async fn get_security_context(
         .await
         .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
 
-    let info = tenant.spec.security_context.as_ref().map_or_else(
-        || SecurityContextInfo {
-            run_as_user: None,
-            run_as_group: None,
-            fs_group: None,
-            run_as_non_root: None,
-        },
-        |sc| SecurityContextInfo {
-            run_as_user: sc.run_as_user,
-            run_as_group: sc.run_as_group,
-            fs_group: sc.fs_group,
-            run_as_non_root: sc.run_as_non_root,
-        },
-    );
-
-    Ok(Json(info))
+    Ok(Json(security_context_info(
+        tenant.spec.security_context.as_ref(),
+    )))
+}
+
+fn security_context_info(
+    security_context: Option<&PodSecurityContextOverride>,
+) -> SecurityContextInfo {
+    SecurityContextInfo::from_override(security_context)
+}
+
+fn apply_patch_field<T: Copy>(target: &mut Option<T>, field: &PatchField<T>) {
+    match field {
+        PatchField::Missing => {}
+        PatchField::Null => *target = None,
+        PatchField::Value(value) => *target = Some(*value),
+    }
+}
+
+fn apply_validated_security_context_update(
+    tenant: &mut Tenant,
+    body: &UpdateSecurityContextRequest,
+) -> Result<bool> {
+    let has_updates = !matches!(body.run_as_user, PatchField::Missing)
+        || !matches!(body.run_as_group, PatchField::Missing)
+        || !matches!(body.fs_group, PatchField::Missing)
+        || !matches!(body.run_as_non_root, PatchField::Missing);
+    if !has_updates {
+        return Ok(false);
+    }
+
+    let context = tenant.spec.security_context.get_or_insert_default();
+    apply_patch_field(&mut context.run_as_user, &body.run_as_user);
+    apply_patch_field(&mut context.run_as_group, &body.run_as_group);
+    apply_patch_field(&mut context.fs_group, &body.fs_group);
+    apply_patch_field(&mut context.run_as_non_root, &body.run_as_non_root);
+    validate_tenant_for_write(tenant)?;
+
+    Ok(true)
 }
 
 /// PUT /namespaces/:namespace/tenants/:name/security-context
+///
+/// Updates only legacy Pod-level fields without replacing advanced security settings.
 pub async fn update_security_context(
     Path((namespace, name)): Path<(String, String)>,
     Extension(claims): Extension<Claims>,
@@ -63,31 +90,43 @@ pub async fn update_security_context(
     let client = create_client(&claims).await?;
     let api: Api<Tenant> = Api::namespaced(client, &namespace);
 
-    let _tenant = api
-        .get(&name)
-        .await
-        .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
-
-    let security_context = PodSecurityContextOverride {
-        run_as_user: body.run_as_user,
-        run_as_group: body.run_as_group,
-        fs_group: body.fs_group,
-        run_as_non_root: body.run_as_non_root,
-    };
+    // Read, validate, and replace with resourceVersion optimistic concurrency. Retrying the full
+    // sequence prevents two individually valid partial updates from racing into an invalid
+    // runAsUser/runAsNonRoot combination.
+    const MAX_RETRIES: u32 = 3;
+    let mut last_conflict = None;
+    for _ in 0..MAX_RETRIES {
+        let mut tenant = api
+            .get(&name)
+            .await
+            .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
 
-    let patch = serde_json::json!({
-        "spec": {
-            "securityContext": serde_json::to_value(&security_context).map_err(|e| Error::Json { source: e })?
+        if !apply_validated_security_context_update(&mut tenant, &body)? {
+            return Ok(Json(SecurityContextUpdateResponse {
+                success: true,
+                message: "SecurityContext updated".to_string(),
+            }));
         }
-    });
 
-    api.patch(&name, &PatchParams::default(), &Patch::Merge(&patch))
-        .await
-        .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
+        match api.replace(&name, &Default::default(), &tenant).await {
+            Ok(_) => {
+                return Ok(Json(SecurityContextUpdateResponse {
+                    success: true,
+                    message: "SecurityContext updated".to_string(),
+                }));
+            }
+            Err(error) => {
+                let mapped = error::map_kube_error(error, format!("Tenant '{}'", name));
+                if !matches!(&mapped, Error::Conflict { .. }) {
+                    return Err(mapped);
+                }
+                last_conflict = Some(mapped);
+            }
+        }
+    }
 
-    Ok(Json(SecurityContextUpdateResponse {
-        success: true,
-        message: "SecurityContext updated".to_string(),
+    Err(last_conflict.unwrap_or_else(|| Error::Conflict {
+        message: "Resource was modified by another request, please retry".to_string(),
     }))
 }
 
@@ -110,3 +149,123 @@ async fn create_client(claims: &Claims) -> Result<Client> {
         message: format!("Failed to create K8s client: {}", e),
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{apply_validated_security_context_update, security_context_info};
+    use crate::console::error::Error;
+    use crate::console::models::encryption::{PatchField, UpdateSecurityContextRequest};
+    use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
+
+    #[test]
+    fn legacy_root_context_reports_effective_non_root_false() {
+        let context = PodSecurityContextOverride {
+            run_as_user: Some(0),
+            run_as_non_root: None,
+            ..Default::default()
+        };
+
+        let info = security_context_info(Some(&context));
+
+        assert_eq!(info.run_as_user, Some(0));
+        assert_eq!(info.run_as_non_root, None);
+        assert!(!info.effective_run_as_non_root);
+    }
+
+    #[test]
+    fn explicit_non_root_setting_wins_in_console_response() {
+        let context = PodSecurityContextOverride {
+            run_as_user: Some(0),
+            run_as_non_root: Some(true),
+            ..Default::default()
+        };
+
+        let info = security_context_info(Some(&context));
+
+        assert_eq!(info.run_as_non_root, Some(true));
+        assert!(info.effective_run_as_non_root);
+    }
+
+    #[test]
+    fn absent_context_reports_default_without_inventing_raw_values() {
+        let info = security_context_info(None);
+
+        assert_eq!(info.run_as_user, None);
+        assert_eq!(info.run_as_non_root, None);
+        assert!(info.effective_run_as_non_root);
+    }
+
+    #[test]
+    fn partial_update_preserves_advanced_and_untouched_fields() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            run_as_user: Some(10_001),
+            run_as_group: Some(10_002),
+            seccomp_profile: Some(k8s_openapi::api::core::v1::SeccompProfile {
+                type_: "RuntimeDefault".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        let changed = apply_validated_security_context_update(
+            &mut tenant,
+            &UpdateSecurityContextRequest {
+                run_as_user: PatchField::Null,
+                run_as_group: PatchField::Missing,
+                fs_group: PatchField::Value(20_001),
+                run_as_non_root: PatchField::Value(false),
+            },
+        )
+        .expect("valid partial update");
+
+        assert!(changed);
+        let context = tenant.spec.security_context.expect("security context");
+        assert_eq!(context.run_as_user, None);
+        assert_eq!(context.run_as_group, Some(10_002));
+        assert_eq!(context.fs_group, Some(20_001));
+        assert_eq!(context.run_as_non_root, Some(false));
+        assert_eq!(
+            context.seccomp_profile.map(|profile| profile.type_),
+            Some("RuntimeDefault".to_string())
+        );
+    }
+
+    #[test]
+    fn empty_update_skips_validation_and_kubernetes_write() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        let changed = apply_validated_security_context_update(
+            &mut tenant,
+            &UpdateSecurityContextRequest {
+                run_as_user: PatchField::Missing,
+                run_as_group: PatchField::Missing,
+                fs_group: PatchField::Missing,
+                run_as_non_root: PatchField::Missing,
+            },
+        )
+        .expect("empty update should be a no-op");
+
+        assert!(!changed);
+        assert!(tenant.spec.security_context.is_none());
+    }
+
+    #[test]
+    fn contradictory_root_update_is_rejected_before_write() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        let error = apply_validated_security_context_update(
+            &mut tenant,
+            &UpdateSecurityContextRequest {
+                run_as_user: PatchField::Value(0),
+                run_as_group: PatchField::Missing,
+                fs_group: PatchField::Missing,
+                run_as_non_root: PatchField::Value(true),
+            },
+        )
+        .expect_err("UID 0 with runAsNonRoot=true must not be persisted");
+
+        assert!(matches!(
+            error,
+            Error::BadRequest { message }
+                if message.contains("UID 0") && message.contains("explicitly true")
+        ));
+    }
+}
diff --git a/src/console/handlers/tenants.rs b/src/console/handlers/tenants.rs
index 27753aa..d615d48 100755
--- a/src/console/handlers/tenants.rs
+++ b/src/console/handlers/tenants.rs
@@ -12,15 +12,16 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+use super::validate_tenant_for_write;
 use crate::console::{
     error::{self, Error, Result},
     models::tenant::*,
     state::Claims,
 };
 use crate::types::v1alpha1::{
-    encryption::PodSecurityContextOverride,
     persistence::PersistenceConfig,
     pool::{Pool, validate_pool_shape_immutable},
+    security_context::PodSecurityContextOverride,
     tenant::Tenant,
 };
 use axum::{
@@ -28,7 +29,34 @@ use axum::{
     extract::{Path, Query},
 };
 use k8s_openapi::api::core::v1 as corev1;
-use kube::{Api, Client, ResourceExt, api::ListParams};
+use kube::{Api, Client, CustomResourceExt, Resource, ResourceExt, api::ListParams};
+use serde_json::Value;
+use std::sync::LazyLock;
+
+#[derive(serde::Deserialize)]
+struct TenantManifestTypeMeta {
+    #[serde(rename = "apiVersion")]
+    api_version: Option<String>,
+    kind: Option<String>,
+}
+
+static TENANT_OPENAPI_SCHEMA: LazyLock<std::result::Result<Value, String>> = LazyLock::new(|| {
+    let crd = serde_json::to_value(Tenant::crd())
+        .map_err(|error| format!("failed to serialize Tenant CRD: {error}"))?;
+    let expected_version = Tenant::version(&());
+    crd.pointer("/spec/versions")
+        .and_then(Value::as_array)
+        .and_then(|versions| {
+            versions.iter().find(|version| {
+                version.get("name").and_then(Value::as_str) == Some(expected_version.as_ref())
+            })
+        })
+        .and_then(|version| version.pointer("/schema/openAPIV3Schema"))
+        .cloned()
+        .ok_or_else(|| {
+            format!("Tenant CRD does not contain an OpenAPI schema for {expected_version}")
+        })
+});
 
 // curl -s -X POST http://localhost:9090/api/v1/login \
 //   -H "Content-Type: application/json" \
@@ -215,11 +243,10 @@ pub async fn create_tenant(
 
     let client = create_client(&claims).await?;
 
-    // Ensure namespace exists
+    // Preserve the existing JSON-create behavior; the complete YAML endpoint performs
+    // stricter namespace validation before reaching Kubernetes.
     let ns_api: Api<corev1::Namespace> = Api::all(client.clone());
     let ns_exists = ns_api.get(&req.namespace).await.is_ok();
-
-    // Create when absent
     if !ns_exists {
         let ns = corev1::Namespace {
             metadata: k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta {
@@ -265,6 +292,8 @@ pub async fn create_tenant(
                 labels: None,
                 annotations: None,
             },
+            security_context: None,
+            container_security_context: None,
             scheduling: Default::default(),
         })
         .collect();
@@ -277,6 +306,7 @@ pub async fn create_tenant(
             run_as_group: sc.run_as_group,
             fs_group: sc.fs_group,
             run_as_non_root: sc.run_as_non_root,
+            seccomp_profile: None,
         });
 
     let tenant = Tenant {
@@ -300,11 +330,7 @@ pub async fn create_tenant(
         },
         status: None,
     };
-    if let Err(e) = tenant.validate_pools() {
-        return Err(Error::BadRequest {
-            message: e.to_string(),
-        });
-    }
+    validate_tenant_for_write(&tenant)?;
 
     let api: Api<Tenant> = Api::namespaced(client, &req.namespace);
     let created = api
@@ -317,6 +343,28 @@ pub async fn create_tenant(
     Ok(Json(item))
 }
 
+/// Create a Tenant from its complete YAML representation.
+pub async fn create_tenant_from_yaml(
+    Extension(claims): Extension<Claims>,
+    Json(req): Json<TenantYAML>,
+) -> Result<Json<TenantListItem>> {
+    let tenant = parse_tenant_yaml_for_create(&req.yaml)?;
+    let (name, namespace) = tenant_identity(&tenant)?;
+    let name = name.to_string();
+    let namespace = namespace.to_string();
+
+    let client = create_client(&claims).await?;
+    ensure_namespace_exists(&client, &namespace).await?;
+
+    let api: Api<Tenant> = Api::namespaced(client.clone(), &namespace);
+    let created = api
+        .create(&Default::default(), &tenant)
+        .await
+        .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
+
+    Ok(Json(tenant_to_list_item(created)))
+}
+
 /// Delete a Tenant CR.
 pub async fn delete_tenant(
     Path((namespace, name)): Path<(String, String)>,
@@ -467,11 +515,7 @@ pub async fn update_tenant(
             message: "No fields to update".to_string(),
         });
     }
-    if let Err(e) = tenant.validate_pools() {
-        return Err(Error::BadRequest {
-            message: e.to_string(),
-        });
-    }
+    validate_tenant_for_write(&tenant)?;
 
     // Replace status-safe fields
     let updated_tenant = api
@@ -515,9 +559,7 @@ pub async fn put_tenant_yaml(
     Extension(claims): Extension<Claims>,
     Json(req): Json<TenantYAML>,
 ) -> Result<Json<TenantYAML>> {
-    let in_tenant: Tenant = serde_yaml_ng::from_str(&req.yaml).map_err(|e| Error::BadRequest {
-        message: format!("Invalid Tenant YAML: {}", e),
-    })?;
+    let in_tenant = parse_tenant_yaml(&req.yaml)?;
 
     // Validate: name and namespace in YAML must match URL params
     let in_name = in_tenant.metadata.name.as_deref().unwrap_or_default();
@@ -554,27 +596,8 @@ pub async fn put_tenant_yaml(
         .get(&name)
         .await
         .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
-    if let Err(message) = validate_pool_shape_immutable(&current.spec.pools, &in_tenant.spec.pools)
-    {
-        return Err(Error::BadRequest { message });
-    }
 
-    // Only update safe fields: spec, metadata.labels, metadata.annotations, metadata.finalizers
-    current.spec = in_tenant.spec;
-    if let Err(e) = current.validate_pools() {
-        return Err(Error::BadRequest {
-            message: e.to_string(),
-        });
-    }
-    if let Some(labels) = in_tenant.metadata.labels {
-        current.metadata.labels = Some(labels);
-    }
-    if let Some(annotations) = in_tenant.metadata.annotations {
-        current.metadata.annotations = Some(annotations);
-    }
-    if let Some(finalizers) = in_tenant.metadata.finalizers {
-        current.metadata.finalizers = Some(finalizers);
-    }
+    apply_tenant_yaml_update(&mut current, in_tenant)?;
 
     let updated = api
         .replace(&name, &Default::default(), &current)
@@ -592,6 +615,26 @@ pub async fn put_tenant_yaml(
     Ok(Json(TenantYAML { yaml: yaml_str }))
 }
 
+fn apply_tenant_yaml_update(current: &mut Tenant, incoming: Tenant) -> Result<()> {
+    if let Err(message) = validate_pool_shape_immutable(&current.spec.pools, &incoming.spec.pools) {
+        return Err(Error::BadRequest { message });
+    }
+
+    // Only update safe fields. Apply annotations before validation because workload-security
+    // acknowledgement annotations are intentionally bound to the incoming image reference.
+    current.spec = incoming.spec;
+    if let Some(labels) = incoming.metadata.labels {
+        current.metadata.labels = Some(labels);
+    }
+    if let Some(annotations) = incoming.metadata.annotations {
+        current.metadata.annotations = Some(annotations);
+    }
+    if let Some(finalizers) = incoming.metadata.finalizers {
+        current.metadata.finalizers = Some(finalizers);
+    }
+    validate_tenant_for_write(current)
+}
+
 /// Build a client using the Kubernetes bearer token from session claims.
 async fn create_client(claims: &Claims) -> Result<Client> {
     let mut config = kube::Config::infer()
@@ -607,6 +650,270 @@ async fn create_client(claims: &Claims) -> Result<Client> {
     })
 }
 
+async fn ensure_namespace_exists(client: &Client, namespace: &str) -> Result<()> {
+    let ns_api: Api<corev1::Namespace> = Api::all(client.clone());
+    match ns_api.get(namespace).await {
+        Ok(_) => return Ok(()),
+        Err(kube::Error::Api(response)) if response.code == 404 => {}
+        Err(error) => {
+            return Err(error::map_kube_error(
+                error,
+                format!("Namespace '{namespace}'"),
+            ));
+        }
+    }
+
+    let ns = corev1::Namespace {
+        metadata: k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta {
+            name: Some(namespace.to_string()),
+            ..Default::default()
+        },
+        ..Default::default()
+    };
+    match ns_api.create(&Default::default(), &ns).await {
+        Ok(_) => Ok(()),
+        Err(kube::Error::Api(response))
+            if response.code == 409 && response.reason == "AlreadyExists" =>
+        {
+            // Another request may have created the Namespace after our initial GET.
+            // Re-read it so unrelated create conflicts are not silently accepted.
+            ns_api
+                .get(namespace)
+                .await
+                .map(|_| ())
+                .map_err(|error| error::map_kube_error(error, format!("Namespace '{}'", namespace)))
+        }
+        Err(error) => Err(error::map_kube_error(
+            error,
+            format!("Namespace '{}'", namespace),
+        )),
+    }
+}
+
+fn tenant_openapi_schema() -> Result<&'static Value> {
+    TENANT_OPENAPI_SCHEMA
+        .as_ref()
+        .map_err(|message| Error::InternalServer {
+            message: message.clone(),
+        })
+}
+
+fn collect_unknown_manifest_fields(
+    value: &Value,
+    schema: &Value,
+    path: &str,
+    unknown_fields: &mut Vec<String>,
+) {
+    if value.is_null()
+        || schema
+            .get("x-kubernetes-preserve-unknown-fields")
+            .and_then(Value::as_bool)
+            == Some(true)
+    {
+        return;
+    }
+
+    if let Some(object) = value.as_object() {
+        let properties = schema.get("properties").and_then(Value::as_object);
+        let additional_properties = schema.get("additionalProperties");
+
+        for (name, child) in object {
+            // TypeMeta and ObjectMeta are implicit CRD fields and are validated by
+            // their typed deserializers rather than openAPIV3Schema.
+            if path.is_empty() && matches!(name.as_str(), "apiVersion" | "kind" | "metadata") {
+                continue;
+            }
+
+            let child_path = if path.is_empty() {
+                name.clone()
+            } else {
+                format!("{path}.{name}")
+            };
+            if let Some(child_schema) = properties.and_then(|properties| properties.get(name)) {
+                collect_unknown_manifest_fields(child, child_schema, &child_path, unknown_fields);
+                continue;
+            }
+
+            match additional_properties {
+                Some(Value::Bool(true)) => {}
+                Some(Value::Object(entries)) if entries.is_empty() => {}
+                Some(child_schema @ Value::Object(_)) => collect_unknown_manifest_fields(
+                    child,
+                    child_schema,
+                    &child_path,
+                    unknown_fields,
+                ),
+                _ => unknown_fields.push(child_path),
+            }
+        }
+        return;
+    }
+
+    if let Some(items) = value.as_array()
+        && let Some(item_schema) = schema.get("items")
+    {
+        for (index, item) in items.iter().enumerate() {
+            collect_unknown_manifest_fields(
+                item,
+                item_schema,
+                &format!("{path}.{index}"),
+                unknown_fields,
+            );
+        }
+    }
+}
+
+fn normalized_ignored_path(path: &serde_ignored::Path<'_>) -> String {
+    fn collect_segments(path: &serde_ignored::Path<'_>, segments: &mut Vec<String>) {
+        match path {
+            serde_ignored::Path::Root => {}
+            serde_ignored::Path::Seq { parent, index } => {
+                collect_segments(parent, segments);
+                segments.push(index.to_string());
+            }
+            serde_ignored::Path::Map { parent, key } => {
+                collect_segments(parent, segments);
+                segments.push(key.clone());
+            }
+            serde_ignored::Path::Some { parent }
+            | serde_ignored::Path::NewtypeStruct { parent }
+            | serde_ignored::Path::NewtypeVariant { parent } => {
+                collect_segments(parent, segments);
+            }
+        }
+    }
+
+    let mut segments = Vec::new();
+    collect_segments(path, &mut segments);
+    segments.join(".")
+}
+
+fn parse_tenant_yaml_for_create(yaml: &str) -> Result<Tenant> {
+    let mut tenant = parse_tenant_yaml(yaml)?;
+    let (name, namespace) = tenant_identity(&tenant)?;
+
+    crate::types::v1alpha1::tenant::validate_dns1035_label(name).map_err(|error| {
+        Error::BadRequest {
+            message: error.to_string(),
+        }
+    })?;
+    validate_namespace_name(namespace).map_err(|message| Error::BadRequest { message })?;
+    validate_tenant_for_write(&tenant)?;
+
+    sanitize_tenant_for_create(&mut tenant);
+    Ok(tenant)
+}
+
+fn parse_tenant_yaml(yaml: &str) -> Result<Tenant> {
+    let type_meta: TenantManifestTypeMeta =
+        serde_yaml_ng::from_str(yaml).map_err(|error| Error::BadRequest {
+            message: format!("Invalid Tenant YAML: {error}"),
+        })?;
+
+    let expected_api_version = Tenant::api_version(&());
+    if type_meta.api_version.as_deref() != Some(expected_api_version.as_ref()) {
+        return Err(Error::BadRequest {
+            message: format!("apiVersion must be '{expected_api_version}'"),
+        });
+    }
+    let expected_kind = Tenant::kind(&());
+    if type_meta.kind.as_deref() != Some(expected_kind.as_ref()) {
+        return Err(Error::BadRequest {
+            message: format!("kind must be '{expected_kind}'"),
+        });
+    }
+
+    let value: serde_json::Value =
+        serde_yaml_ng::from_str(yaml).map_err(|error| Error::BadRequest {
+            message: format!("Invalid Tenant YAML: {error}"),
+        })?;
+    let mut unknown_fields = Vec::new();
+    collect_unknown_manifest_fields(&value, tenant_openapi_schema()?, "", &mut unknown_fields);
+    let tenant = serde_ignored::deserialize(value, |path| {
+        let path = normalized_ignored_path(&path);
+        // ObjectMeta is implicit in the CRD OpenAPI schema, so its typed
+        // deserializer is the source of truth for unknown metadata fields.
+        // The generated schema walker covers spec, status, and root fields.
+        if path == "metadata" || path.starts_with("metadata.") {
+            unknown_fields.push(path);
+        }
+    })
+    .map_err(|error| Error::BadRequest {
+        message: format!("Invalid Tenant YAML: {error}"),
+    })?;
+
+    if !unknown_fields.is_empty() {
+        unknown_fields.sort();
+        unknown_fields.dedup();
+        return Err(Error::BadRequest {
+            message: format!(
+                "Unknown field(s) in Tenant YAML: {}",
+                unknown_fields.join(", ")
+            ),
+        });
+    }
+
+    Ok(tenant)
+}
+
+fn tenant_identity(tenant: &Tenant) -> Result<(&str, &str)> {
+    let name = tenant
+        .metadata
+        .name
+        .as_deref()
+        .filter(|name| !name.is_empty())
+        .ok_or_else(|| Error::BadRequest {
+            message: "metadata.name is required".to_string(),
+        })?;
+    let namespace = tenant
+        .metadata
+        .namespace
+        .as_deref()
+        .filter(|namespace| !namespace.is_empty())
+        .ok_or_else(|| Error::BadRequest {
+            message: "metadata.namespace is required".to_string(),
+        })?;
+
+    Ok((name, namespace))
+}
+
+fn validate_namespace_name(namespace: &str) -> std::result::Result<(), String> {
+    if namespace.len() > 63 {
+        return Err("metadata.namespace must be at most 63 characters".to_string());
+    }
+
+    let bytes = namespace.as_bytes();
+    if !bytes
+        .first()
+        .is_some_and(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit())
+        || !bytes
+            .last()
+            .is_some_and(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit())
+        || bytes
+            .iter()
+            .any(|byte| !byte.is_ascii_lowercase() && !byte.is_ascii_digit() && *byte != b'-')
+    {
+        return Err(
+            "metadata.namespace must be a valid DNS-1123 label (lowercase alphanumeric or '-')"
+                .to_string(),
+        );
+    }
+
+    Ok(())
+}
+
+fn sanitize_tenant_for_create(tenant: &mut Tenant) {
+    tenant.status = None;
+    tenant.metadata.creation_timestamp = None;
+    tenant.metadata.deletion_grace_period_seconds = None;
+    tenant.metadata.deletion_timestamp = None;
+    tenant.metadata.generation = None;
+    tenant.metadata.managed_fields = None;
+    tenant.metadata.resource_version = None;
+    tenant.metadata.self_link = None;
+    tenant.metadata.uid = None;
+}
+
 fn build_tenant_list_items(
     tenants: Vec<Tenant>,
     state_filter: Option<&str>,
@@ -652,7 +959,63 @@ fn summarize_tenant_states(tenants: &[Tenant]) -> TenantStateCountsResponse {
 
 #[cfg(test)]
 mod tests {
-    use super::state_matches_filter;
+    use super::{
+        apply_tenant_yaml_update, ensure_namespace_exists, parse_tenant_yaml,
+        parse_tenant_yaml_for_create, state_matches_filter,
+    };
+    use crate::console::error::Error;
+    use crate::types::v1alpha1::tenant::RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION;
+    use kube::{Client, client::Body};
+    use std::sync::{
+        Arc,
+        atomic::{AtomicUsize, Ordering},
+    };
+    use tower::service_fn;
+
+    const MINIMAL_TENANT_YAML: &str = r#"
+apiVersion: rustfs.com/v1alpha1
+kind: Tenant
+metadata:
+  name: legacy-root
+  namespace: storage
+spec:
+  pools:
+    - name: pool-0
+      servers: 1
+      persistence:
+        volumesPerServer: 1
+"#;
+
+    #[test]
+    fn raw_yaml_update_validates_image_and_acknowledgement_from_the_same_request() {
+        let mut current = crate::tests::create_test_tenant(None, None);
+        current.spec.image = Some("rustfs/rustfs:1.0.0-beta.10".to_string());
+
+        let image = "registry.example.com/rustfs/rustfs@sha256:0123456789abcdef";
+        let mut incoming = current.clone();
+        incoming.spec.image = Some(image.to_string());
+        incoming
+            .metadata
+            .annotations
+            .get_or_insert_default()
+            .insert(
+                RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION.to_string(),
+                image.to_string(),
+            );
+
+        apply_tenant_yaml_update(&mut current, incoming)
+            .expect("an incoming image-bound acknowledgement should validate atomically");
+        assert_eq!(current.spec.image.as_deref(), Some(image));
+        assert_eq!(
+            current
+                .metadata
+                .annotations
+                .as_ref()
+                .and_then(|annotations| annotations.get(RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION))
+                .map(String::as_str),
+            Some(image)
+        );
+    }
 
     #[test]
     fn state_filter_is_case_insensitive_for_known_states() {
@@ -665,4 +1028,467 @@ mod tests {
     fn unknown_filter_value_does_not_match_unknown_state() {
         assert!(!state_matches_filter("Unknown", Some("foo")));
     }
+
+    #[test]
+    fn yaml_create_preserves_complete_security_context_configuration() {
+        let tenant = parse_tenant_yaml_for_create(
+            r#"
+apiVersion: rustfs.com/v1alpha1
+kind: Tenant
+metadata:
+  name: legacy-root
+  namespace: storage
+  labels:
+    team: storage
+  annotations:
+    example.com/note: preserved
+  finalizers:
+    - example.com/finalizer
+  ownerReferences:
+    - apiVersion: v1
+      kind: ConfigMap
+      name: tenant-owner
+      uid: owner-uid
+  resourceVersion: "42"
+  uid: tenant-uid
+  generation: 7
+  creationTimestamp: "2026-07-18T00:00:00Z"
+  deletionTimestamp: "2026-07-19T00:00:00Z"
+  deletionGracePeriodSeconds: 30
+  selfLink: /apis/rustfs.com/v1alpha1/namespaces/storage/tenants/legacy-root
+  managedFields:
+    - manager: kubectl
+      operation: Apply
+      apiVersion: rustfs.com/v1alpha1
+      fieldsType: FieldsV1
+spec:
+  image: rustfs/rustfs:1.0.0-alpha.99
+  securityContext:
+    runAsUser: 0
+    runAsGroup: 0
+    fsGroup: 0
+    seccompProfile:
+      type: Localhost
+      localhostProfile: profiles/rustfs.json
+  containerSecurityContext:
+    runAsUser: 0
+    allowPrivilegeEscalation: true
+    readOnlyRootFilesystem: false
+    capabilities:
+      add: [SYS_ADMIN]
+  pools:
+    - name: pool-0
+      servers: 1
+      persistence:
+        volumesPerServer: 1
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+        fsGroup: 0
+        seccompProfile:
+          type: Localhost
+          localhostProfile: profiles/pool-rustfs.json
+      containerSecurityContext:
+        runAsUser: 0
+        allowPrivilegeEscalation: true
+        capabilities:
+          add: [SYS_ADMIN]
+status:
+  currentState: Ready
+  availableReplicas: 1
+  pools: []
+"#,
+        )
+        .expect("complete Tenant YAML should parse");
+
+        let tenant_pod = tenant
+            .spec
+            .security_context
+            .as_ref()
+            .expect("Tenant Pod security context is preserved");
+        assert_eq!(tenant_pod.run_as_user, Some(0));
+        assert_eq!(tenant_pod.run_as_non_root, None);
+        assert_eq!(
+            tenant_pod
+                .seccomp_profile
+                .as_ref()
+                .and_then(|profile| profile.localhost_profile.as_deref()),
+            Some("profiles/rustfs.json")
+        );
+
+        let tenant_container = tenant
+            .spec
+            .container_security_context
+            .as_ref()
+            .expect("Tenant container security context is preserved");
+        assert_eq!(tenant_container.run_as_user, Some(0));
+        assert_eq!(tenant_container.allow_privilege_escalation, Some(true));
+        assert_eq!(
+            tenant_container
+                .capabilities
+                .as_ref()
+                .and_then(|capabilities| capabilities.add.as_ref()),
+            Some(&vec!["SYS_ADMIN".to_string()])
+        );
+
+        let pool = &tenant.spec.pools[0];
+        let pool_pod = pool
+            .security_context
+            .as_ref()
+            .expect("Pool Pod security context is preserved");
+        assert_eq!(pool_pod.run_as_user, Some(0));
+        assert_eq!(pool_pod.run_as_non_root, None);
+        assert_eq!(
+            pool_pod
+                .seccomp_profile
+                .as_ref()
+                .and_then(|profile| profile.localhost_profile.as_deref()),
+            Some("profiles/pool-rustfs.json")
+        );
+
+        let pool_container = pool
+            .container_security_context
+            .as_ref()
+            .expect("Pool container security context is preserved");
+        assert_eq!(pool_container.run_as_user, Some(0));
+        assert_eq!(pool_container.allow_privilege_escalation, Some(true));
+        assert_eq!(
+            pool_container
+                .capabilities
+                .as_ref()
+                .and_then(|capabilities| capabilities.add.as_ref()),
+            Some(&vec!["SYS_ADMIN".to_string()])
+        );
+
+        assert_eq!(
+            tenant
+                .metadata
+                .labels
+                .as_ref()
+                .and_then(|labels| labels.get("team"))
+                .map(String::as_str),
+            Some("storage")
+        );
+        assert_eq!(
+            tenant
+                .metadata
+                .annotations
+                .as_ref()
+                .and_then(|annotations| annotations.get("example.com/note"))
+                .map(String::as_str),
+            Some("preserved")
+        );
+        assert!(tenant.metadata.finalizers.is_some());
+        assert!(tenant.metadata.owner_references.is_some());
+    }
+
+    #[test]
+    fn yaml_create_strips_status_and_server_owned_metadata() {
+        let yaml = r#"
+apiVersion: rustfs.com/v1alpha1
+kind: Tenant
+metadata:
+  name: legacy-root
+  namespace: storage
+  resourceVersion: "42"
+  uid: tenant-uid
+  generation: 7
+  creationTimestamp: "2026-07-18T00:00:00Z"
+  deletionTimestamp: "2026-07-19T00:00:00Z"
+  deletionGracePeriodSeconds: 30
+  selfLink: /apis/rustfs.com/v1alpha1/namespaces/storage/tenants/legacy-root
+  managedFields:
+    - manager: kubectl
+      operation: Apply
+      apiVersion: rustfs.com/v1alpha1
+      fieldsType: FieldsV1
+spec:
+  pools:
+    - name: pool-0
+      servers: 1
+      persistence:
+        volumesPerServer: 1
+status:
+  currentState: Ready
+  availableReplicas: 1
+  pools: []
+"#;
+
+        let tenant = parse_tenant_yaml_for_create(yaml).expect("Tenant YAML should parse");
+
+        assert!(tenant.status.is_none());
+        assert!(tenant.metadata.resource_version.is_none());
+        assert!(tenant.metadata.uid.is_none());
+        assert!(tenant.metadata.generation.is_none());
+        assert!(tenant.metadata.creation_timestamp.is_none());
+        assert!(tenant.metadata.deletion_timestamp.is_none());
+        assert!(tenant.metadata.deletion_grace_period_seconds.is_none());
+        assert!(tenant.metadata.self_link.is_none());
+        assert!(tenant.metadata.managed_fields.is_none());
+    }
+
+    #[test]
+    fn yaml_create_rejects_wrong_type_metadata_and_missing_identity() {
+        let cases = [
+            (
+                MINIMAL_TENANT_YAML.replace("rustfs.com/v1alpha1", "v1"),
+                "apiVersion",
+            ),
+            (MINIMAL_TENANT_YAML.replace("Tenant", "ConfigMap"), "kind"),
+            (
+                MINIMAL_TENANT_YAML.replace("  name: legacy-root\n", ""),
+                "metadata.name",
+            ),
+            (
+                MINIMAL_TENANT_YAML.replace("  namespace: storage\n", ""),
+                "metadata.namespace",
+            ),
+            (
+                MINIMAL_TENANT_YAML
+                    .replace("metadata:\n  name: legacy-root\n  namespace: storage\n", ""),
+                "metadata",
+            ),
+        ];
+
+        for (yaml, expected) in cases {
+            let message = bad_request_message(&yaml);
+            assert!(
+                message.contains(expected),
+                "expected '{expected}' in '{message}'"
+            );
+        }
+    }
+
+    #[test]
+    fn yaml_create_rejects_invalid_namespace_and_empty_pools() {
+        let invalid_namespace = MINIMAL_TENANT_YAML.replace("storage", "Storage_Team");
+        assert!(bad_request_message(&invalid_namespace).contains("metadata.namespace"));
+
+        let empty_pools = MINIMAL_TENANT_YAML.replace(
+            "  pools:\n    - name: pool-0\n      servers: 1\n      persistence:\n        volumesPerServer: 1\n",
+            "  pools: []\n",
+        );
+        assert!(bad_request_message(&empty_pools).contains("pools must be configured"));
+    }
+
+    #[test]
+    fn yaml_create_rejects_incompatible_or_invalid_security_profiles() {
+        let incompatible_image = MINIMAL_TENANT_YAML.replace(
+            "spec:\n  pools:",
+            "spec:\n  image: rustfs/rustfs:1.0.0-alpha.99\n  pools:",
+        );
+        assert!(bad_request_message(&incompatible_image).contains("Tokio io_uring"));
+
+        let invalid_profile = MINIMAL_TENANT_YAML.replace(
+            "spec:\n  pools:",
+            "spec:\n  securityContext:\n    seccompProfile:\n      type: RuntimeDefaut\n  pools:",
+        );
+        assert!(bad_request_message(&invalid_profile).contains("must be RuntimeDefault"));
+    }
+
+    #[test]
+    fn yaml_create_rejects_unknown_nested_field_with_exact_path() {
+        let persistence_yaml = MINIMAL_TENANT_YAML.replace(
+            "        volumesPerServer: 1",
+            "        volumesPerServer: 1\n        volumePerSever: 2",
+        );
+
+        assert_eq!(
+            bad_request_message(&persistence_yaml),
+            "Unknown field(s) in Tenant YAML: spec.pools.0.persistence.volumePerSever"
+        );
+
+        let security_context_yaml = MINIMAL_TENANT_YAML.replace(
+            "spec:\n",
+            "spec:\n  containerSecurityContex:\n    runAsUser: 1000\n",
+        );
+        assert_eq!(
+            bad_request_message(&security_context_yaml),
+            "Unknown field(s) in Tenant YAML: spec.containerSecurityContex"
+        );
+
+        let flattened_pool_yaml = MINIMAL_TENANT_YAML.replace(
+            "      servers: 1",
+            "      servers: 1\n      unknownPoolSetting: true",
+        );
+        assert_eq!(
+            bad_request_message(&flattened_pool_yaml),
+            "Unknown field(s) in Tenant YAML: spec.pools.0.unknownPoolSetting"
+        );
+    }
+
+    #[test]
+    fn yaml_create_reports_optional_object_unknown_field_once_without_wrapper_segments() {
+        let yaml = MINIMAL_TENANT_YAML.replace(
+            "spec:\n",
+            "spec:\n  containerSecurityContext:\n    runAsUser: 1000\n    unknownSecurity: true\n",
+        );
+
+        let message = bad_request_message(&yaml);
+        assert_eq!(
+            message,
+            "Unknown field(s) in Tenant YAML: spec.containerSecurityContext.unknownSecurity"
+        );
+        assert!(!message.contains('?'));
+        assert_eq!(message.matches("unknownSecurity").count(), 1);
+    }
+
+    #[test]
+    fn yaml_create_reports_metadata_array_unknown_field_without_wrapper_segments() {
+        let yaml = MINIMAL_TENANT_YAML.replace(
+            "  namespace: storage",
+            "  namespace: storage\n  ownerReferences:\n    - apiVersion: v1\n      kind: ConfigMap\n      name: tenant-owner\n      uid: owner-uid\n      unknownOwnerField: true",
+        );
+
+        let message = bad_request_message(&yaml);
+        assert_eq!(
+            message,
+            "Unknown field(s) in Tenant YAML: metadata.ownerReferences.0.unknownOwnerField"
+        );
+        assert!(!message.contains('?'));
+        assert_eq!(message.matches("unknownOwnerField").count(), 1);
+    }
+
+    #[test]
+    fn yaml_create_allows_arbitrary_keys_in_schema_maps() {
+        let yaml = MINIMAL_TENANT_YAML.replace(
+            "      servers: 1",
+            "      servers: 1\n      nodeSelector:\n        topology.kubernetes.io/zone: zone-a\n      resources:\n        requests:\n          example.com/device: '1'",
+        );
+
+        let tenant = parse_tenant_yaml_for_create(&yaml)
+            .expect("schema additionalProperties maps should accept arbitrary keys");
+        let scheduling = &tenant.spec.pools[0].scheduling;
+        assert_eq!(
+            scheduling
+                .node_selector
+                .as_ref()
+                .and_then(|selector| selector.get("topology.kubernetes.io/zone"))
+                .map(String::as_str),
+            Some("zone-a")
+        );
+    }
+
+    #[test]
+    fn raw_yaml_update_rejects_unknown_top_level_field_with_exact_path() {
+        let yaml = MINIMAL_TENANT_YAML.replace("kind: Tenant", "kind: Tenant\nunknownRoot: true");
+
+        assert_eq!(
+            bad_parse_request_message(&yaml),
+            "Unknown field(s) in Tenant YAML: unknownRoot"
+        );
+    }
+
+    #[tokio::test]
+    async fn namespace_create_accepts_verified_already_exists_race() {
+        let request_count = Arc::new(AtomicUsize::new(0));
+        let service = service_fn({
+            let request_count = Arc::clone(&request_count);
+            move |request: http::Request<Body>| {
+                let request_number = request_count.fetch_add(1, Ordering::SeqCst);
+                async move {
+                    let (status, body) = match request_number {
+                        0 => {
+                            assert_eq!(request.method(), http::Method::GET);
+                            assert_eq!(request.uri().path(), "/api/v1/namespaces/storage");
+                            (
+                                http::StatusCode::NOT_FOUND,
+                                serde_json::json!({
+                                    "status": "Failure",
+                                    "message": "namespaces \"storage\" not found",
+                                    "reason": "NotFound",
+                                    "code": 404
+                                }),
+                            )
+                        }
+                        1 => {
+                            assert_eq!(request.method(), http::Method::POST);
+                            assert_eq!(request.uri().path(), "/api/v1/namespaces");
+                            (
+                                http::StatusCode::CONFLICT,
+                                serde_json::json!({
+                                    "status": "Failure",
+                                    "message": "namespaces \"storage\" already exists",
+                                    "reason": "AlreadyExists",
+                                    "code": 409
+                                }),
+                            )
+                        }
+                        2 => {
+                            assert_eq!(request.method(), http::Method::GET);
+                            assert_eq!(request.uri().path(), "/api/v1/namespaces/storage");
+                            (
+                                http::StatusCode::OK,
+                                serde_json::json!({
+                                    "apiVersion": "v1",
+                                    "kind": "Namespace",
+                                    "metadata": { "name": "storage" }
+                                }),
+                            )
+                        }
+                        other => panic!("unexpected request number {other}"),
+                    };
+
+                    Ok::<_, std::convert::Infallible>(
+                        http::Response::builder()
+                            .status(status)
+                            .body(Body::from(
+                                serde_json::to_vec(&body).expect("response body should serialize"),
+                            ))
+                            .expect("response should build"),
+                    )
+                }
+            }
+        });
+        let client = Client::new(service, "default");
+
+        ensure_namespace_exists(&client, "storage")
+            .await
+            .expect("AlreadyExists race should be treated as success after verification");
+
+        assert_eq!(request_count.load(Ordering::SeqCst), 3);
+    }
+
+    #[test]
+    fn raw_yaml_parser_allows_omitted_identity_but_validates_type_metadata() {
+        let without_identity = MINIMAL_TENANT_YAML.replace(
+            "metadata:\n  name: legacy-root\n  namespace: storage\n",
+            "metadata: {}\n",
+        );
+        let tenant = parse_tenant_yaml(&without_identity)
+            .expect("raw update YAML may omit metadata name and namespace");
+        assert!(tenant.metadata.name.is_none());
+        assert!(tenant.metadata.namespace.is_none());
+
+        let wrong_kind = without_identity.replace("kind: Tenant", "kind: ConfigMap");
+        assert!(bad_parse_request_message(&wrong_kind).contains("kind"));
+    }
+
+    #[test]
+    fn serialized_tenant_round_trips_through_raw_yaml_parser() {
+        let tenant = crate::tests::create_test_tenant(None, None);
+        let yaml = serde_yaml_ng::to_string(&tenant).expect("Tenant should serialize to YAML");
+
+        assert!(yaml.contains("apiVersion: rustfs.com/v1alpha1"));
+        assert!(yaml.contains("kind: Tenant"));
+
+        let parsed = parse_tenant_yaml(&yaml).expect("GET YAML should be accepted by PUT parser");
+        assert_eq!(parsed.metadata.name, tenant.metadata.name);
+        assert_eq!(parsed.metadata.namespace, tenant.metadata.namespace);
+        assert_eq!(parsed.spec.pools.len(), tenant.spec.pools.len());
+    }
+
+    fn bad_request_message(yaml: &str) -> String {
+        match parse_tenant_yaml_for_create(yaml) {
+            Err(Error::BadRequest { message }) => message,
+            result => panic!("expected BadRequest, got {result:?}"),
+        }
+    }
+
+    fn bad_parse_request_message(yaml: &str) -> String {
+        match parse_tenant_yaml(yaml) {
+            Err(Error::BadRequest { message }) => message,
+            result => panic!("expected BadRequest, got {result:?}"),
+        }
+    }
 }
diff --git a/src/console/models/encryption.rs b/src/console/models/encryption.rs
index 2c4f3b4..e6e2684 100644
--- a/src/console/models/encryption.rs
+++ b/src/console/models/encryption.rs
@@ -12,9 +12,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Deserializer, Serialize};
 use utoipa::ToSchema;
 
+use crate::types::v1alpha1::security_context::{
+    PodSecurityContextOverride, effective_run_as_non_root,
+};
+
 /// GET response – current encryption configuration for a Tenant.
 #[derive(Debug, Serialize, ToSchema)]
 #[serde(rename_all = "camelCase")]
@@ -50,7 +54,9 @@ pub struct LocalMasterKeySecretRefInfo {
     pub key: String,
 }
 
-/// SecurityContext information (TenantSpec; shown alongside encryption for convenience).
+/// Legacy Console form subset of the Tenant Pod security context.
+///
+/// The raw YAML editor is authoritative for seccomp, container, and Pool-level settings.
 #[derive(Debug, Serialize, ToSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct SecurityContextInfo {
@@ -58,6 +64,23 @@ pub struct SecurityContextInfo {
     pub run_as_group: Option<i64>,
     pub fs_group: Option<i64>,
     pub run_as_non_root: Option<bool>,
+    /// Effective value after applying the Operator default while preserving the raw override.
+    pub effective_run_as_non_root: bool,
+}
+
+impl SecurityContextInfo {
+    pub(crate) fn from_override(context: Option<&PodSecurityContextOverride>) -> Self {
+        let run_as_user = context.and_then(|context| context.run_as_user);
+        let run_as_non_root = context.and_then(|context| context.run_as_non_root);
+
+        Self {
+            run_as_user,
+            run_as_group: context.and_then(|context| context.run_as_group),
+            fs_group: context.and_then(|context| context.fs_group),
+            run_as_non_root,
+            effective_run_as_non_root: effective_run_as_non_root(run_as_user, run_as_non_root),
+        }
+    }
 }
 
 /// PUT request – update encryption configuration.
@@ -87,12 +110,50 @@ pub struct UpdateLocalRequest {
 }
 
 #[derive(Debug, Deserialize, ToSchema)]
-#[serde(rename_all = "camelCase")]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct UpdateSecurityContextRequest {
-    pub run_as_user: Option<i64>,
-    pub run_as_group: Option<i64>,
-    pub fs_group: Option<i64>,
-    pub run_as_non_root: Option<bool>,
+    /// Omit to preserve the current value, send `null` to clear it, or send an integer to set it.
+    #[serde(default)]
+    #[schema(value_type = Option<i64>, nullable, required = false)]
+    pub run_as_user: PatchField<i64>,
+    /// Omit to preserve the current value, send `null` to clear it, or send an integer to set it.
+    #[serde(default)]
+    #[schema(value_type = Option<i64>, nullable, required = false)]
+    pub run_as_group: PatchField<i64>,
+    /// Omit to preserve the current value, send `null` to clear it, or send an integer to set it.
+    #[serde(default)]
+    #[schema(value_type = Option<i64>, nullable, required = false)]
+    pub fs_group: PatchField<i64>,
+    /// Omit to preserve the current value, send `null` to restore the Operator default, or send a boolean to set it.
+    #[serde(default)]
+    #[schema(value_type = Option<bool>, nullable, required = false)]
+    pub run_as_non_root: PatchField<bool>,
+}
+
+/// A JSON Merge Patch field with distinct missing, null, and concrete-value states.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub enum PatchField<T> {
+    /// The property was omitted and must not be modified.
+    #[default]
+    Missing,
+    /// The property was explicitly set to JSON null and must be removed.
+    Null,
+    /// The property was explicitly assigned a value.
+    Value(T),
+}
+
+impl<'de, T> Deserialize<'de> for PatchField<T>
+where
+    T: Deserialize<'de>,
+{
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        Ok(Option::<T>::deserialize(deserializer)?
+            .map(Self::Value)
+            .unwrap_or(Self::Null))
+    }
 }
 
 /// Generic success response.
@@ -101,3 +162,64 @@ pub struct EncryptionUpdateResponse {
     pub success: bool,
     pub message: String,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{PatchField, SecurityContextInfo, UpdateSecurityContextRequest};
+    use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
+
+    #[test]
+    fn security_context_info_keeps_raw_value_and_serializes_effective_value() {
+        let context = PodSecurityContextOverride {
+            run_as_user: Some(0),
+            run_as_non_root: None,
+            ..Default::default()
+        };
+
+        let info = SecurityContextInfo::from_override(Some(&context));
+        let json = serde_json::to_value(&info).expect("SecurityContextInfo should serialize");
+
+        assert_eq!(info.run_as_non_root, None);
+        assert!(!info.effective_run_as_non_root);
+        assert!(json["runAsNonRoot"].is_null());
+        assert_eq!(json["effectiveRunAsNonRoot"], serde_json::json!(false));
+    }
+
+    #[test]
+    fn security_context_update_distinguishes_missing_null_and_value() {
+        let request: UpdateSecurityContextRequest = serde_json::from_value(serde_json::json!({
+            "runAsUser": null,
+            "runAsGroup": 20_001,
+            "runAsNonRoot": false
+        }))
+        .expect("security context update should deserialize");
+
+        assert_eq!(request.run_as_user, PatchField::Null);
+        assert_eq!(request.run_as_group, PatchField::Value(20_001));
+        assert_eq!(request.fs_group, PatchField::Missing);
+        assert_eq!(request.run_as_non_root, PatchField::Value(false));
+    }
+
+    #[test]
+    fn security_context_update_preserves_all_omitted_fields() {
+        let request: UpdateSecurityContextRequest = serde_json::from_value(serde_json::json!({}))
+            .expect("empty security context update should deserialize");
+
+        assert_eq!(request.run_as_user, PatchField::Missing);
+        assert_eq!(request.run_as_group, PatchField::Missing);
+        assert_eq!(request.fs_group, PatchField::Missing);
+        assert_eq!(request.run_as_non_root, PatchField::Missing);
+    }
+
+    #[test]
+    fn security_context_update_rejects_unknown_fields() {
+        let result: Result<UpdateSecurityContextRequest, _> =
+            serde_json::from_value(serde_json::json!({ "runAsUsr": 20_001 }));
+
+        let error = match result {
+            Ok(_) => panic!("unknown security context fields must be rejected"),
+            Err(error) => error,
+        };
+        assert!(error.to_string().contains("unknown field `runAsUsr`"));
+    }
+}
diff --git a/src/console/models/tenant.rs b/src/console/models/tenant.rs
index 3cf7a76..81d6e68 100755
--- a/src/console/models/tenant.rs
+++ b/src/console/models/tenant.rs
@@ -134,7 +134,9 @@ pub struct ServicePort {
     pub target_port: String,
 }
 
-/// SecurityContext for create/update (Pod runAsUser, runAsGroup, fsGroup, runAsNonRoot).
+/// Legacy Console form subset of the Tenant Pod security context.
+///
+/// The raw YAML editor is authoritative for seccomp, container, and Pool-level settings.
 #[derive(Debug, Deserialize, Serialize, ToSchema)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateSecurityContextRequest {
@@ -156,7 +158,7 @@ pub struct CreateTenantRequest {
     pub policies: Option<Vec<ProvisioningPolicy>>,
     pub users: Option<Vec<ProvisioningUser>>,
     pub buckets: Option<Vec<ProvisioningBucket>>,
-    /// Optional Pod SecurityContext override (runAsUser, runAsGroup, fsGroup, runAsNonRoot).
+    /// Optional legacy Pod security context form fields.
     pub security_context: Option<CreateSecurityContextRequest>,
 }
 
diff --git a/src/console/openapi.rs b/src/console/openapi.rs
index 7f78338..f8008b6 100644
--- a/src/console/openapi.rs
+++ b/src/console/openapi.rs
@@ -65,6 +65,7 @@ use crate::types::v1alpha1::status::provisioning::{
         api_list_tenants,
         api_get_tenant_state_counts,
         api_create_tenant,
+        api_create_tenant_from_yaml,
         api_list_tenants_by_ns,
         api_get_tenant_state_counts_by_ns,
         api_get_tenant,
@@ -216,6 +217,24 @@ fn api_create_tenant(_body: Json<CreateTenantRequest>) -> Json<TenantListItem> {
     unimplemented!("Documentation only")
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/v1/tenants/yaml",
+    request_body = TenantYAML,
+    responses(
+        (status = 200, body = TenantListItem),
+        (status = 400, body = ConsoleErrorResponse),
+        (status = 401, body = ConsoleErrorResponse),
+        (status = 403, body = ConsoleErrorResponse),
+        (status = 409, body = ConsoleErrorResponse),
+        (status = 500, body = ConsoleErrorResponse)
+    ),
+    tag = "tenants"
+)]
+fn api_create_tenant_from_yaml(_body: Json<TenantYAML>) -> Json<TenantListItem> {
+    unimplemented!("Documentation only")
+}
+
 #[utoipa::path(
     get,
     path = "/api/v1/namespaces/{namespace}/tenants",
@@ -459,4 +478,31 @@ mod tests {
             Some("#/components/schemas/UserCredentialsSecretRef")
         );
     }
+
+    #[test]
+    fn tenant_yaml_create_route_is_documented() {
+        let spec = serde_json::to_value(ApiDoc::openapi()).expect("OpenAPI spec serializes");
+        let operation = spec
+            .pointer("/paths/~1api~1v1~1tenants~1yaml/post")
+            .expect("Tenant YAML create path should exist");
+
+        assert_eq!(
+            operation
+                .pointer("/requestBody/content/application~1json/schema/$ref")
+                .and_then(Value::as_str),
+            Some("#/components/schemas/TenantYAML")
+        );
+        assert_eq!(
+            operation
+                .pointer("/responses/200/content/application~1json/schema/$ref")
+                .and_then(Value::as_str),
+            Some("#/components/schemas/TenantListItem")
+        );
+        assert_eq!(
+            operation
+                .pointer("/responses/400/content/application~1json/schema/$ref")
+                .and_then(Value::as_str),
+            Some("#/components/schemas/ConsoleErrorResponse")
+        );
+    }
 }
diff --git a/src/console/routes/mod.rs b/src/console/routes/mod.rs
index 5536cdb..adba902 100755
--- a/src/console/routes/mod.rs
+++ b/src/console/routes/mod.rs
@@ -36,6 +36,10 @@ pub fn tenant_routes() -> Router<AppState> {
             get(handlers::tenants::get_all_tenant_state_counts),
         )
         .route("/tenants", post(handlers::tenants::create_tenant))
+        .route(
+            "/tenants/yaml",
+            post(handlers::tenants::create_tenant_from_yaml),
+        )
         .route(
             "/namespaces/:namespace/tenants",
             get(handlers::tenants::list_tenants_by_namespace),
diff --git a/src/context.rs b/src/context.rs
index d8d052e..d0983a8 100755
--- a/src/context.rs
+++ b/src/context.rs
@@ -908,6 +908,8 @@ mod validate_local_kms_tests {
                 path: path.map(ToOwned::to_owned),
                 ..Default::default()
             },
+            security_context: None,
+            container_security_context: None,
             scheduling: Default::default(),
         }
     }
diff --git a/src/lib.rs b/src/lib.rs
index 1c113ec..e3ba79e 100755
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -848,6 +848,23 @@ mod controller_watch_tests {
         assert!(documents[1].contains("scope: Namespaced"));
     }
 
+    #[test]
+    fn tracked_tenant_crds_match_generated_schema() {
+        let yaml = render_crds_yaml().expect("CRDs render to YAML");
+        let (tenant, _) = yaml
+            .split_once("---\n")
+            .expect("Tenant and PolicyBinding CRDs should be separated");
+
+        assert_eq!(
+            tenant,
+            include_str!("../deploy/rustfs-operator/crds/tenant.yaml")
+        );
+        assert_eq!(
+            tenant,
+            include_str!("../deploy/rustfs-operator/crds/tenant-crd.yaml")
+        );
+    }
+
     fn tenant_owner_ref(name: &str) -> metav1::OwnerReference {
         metav1::OwnerReference {
             api_version: "rustfs.com/v1alpha1".to_string(),
diff --git a/src/reconcile.rs b/src/reconcile.rs
index 9887a93..b6b5d62 100755
--- a/src/reconcile.rs
+++ b/src/reconcile.rs
@@ -922,6 +922,8 @@ pub fn error_policy(object: Arc<Tenant>, error: &Error, _ctx: Arc<Context>) -> A
             types::error::Error::ImmutableFieldModified { .. }
             | types::error::Error::InvalidTenantName { .. }
             | types::error::Error::KmsMigrationBlocked { .. }
+            | types::error::Error::InvalidWorkloadSecurityProfile { .. }
+            | types::error::Error::WorkloadSecurityIncompatible { .. }
             | types::error::Error::PoolDeleteBlocked { .. } => Duration::from_secs(60),
 
             // Other type errors - use moderate requeue
@@ -972,6 +974,12 @@ fn reconcile_error_reason(error: &Error) -> &'static str {
             types::error::Error::ImmutableFieldModified { .. } => "ImmutableFieldModified",
             types::error::Error::PoolDeleteBlocked { .. } => "PoolDeleteBlocked",
             types::error::Error::KmsMigrationBlocked { .. } => "KmsMigrationBlocked",
+            types::error::Error::InvalidWorkloadSecurityProfile { .. } => {
+                "InvalidWorkloadSecurityProfile"
+            }
+            types::error::Error::WorkloadSecurityIncompatible { .. } => {
+                "WorkloadSecurityIncompatible"
+            }
             types::error::Error::NoNamespace => "NoNamespace",
             types::error::Error::InternalError { .. } => "InternalError",
             types::error::Error::SerdeJson { .. } => "SerdeJsonError",
diff --git a/src/reconcile/phases.rs b/src/reconcile/phases.rs
index e35573d..a378f20 100644
--- a/src/reconcile/phases.rs
+++ b/src/reconcile/phases.rs
@@ -82,6 +82,13 @@ pub(super) async fn validate_tenant_prerequisites(
         return Err(e.into());
     }
 
+    // Block known incompatible RustFS images before creating or rolling any StatefulSet.
+    if let Err(e) = tenant.validate_workload_security_compatibility() {
+        let status_error = StatusError::from_types_error(&e);
+        patch_status_error(ctx, tenant, &status_error).await;
+        return Err(e.into());
+    }
+
     // Validate credential Secret if configured.
     // This only validates the Secret exists and has required keys.
     // Actual credential injection happens via secretKeyRef in the StatefulSet.
diff --git a/src/reconcile/pool_lifecycle.rs b/src/reconcile/pool_lifecycle.rs
index 39a5bd4..c723daf 100644
--- a/src/reconcile/pool_lifecycle.rs
+++ b/src/reconcile/pool_lifecycle.rs
@@ -1191,6 +1191,8 @@ mod tests {
                 volumes_per_server: 2,
                 ..Default::default()
             },
+            security_context: None,
+            container_security_context: None,
             scheduling: SchedulingConfig::default(),
         }
     }
diff --git a/src/status.rs b/src/status.rs
index 81cf687..66c5ae9 100644
--- a/src/status.rs
+++ b/src/status.rs
@@ -185,6 +185,16 @@ impl StatusError {
                 ConditionType::KmsReady,
                 sanitize_message(message),
             ),
+            types::error::Error::InvalidWorkloadSecurityProfile { message, .. } => Self::blocked(
+                Reason::InvalidWorkloadSecurityProfile,
+                ConditionType::SpecValid,
+                sanitize_message(message),
+            ),
+            types::error::Error::WorkloadSecurityIncompatible { message, .. } => Self::blocked(
+                Reason::WorkloadSecurityIncompatible,
+                ConditionType::WorkloadsReady,
+                sanitize_message(message),
+            ),
             types::error::Error::NoNamespace => Self::transient(
                 Reason::KubernetesApiError,
                 ConditionType::Ready,
@@ -693,6 +703,52 @@ mod tests {
         assert!(status.condition(ConditionType::WorkloadsReady).is_none());
     }
 
+    #[test]
+    fn status_builder_blocks_incompatible_workload_security() {
+        let tenant = crate::tests::create_test_tenant(None, None);
+        let err = types::error::Error::WorkloadSecurityIncompatible {
+            name: tenant.name(),
+            message: "upgrade the RustFS image".to_string(),
+        };
+
+        let status_error = StatusError::from_types_error(&err);
+        let mut builder = StatusBuilder::from_tenant(&tenant);
+        builder.mark_error(&status_error);
+        let status = builder.build();
+
+        let condition = status.condition(ConditionType::WorkloadsReady).unwrap();
+        assert_eq!(condition.status, "False");
+        assert_eq!(condition.reason, "WorkloadSecurityIncompatible");
+        assert_eq!(status.current_state, "Blocked");
+        assert_eq!(
+            crate::types::v1alpha1::status::next_actions_for_reason(&condition.reason),
+            vec!["upgradeRustfsImage", "configureCompatibleSeccompProfile"]
+        );
+    }
+
+    #[test]
+    fn status_builder_marks_invalid_workload_security_profile_as_invalid_spec() {
+        let tenant = crate::tests::create_test_tenant(None, None);
+        let err = types::error::Error::InvalidWorkloadSecurityProfile {
+            name: tenant.name(),
+            message: "spec.containerSecurityContext.appArmorProfile is invalid".to_string(),
+        };
+
+        let status_error = StatusError::from_types_error(&err);
+        let mut builder = StatusBuilder::from_tenant(&tenant);
+        builder.mark_error(&status_error);
+        let status = builder.build();
+
+        let condition = status.condition(ConditionType::SpecValid).unwrap();
+        assert_eq!(condition.status, "False");
+        assert_eq!(condition.reason, "InvalidWorkloadSecurityProfile");
+        assert_eq!(status.current_state, "Blocked");
+        assert_eq!(
+            crate::types::v1alpha1::status::next_actions_for_reason(&condition.reason),
+            vec!["fixWorkloadSecurityProfile"]
+        );
+    }
+
     #[test]
     fn successful_status_reports_rpc_auth_ready_only_for_managed_secret() {
         let mut unmanaged = crate::tests::create_test_tenant(None, None);
diff --git a/src/tests.rs b/src/tests.rs
index 87cc535..580007a 100755
--- a/src/tests.rs
+++ b/src/tests.rs
@@ -38,6 +38,8 @@ pub fn create_test_tenant(
                     volumes_per_server: 4,
                     ..Default::default()
                 },
+                security_context: None,
+                container_security_context: None,
                 scheduling: Default::default(),
             }],
             service_account_name,
diff --git a/src/types/error.rs b/src/types/error.rs
index 53883d7..31844ac 100755
--- a/src/types/error.rs
+++ b/src/types/error.rs
@@ -42,6 +42,12 @@ pub enum Error {
     #[snafu(display("KMS migration is blocked for tenant '{}': {}", name, message))]
     KmsMigrationBlocked { name: String, message: String },
 
+    #[snafu(display("invalid workload security profile for tenant '{}': {}", name, message))]
+    InvalidWorkloadSecurityProfile { name: String, message: String },
+
+    #[snafu(display("workload security is incompatible for tenant '{}': {}", name, message))]
+    WorkloadSecurityIncompatible { name: String, message: String },
+
     #[snafu(display("serde_json error: {}", source))]
     SerdeJson { source: serde_json::Error },
 }
diff --git a/src/types/v1alpha1.rs b/src/types/v1alpha1.rs
index 8940c44..f5e65a0 100755
--- a/src/types/v1alpha1.rs
+++ b/src/types/v1alpha1.rs
@@ -20,6 +20,7 @@ pub mod policy_binding;
 pub mod pool;
 pub mod pool_lifecycle;
 pub mod provisioning;
+pub mod security_context;
 pub mod status;
 pub mod tenant;
 pub mod tls;
@@ -319,3 +320,93 @@ mod tenant_provisioning_crd_tests {
         );
     }
 }
+
+#[cfg(test)]
+mod tenant_security_context_tests {
+    use super::tenant::Tenant;
+    use kube::CustomResourceExt;
+    use serde_json::json;
+
+    #[test]
+    fn tenant_crd_exposes_pod_and_container_security_contexts() {
+        let crd = serde_json::to_value(Tenant::crd()).expect("Tenant CRD serializes");
+        let spec = &crd["spec"]["versions"][0]["schema"]["openAPIV3Schema"]["properties"]["spec"]["properties"];
+        let tenant_pod = &spec["securityContext"]["properties"];
+        let tenant_container = &spec["containerSecurityContext"]["properties"];
+        let pool = &spec["pools"]["items"]["properties"];
+
+        assert_eq!(
+            tenant_pod["seccompProfile"]["properties"]["type"]["type"],
+            json!("string")
+        );
+        assert_eq!(pool["securityContext"]["type"], json!("object"));
+        assert_eq!(pool["containerSecurityContext"]["type"], json!("object"));
+
+        for pod in [tenant_pod, &pool["securityContext"]["properties"]] {
+            for field in ["runAsUser", "runAsGroup", "fsGroup"] {
+                assert_eq!(pod[field]["minimum"].as_f64(), Some(0.0));
+                assert_eq!(pod[field]["maximum"].as_f64(), Some(i32::MAX as f64));
+            }
+        }
+
+        for container in [
+            tenant_container,
+            &pool["containerSecurityContext"]["properties"],
+        ] {
+            assert_eq!(
+                container["allowPrivilegeEscalation"]["type"],
+                json!("boolean")
+            );
+            assert_eq!(
+                container["capabilities"]["properties"]["drop"]["items"]["type"],
+                json!("string")
+            );
+            assert_eq!(
+                container["readOnlyRootFilesystem"]["type"],
+                json!("boolean")
+            );
+            assert_eq!(
+                container["seccompProfile"]["properties"]["type"]["type"],
+                json!("string")
+            );
+        }
+    }
+
+    #[test]
+    fn legacy_tenant_security_context_still_deserializes() {
+        let tenant: Tenant = serde_yaml_ng::from_str(
+            r#"
+apiVersion: rustfs.com/v1alpha1
+kind: Tenant
+metadata:
+  name: legacy
+  namespace: storage
+spec:
+  pools:
+    - name: pool-0
+      servers: 1
+      persistence:
+        volumesPerServer: 1
+  securityContext:
+    runAsUser: 10001
+    runAsGroup: 10001
+    fsGroup: 10001
+    runAsNonRoot: true
+"#,
+        )
+        .expect("Legacy Tenant YAML should deserialize");
+
+        let context = tenant
+            .spec
+            .security_context
+            .expect("Legacy securityContext should be preserved");
+        assert_eq!(context.run_as_user, Some(10001));
+        assert_eq!(context.run_as_group, Some(10001));
+        assert_eq!(context.fs_group, Some(10001));
+        assert_eq!(context.run_as_non_root, Some(true));
+        assert!(context.seccomp_profile.is_none());
+        assert!(tenant.spec.container_security_context.is_none());
+        assert!(tenant.spec.pools[0].security_context.is_none());
+        assert!(tenant.spec.pools[0].container_security_context.is_none());
+    }
+}
diff --git a/src/types/v1alpha1/encryption.rs b/src/types/v1alpha1/encryption.rs
index 4edc0c9..b9f3b64 100644
--- a/src/types/v1alpha1/encryption.rs
+++ b/src/types/v1alpha1/encryption.rs
@@ -18,6 +18,9 @@ use kube::KubeSchema;
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeSet;
 
+// Keep the former public path available for downstream Rust users.
+pub use super::security_context::PodSecurityContextOverride;
+
 /// KMS backend type for server-side encryption.
 ///
 /// RustFS `init_kms_system` reads `RUSTFS_KMS_BACKEND` (`local` or `vault`).
@@ -149,26 +152,3 @@ impl EncryptionConfig {
         names
     }
 }
-
-/// Pod SecurityContext overrides for all RustFS pods in this Tenant.
-///
-/// Overrides the default Pod SecurityContext (`runAsUser` / `runAsGroup` / `fsGroup` = 10001).
-#[derive(Deserialize, Serialize, Clone, Debug, KubeSchema, Default)]
-#[serde(rename_all = "camelCase")]
-pub struct PodSecurityContextOverride {
-    /// UID to run the container process as.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub run_as_user: Option<i64>,
-
-    /// GID to run the container process as.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub run_as_group: Option<i64>,
-
-    /// GID applied to all volumes mounted in the Pod (`fsGroup`).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub fs_group: Option<i64>,
-
-    /// Enforce non-root execution (default in the operator: `true` when set).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub run_as_non_root: Option<bool>,
-}
diff --git a/src/types/v1alpha1/pool.rs b/src/types/v1alpha1/pool.rs
index 12d66c1..6a52551 100755
--- a/src/types/v1alpha1/pool.rs
+++ b/src/types/v1alpha1/pool.rs
@@ -18,6 +18,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashSet;
 
 use crate::types::v1alpha1::persistence::PersistenceConfig;
+use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
 
 /// Kubernetes scheduling and placement configuration for pools.
 /// Groups related scheduling fields for better code organization.
@@ -65,6 +66,16 @@ pub struct Pool {
 
     pub persistence: PersistenceConfig,
 
+    /// Pod SecurityContext overrides for this Pool.
+    /// Values override Tenant-level Pod SecurityContext settings.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub security_context: Option<PodSecurityContextOverride>,
+
+    /// RustFS container SecurityContext overrides for this Pool.
+    /// Values are merged over Tenant-level container settings and operator defaults.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub container_security_context: Option<corev1::SecurityContext>,
+
     /// Kubernetes scheduling and placement configuration.
     /// Flattened to maintain backward compatibility with YAML structure.
     #[serde(flatten)]
@@ -236,6 +247,8 @@ mod tests {
                 volumes_per_server,
                 ..Default::default()
             },
+            security_context: None,
+            container_security_context: None,
             scheduling: Default::default(),
         }
     }
diff --git a/src/types/v1alpha1/security_context.rs b/src/types/v1alpha1/security_context.rs
new file mode 100644
index 0000000..32c3ccf
--- /dev/null
+++ b/src/types/v1alpha1/security_context.rs
@@ -0,0 +1,77 @@
+// Copyright 2025 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use k8s_openapi::api::core::v1 as corev1;
+use kube::KubeSchema;
+use serde::{Deserialize, Serialize};
+
+/// Largest UID/GID accepted by Kubernetes workload security contexts.
+pub(crate) const MAX_KUBERNETES_ID: i64 = i32::MAX as i64;
+
+/// Resolves the effective `runAsNonRoot` value used by generated RustFS Pods.
+///
+/// Explicit configuration always wins. Otherwise UID 0 preserves legacy root
+/// behavior, while every other UID uses the Operator's secure default.
+pub(crate) fn effective_run_as_non_root(run_as_user: Option<i64>, explicit: Option<bool>) -> bool {
+    explicit.unwrap_or(run_as_user != Some(0))
+}
+
+/// Pod SecurityContext overrides for RustFS pods.
+///
+/// Overrides the operator defaults (`runAsUser` / `runAsGroup` / `fsGroup` = 10001,
+/// `runAsNonRoot` = true, and `seccompProfile.type` = `RuntimeDefault`).
+#[derive(Deserialize, Serialize, Clone, Debug, KubeSchema, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct PodSecurityContextOverride {
+    /// UID to run the container process as.
+    #[schemars(range(min = 0, max = 2147483647))]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub run_as_user: Option<i64>,
+
+    /// GID to run the container process as.
+    #[schemars(range(min = 0, max = 2147483647))]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub run_as_group: Option<i64>,
+
+    /// GID applied to all volumes mounted in the Pod (`fsGroup`).
+    #[schemars(range(min = 0, max = 2147483647))]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub fs_group: Option<i64>,
+
+    /// Enforce non-root execution.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub run_as_non_root: Option<bool>,
+
+    /// Seccomp profile applied to all containers in the Pod.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub seccomp_profile: Option<corev1::SeccompProfile>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::effective_run_as_non_root;
+
+    #[test]
+    fn effective_run_as_non_root_preserves_legacy_uid_zero() {
+        assert!(!effective_run_as_non_root(Some(0), None));
+        assert!(effective_run_as_non_root(Some(10_001), None));
+        assert!(effective_run_as_non_root(None, None));
+    }
+
+    #[test]
+    fn effective_run_as_non_root_prefers_explicit_configuration() {
+        assert!(effective_run_as_non_root(Some(0), Some(true)));
+        assert!(!effective_run_as_non_root(Some(10_001), Some(false)));
+    }
+}
diff --git a/src/types/v1alpha1/status.rs b/src/types/v1alpha1/status.rs
index 6a93fe8..7f785de 100755
--- a/src/types/v1alpha1/status.rs
+++ b/src/types/v1alpha1/status.rs
@@ -154,6 +154,8 @@ pub enum Reason {
     PoolDecommissionFailed,
     StatefulSetApplyFailed,
     StatefulSetUpdateValidationFailed,
+    InvalidWorkloadSecurityProfile,
+    WorkloadSecurityIncompatible,
     RolloutInProgress,
     PodsNotReady,
     PoolDegraded,
@@ -221,6 +223,8 @@ impl Reason {
             Self::PoolDecommissionFailed => "PoolDecommissionFailed",
             Self::StatefulSetApplyFailed => "StatefulSetApplyFailed",
             Self::StatefulSetUpdateValidationFailed => "StatefulSetUpdateValidationFailed",
+            Self::InvalidWorkloadSecurityProfile => "InvalidWorkloadSecurityProfile",
+            Self::WorkloadSecurityIncompatible => "WorkloadSecurityIncompatible",
             Self::RolloutInProgress => "RolloutInProgress",
             Self::PodsNotReady => "PodsNotReady",
             Self::PoolDegraded => "PoolDegraded",
@@ -497,6 +501,8 @@ pub fn is_blocked_reason(reason: &str) -> bool {
             | "PoolDecommissionCanceled"
             | "PoolDecommissionFailed"
             | "StatefulSetUpdateValidationFailed"
+            | "InvalidWorkloadSecurityProfile"
+            | "WorkloadSecurityIncompatible"
             | "ProvisioningUnsupported"
             | "PolicyDocumentConfigMapNotFound"
             | "PolicyDocumentKeyNotFound"
@@ -562,6 +568,10 @@ pub fn next_actions_for_reason(reason: &str) -> Vec<&'static str> {
         "CaBundleMissing" => vec!["configureCaSecretRef", "enableSystemCaIfAppropriate"],
         "CaBundleInvalid" => vec!["replaceCaBundle"],
         "TlsHotReloadUnsupported" => vec!["useRolloutRotation", "enableCleanTlsDirectory"],
+        "InvalidWorkloadSecurityProfile" => vec!["fixWorkloadSecurityProfile"],
+        "WorkloadSecurityIncompatible" => {
+            vec!["upgradeRustfsImage", "configureCompatibleSeccompProfile"]
+        }
         "InvalidTenantName" => vec!["renameTenant"],
         "ImmutableFieldModified" => vec!["restoreImmutableField"],
         "PoolDeleteBlocked" => vec!["restorePoolSpec", "startDecommissionAfterRestore"],
@@ -657,6 +667,14 @@ mod tests {
             next_actions_for_reason("CertManagerCertificateApplyFailed"),
             vec!["fixCertificateSpec", "inspectOperatorLogs"]
         );
+        assert_eq!(
+            next_actions_for_reason("InvalidWorkloadSecurityProfile"),
+            vec!["fixWorkloadSecurityProfile"]
+        );
+        assert_eq!(
+            next_actions_for_reason("WorkloadSecurityIncompatible"),
+            vec!["upgradeRustfsImage", "configureCompatibleSeccompProfile"]
+        );
     }
 
     #[test]
diff --git a/src/types/v1alpha1/tenant.rs b/src/types/v1alpha1/tenant.rs
index 75bd40c..583f492 100755
--- a/src/types/v1alpha1/tenant.rs
+++ b/src/types/v1alpha1/tenant.rs
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use crate::types::v1alpha1::encryption::{EncryptionConfig, PodSecurityContextOverride};
+use crate::types::v1alpha1::encryption::EncryptionConfig;
 use crate::types::v1alpha1::k8s;
 use crate::types::v1alpha1::logging::LoggingConfig;
 use crate::types::v1alpha1::pool::{Pool, validate_pool_collection};
@@ -20,6 +20,7 @@ use crate::types::v1alpha1::pool_lifecycle::PoolLifecycleSpec;
 use crate::types::v1alpha1::provisioning::{
     ProvisioningBucket, ProvisioningPolicy, ProvisioningUser,
 };
+use crate::types::v1alpha1::security_context::PodSecurityContextOverride;
 use crate::types::v1alpha1::tls::TlsConfig;
 use crate::types::{self, error::NoNamespaceSnafu};
 use k8s_openapi::api::core::v1 as corev1;
@@ -35,6 +36,8 @@ mod rbac;
 mod services;
 mod workloads;
 
+pub use workloads::RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION;
+
 pub(crate) const MAX_TENANT_POOLS: u32 = 32;
 pub(crate) const MAX_TENANT_POLICIES: u32 = 256;
 pub(crate) const MAX_TENANT_USERS: u32 = 256;
@@ -226,10 +229,15 @@ pub struct TenantSpec {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub encryption: Option<EncryptionConfig>,
 
-    /// Override the default Pod SecurityContext (runAsUser/runAsGroup/fsGroup = 10001).
-    /// Applies to all RustFS pods in this Tenant.
+    /// Override the default Pod SecurityContext for every Pool in this Tenant.
+    /// Pool-level values take precedence.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub security_context: Option<PodSecurityContextOverride>,
+
+    /// Override the default RustFS container SecurityContext for every Pool in this Tenant.
+    /// Pool-level values take precedence.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub container_security_context: Option<corev1::SecurityContext>,
 }
 
 impl TenantSpec {
diff --git a/src/types/v1alpha1/tenant/helper.rs b/src/types/v1alpha1/tenant/helper.rs
index 02840a4..aa6a654 100755
--- a/src/types/v1alpha1/tenant/helper.rs
+++ b/src/types/v1alpha1/tenant/helper.rs
@@ -13,7 +13,7 @@
 //  limitations under the License.
 
 /// Default RustFS container image when neither spec.image nor TENANT_RUSTFS_IMAGE is set.
-pub const DEFAULT_RUSTFS_IMAGE: &str = "rustfs/rustfs:latest";
+pub const DEFAULT_RUSTFS_IMAGE: &str = "rustfs/rustfs:1.0.0-beta.10";
 
 pub(crate) fn get_rustfs_image() -> Option<String> {
     std::env::var("TENANT_RUSTFS_IMAGE").ok()
diff --git a/src/types/v1alpha1/tenant/workloads.rs b/src/types/v1alpha1/tenant/workloads.rs
index 640b69d..b98cf73 100755
--- a/src/types/v1alpha1/tenant/workloads.rs
+++ b/src/types/v1alpha1/tenant/workloads.rs
@@ -21,7 +21,11 @@ use crate::types::v1alpha1::persistence::{
     default_local_kms_key_directory,
 };
 use crate::types::v1alpha1::pool::Pool;
+use crate::types::v1alpha1::security_context::{
+    MAX_KUBERNETES_ID, PodSecurityContextOverride, effective_run_as_non_root,
+};
 use crate::types::v1alpha1::tls::{TlsPlan, http_probe};
+use k8s_openapi::DeepMerge;
 use k8s_openapi::api::apps::v1;
 use k8s_openapi::api::core::v1 as corev1;
 use k8s_openapi::apimachinery::pkg::apis::meta::v1 as metav1;
@@ -35,6 +39,404 @@ const VOLUME_CLAIM_TEMPLATE_PREFIX: &str = "vol";
 const DEFAULT_RUN_AS_USER: i64 = 10001;
 const DEFAULT_RUN_AS_GROUP: i64 = 10001;
 const DEFAULT_FS_GROUP: i64 = 10001;
+const LAST_TOKIO_IO_URING_BETA: u32 = 8;
+pub const RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION: &str =
+    "operator.rustfs.com/runtime-default-image-ack";
+// Kubernetes caps Localhost AppArmor names at PATH_MAX - 1 bytes.
+const MAX_APP_ARMOR_LOCALHOST_PROFILE_LENGTH: usize = 4095;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum ImageUnverifiableReason {
+    CustomRepository,
+    DigestQualified,
+    MissingTag,
+    MutableTag,
+    UnknownTag,
+}
+
+impl ImageUnverifiableReason {
+    fn description(self) -> &'static str {
+        match self {
+            Self::CustomRepository => "reference from a custom repository",
+            Self::DigestQualified => {
+                "digest-qualified reference (Kubernetes pulls by digest, not tag)"
+            }
+            Self::MissingTag => "reference without an explicit version tag",
+            Self::MutableTag => "mutable 'latest' tag",
+            Self::UnknownTag => "unrecognized version tag",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum RustfsImageSeccompCompatibility<'a> {
+    KnownCompatible,
+    KnownIncompatible { tag: &'a str },
+    Unverifiable { reason: ImageUnverifiableReason },
+}
+
+fn split_image_repository_and_tag(reference: &str) -> (&str, Option<&str>) {
+    let last_path_separator = reference.rfind('/').map_or(0, |index| index + 1);
+    let tag_separator = reference
+        .rfind(':')
+        .filter(|index| *index >= last_path_separator);
+
+    match tag_separator {
+        Some(index) => (&reference[..index], Some(&reference[index + 1..])),
+        None => (reference, None),
+    }
+}
+
+fn is_official_rustfs_repository(repository: &str) -> bool {
+    matches!(
+        repository,
+        "rustfs/rustfs"
+            | "docker.io/rustfs/rustfs"
+            | "index.docker.io/rustfs/rustfs"
+            | "registry-1.docker.io/rustfs/rustfs"
+            | "ghcr.io/rustfs/rustfs"
+            | "quay.io/rustfs/rustfs"
+    )
+}
+
+fn parse_canonical_u32(part: &str) -> Option<u32> {
+    let value = part.parse::<u32>().ok()?;
+    (part == value.to_string()).then_some(value)
+}
+
+fn is_known_compatible_release_tag(tag: &str) -> bool {
+    let (release, suffix) = tag
+        .split_once('-')
+        .map_or((tag, None), |(release, suffix)| (release, Some(suffix)));
+    let mut components = release.split('.');
+    let version = match (
+        components.next().and_then(parse_canonical_u32),
+        components.next().and_then(parse_canonical_u32),
+        components.next().and_then(parse_canonical_u32),
+        components.next(),
+    ) {
+        (Some(major), Some(minor), Some(patch), None) => (major, minor, patch),
+        _ => return false,
+    };
+
+    if suffix.is_some_and(|suffix| suffix != "glibc") {
+        return false;
+    }
+
+    version >= (1, 0, 0)
+}
+
+fn classify_rustfs_image_for_seccomp(image: &str) -> RustfsImageSeccompCompatibility<'_> {
+    let image = image.trim();
+    let (tagged_reference, digest) = image
+        .split_once('@')
+        .map_or((image, None), |(reference, digest)| {
+            (reference, Some(digest))
+        });
+    let (repository, tag) = split_image_repository_and_tag(tagged_reference);
+    if !is_official_rustfs_repository(repository) {
+        return RustfsImageSeccompCompatibility::Unverifiable {
+            reason: ImageUnverifiableReason::CustomRepository,
+        };
+    }
+
+    if digest.is_some() {
+        return RustfsImageSeccompCompatibility::Unverifiable {
+            reason: ImageUnverifiableReason::DigestQualified,
+        };
+    }
+
+    let Some(tag) = tag else {
+        return RustfsImageSeccompCompatibility::Unverifiable {
+            reason: ImageUnverifiableReason::MissingTag,
+        };
+    };
+    if tag == "latest" {
+        return RustfsImageSeccompCompatibility::Unverifiable {
+            reason: ImageUnverifiableReason::MutableTag,
+        };
+    }
+
+    let tag = tag.strip_prefix('v').unwrap_or(tag);
+    if tag.starts_with("1.0.0-alpha.") {
+        return RustfsImageSeccompCompatibility::KnownIncompatible { tag };
+    }
+
+    if let Some(beta) = tag.strip_prefix("1.0.0-beta.") {
+        let (number, suffix) = beta
+            .split_once('-')
+            .map_or((beta, None), |(number, suffix)| (number, Some(suffix)));
+        if let Some(beta) = parse_canonical_u32(number)
+            && (beta <= LAST_TOKIO_IO_URING_BETA || suffix.is_none_or(|suffix| suffix == "glibc"))
+        {
+            return if beta <= LAST_TOKIO_IO_URING_BETA {
+                RustfsImageSeccompCompatibility::KnownIncompatible { tag }
+            } else {
+                RustfsImageSeccompCompatibility::KnownCompatible
+            };
+        }
+    }
+
+    if is_known_compatible_release_tag(tag) {
+        RustfsImageSeccompCompatibility::KnownCompatible
+    } else {
+        RustfsImageSeccompCompatibility::Unverifiable {
+            reason: ImageUnverifiableReason::UnknownTag,
+        }
+    }
+}
+
+fn validate_declared_security_profile_shape<'a>(
+    field_path: &str,
+    type_: &str,
+    localhost_profile: Option<&'a str>,
+) -> Result<Option<&'a str>, String> {
+    if !matches!(type_, "RuntimeDefault" | "Localhost" | "Unconfined") {
+        return Err(format!(
+            "{field_path}.type must be RuntimeDefault, Localhost, or Unconfined; got '{type_}'"
+        ));
+    }
+
+    match (type_, localhost_profile) {
+        ("Localhost", Some(profile)) => Ok(Some(profile)),
+        ("Localhost", None) => Err(format!(
+            "{field_path}.localhostProfile must be nonblank when type is Localhost"
+        )),
+        (_, Some(_)) => Err(format!(
+            "{field_path}.localhostProfile must be omitted when type is {type_}"
+        )),
+        _ => Ok(None),
+    }
+}
+
+fn validate_declared_seccomp_profile(
+    field_path: &str,
+    type_: &str,
+    localhost_profile: Option<&str>,
+) -> Result<(), String> {
+    let Some(profile) =
+        validate_declared_security_profile_shape(field_path, type_, localhost_profile)?
+    else {
+        return Ok(());
+    };
+
+    if profile.trim().is_empty() {
+        return Err(format!(
+            "{field_path}.localhostProfile must be nonblank when type is Localhost"
+        ));
+    }
+    // Match kube-apiserver's validateLocalDescendingPath checks.
+    if profile.starts_with('/') {
+        return Err(format!(
+            "{field_path}.localhostProfile must be a relative path"
+        ));
+    }
+    if profile.split('/').any(|component| component == "..") {
+        return Err(format!(
+            "{field_path}.localhostProfile must not contain '..'"
+        ));
+    }
+
+    Ok(())
+}
+
+fn validate_declared_app_armor_profile(
+    field_path: &str,
+    type_: &str,
+    localhost_profile: Option<&str>,
+) -> Result<(), String> {
+    let Some(profile) =
+        validate_declared_security_profile_shape(field_path, type_, localhost_profile)?
+    else {
+        return Ok(());
+    };
+
+    if profile.trim() != profile {
+        return Err(format!(
+            "{field_path}.localhostProfile must not be padded with whitespace"
+        ));
+    }
+    if profile.is_empty() {
+        return Err(format!(
+            "{field_path}.localhostProfile must be nonblank when type is Localhost"
+        ));
+    }
+    if profile.len() > MAX_APP_ARMOR_LOCALHOST_PROFILE_LENGTH {
+        return Err(format!(
+            "{field_path}.localhostProfile must be at most {MAX_APP_ARMOR_LOCALHOST_PROFILE_LENGTH} bytes"
+        ));
+    }
+
+    Ok(())
+}
+
+fn validate_kubernetes_id(field_path: &str, value: Option<i64>) -> Result<(), String> {
+    if value.is_some_and(|value| !(0..=MAX_KUBERNETES_ID).contains(&value)) {
+        return Err(format!(
+            "{field_path} must be between 0 and {MAX_KUBERNETES_ID}, inclusive"
+        ));
+    }
+
+    Ok(())
+}
+
+fn validate_declared_security_context_ids(
+    pod_field_path: &str,
+    pod: Option<&PodSecurityContextOverride>,
+    container_field_path: &str,
+    container: Option<&corev1::SecurityContext>,
+) -> Result<(), String> {
+    validate_kubernetes_id(
+        &format!("{pod_field_path}.runAsUser"),
+        pod.and_then(|context| context.run_as_user),
+    )?;
+    validate_kubernetes_id(
+        &format!("{pod_field_path}.runAsGroup"),
+        pod.and_then(|context| context.run_as_group),
+    )?;
+    validate_kubernetes_id(
+        &format!("{pod_field_path}.fsGroup"),
+        pod.and_then(|context| context.fs_group),
+    )?;
+    validate_kubernetes_id(
+        &format!("{container_field_path}.runAsUser"),
+        container.and_then(|context| context.run_as_user),
+    )?;
+    validate_kubernetes_id(
+        &format!("{container_field_path}.runAsGroup"),
+        container.and_then(|context| context.run_as_group),
+    )?;
+
+    Ok(())
+}
+
+fn apply_pod_security_context_override(
+    context: &mut corev1::PodSecurityContext,
+    overrides: &PodSecurityContextOverride,
+) {
+    context.run_as_user = overrides.run_as_user.or(context.run_as_user);
+    context.run_as_group = overrides.run_as_group.or(context.run_as_group);
+    context.fs_group = overrides.fs_group.or(context.fs_group);
+    context.run_as_non_root = overrides.run_as_non_root.or(context.run_as_non_root);
+    context.seccomp_profile = overrides
+        .seccomp_profile
+        .clone()
+        .or_else(|| context.seccomp_profile.clone());
+}
+
+fn explicit_pod_run_as_non_root(
+    tenant: Option<&PodSecurityContextOverride>,
+    pool: Option<&PodSecurityContextOverride>,
+) -> Option<bool> {
+    pool.and_then(|overrides| overrides.run_as_non_root)
+        .or_else(|| tenant.and_then(|overrides| overrides.run_as_non_root))
+}
+
+fn effective_pod_security_context(
+    tenant: Option<&PodSecurityContextOverride>,
+    pool: Option<&PodSecurityContextOverride>,
+) -> corev1::PodSecurityContext {
+    let explicit_run_as_non_root = explicit_pod_run_as_non_root(tenant, pool);
+    let mut context = corev1::PodSecurityContext {
+        run_as_user: Some(DEFAULT_RUN_AS_USER),
+        run_as_group: Some(DEFAULT_RUN_AS_GROUP),
+        fs_group: Some(DEFAULT_FS_GROUP),
+        fs_group_change_policy: Some("OnRootMismatch".to_string()),
+        run_as_non_root: Some(true),
+        seccomp_profile: Some(corev1::SeccompProfile {
+            type_: "RuntimeDefault".to_string(),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+
+    for overrides in [tenant, pool].into_iter().flatten() {
+        apply_pod_security_context_override(&mut context, overrides);
+    }
+
+    context.run_as_non_root = Some(effective_run_as_non_root(
+        context.run_as_user,
+        explicit_run_as_non_root,
+    ));
+
+    context
+}
+
+fn merge_container_security_context(
+    context: &mut corev1::SecurityContext,
+    overrides: &corev1::SecurityContext,
+) {
+    context.merge_from(overrides.clone());
+
+    // These tagged profile objects are atomic Kubernetes values. Deep-merging them can retain
+    // localhostProfile after changing type from Localhost to RuntimeDefault, which is invalid.
+    if overrides.seccomp_profile.is_some() {
+        context
+            .seccomp_profile
+            .clone_from(&overrides.seccomp_profile);
+    }
+    if overrides.app_armor_profile.is_some() {
+        context
+            .app_armor_profile
+            .clone_from(&overrides.app_armor_profile);
+    }
+}
+
+fn effective_container_security_context(
+    tenant: Option<&corev1::SecurityContext>,
+    pool: Option<&corev1::SecurityContext>,
+    explicit_pod_run_as_non_root: Option<bool>,
+) -> corev1::SecurityContext {
+    let explicit_container_run_as_non_root = pool
+        .and_then(|overrides| overrides.run_as_non_root)
+        .or_else(|| tenant.and_then(|overrides| overrides.run_as_non_root));
+    let mut context = corev1::SecurityContext {
+        allow_privilege_escalation: Some(false),
+        capabilities: Some(corev1::Capabilities {
+            drop: Some(vec!["ALL".to_string()]),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+
+    for overrides in [tenant, pool].into_iter().flatten() {
+        merge_container_security_context(&mut context, overrides);
+    }
+
+    // A container UID overrides the Pod UID. When neither the container nor Pod explicitly
+    // chooses runAsNonRoot, materialize the matching container value so the Pod default does not
+    // turn an intentional UID 0 override into the contradictory UID 0 + runAsNonRoot=true pair.
+    if context.run_as_user.is_some()
+        && explicit_container_run_as_non_root.is_none()
+        && explicit_pod_run_as_non_root.is_none()
+    {
+        context.run_as_non_root = Some(effective_run_as_non_root(context.run_as_user, None));
+    }
+
+    context
+}
+
+struct EffectiveWorkloadSecurityContext {
+    pod: corev1::PodSecurityContext,
+    container: corev1::SecurityContext,
+}
+
+fn effective_workload_security_context(
+    tenant_pod: Option<&PodSecurityContextOverride>,
+    pool_pod: Option<&PodSecurityContextOverride>,
+    tenant_container: Option<&corev1::SecurityContext>,
+    pool_container: Option<&corev1::SecurityContext>,
+) -> EffectiveWorkloadSecurityContext {
+    let explicit_pod_run_as_non_root = explicit_pod_run_as_non_root(tenant_pod, pool_pod);
+    EffectiveWorkloadSecurityContext {
+        pod: effective_pod_security_context(tenant_pod, pool_pod),
+        container: effective_container_security_context(
+            tenant_container,
+            pool_container,
+            explicit_pod_run_as_non_root,
+        ),
+    }
+}
 
 const TLS_OPERATOR_MANAGED_ENV_VARS: &[&str] = &[
     "RUSTFS_VOLUMES",
@@ -84,6 +486,201 @@ fn stateful_name(tenant: &Tenant, pool: &Pool) -> String {
 }
 
 impl Tenant {
+    fn validate_declared_workload_security_contexts(&self) -> Result<(), types::error::Error> {
+        let invalid_profile = |message| types::error::Error::InvalidWorkloadSecurityProfile {
+            name: self.name(),
+            message,
+        };
+        let validate_seccomp = |field_path: &str, type_: &str, localhost_profile: Option<&str>| {
+            validate_declared_seccomp_profile(field_path, type_, localhost_profile)
+                .map_err(&invalid_profile)
+        };
+        let validate_app_armor =
+            |field_path: &str, type_: &str, localhost_profile: Option<&str>| {
+                validate_declared_app_armor_profile(field_path, type_, localhost_profile).map_err(
+                    |message| types::error::Error::InvalidWorkloadSecurityProfile {
+                        name: self.name(),
+                        message,
+                    },
+                )
+            };
+
+        validate_declared_security_context_ids(
+            "spec.securityContext",
+            self.spec.security_context.as_ref(),
+            "spec.containerSecurityContext",
+            self.spec.container_security_context.as_ref(),
+        )
+        .map_err(&invalid_profile)?;
+
+        if let Some(profile) = self
+            .spec
+            .security_context
+            .as_ref()
+            .and_then(|context| context.seccomp_profile.as_ref())
+        {
+            validate_seccomp(
+                "spec.securityContext.seccompProfile",
+                &profile.type_,
+                profile.localhost_profile.as_deref(),
+            )?;
+        }
+
+        if let Some(context) = self.spec.container_security_context.as_ref() {
+            if let Some(profile) = context.seccomp_profile.as_ref() {
+                validate_seccomp(
+                    "spec.containerSecurityContext.seccompProfile",
+                    &profile.type_,
+                    profile.localhost_profile.as_deref(),
+                )?;
+            }
+            if let Some(profile) = context.app_armor_profile.as_ref() {
+                validate_app_armor(
+                    "spec.containerSecurityContext.appArmorProfile",
+                    &profile.type_,
+                    profile.localhost_profile.as_deref(),
+                )?;
+            }
+        }
+
+        for pool in &self.spec.pools {
+            validate_declared_security_context_ids(
+                &format!("spec.pools[name={}].securityContext", pool.name),
+                pool.security_context.as_ref(),
+                &format!("spec.pools[name={}].containerSecurityContext", pool.name),
+                pool.container_security_context.as_ref(),
+            )
+            .map_err(&invalid_profile)?;
+
+            if let Some(profile) = pool
+                .security_context
+                .as_ref()
+                .and_then(|context| context.seccomp_profile.as_ref())
+            {
+                validate_seccomp(
+                    &format!(
+                        "spec.pools[name={}].securityContext.seccompProfile",
+                        pool.name
+                    ),
+                    &profile.type_,
+                    profile.localhost_profile.as_deref(),
+                )?;
+            }
+
+            if let Some(context) = pool.container_security_context.as_ref() {
+                if let Some(profile) = context.seccomp_profile.as_ref() {
+                    validate_seccomp(
+                        &format!(
+                            "spec.pools[name={}].containerSecurityContext.seccompProfile",
+                            pool.name
+                        ),
+                        &profile.type_,
+                        profile.localhost_profile.as_deref(),
+                    )?;
+                }
+                if let Some(profile) = context.app_armor_profile.as_ref() {
+                    validate_app_armor(
+                        &format!(
+                            "spec.pools[name={}].containerSecurityContext.appArmorProfile",
+                            pool.name
+                        ),
+                        &profile.type_,
+                        profile.localhost_profile.as_deref(),
+                    )?;
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    fn validate_effective_workload_identity(
+        &self,
+        pool: &Pool,
+        security: &EffectiveWorkloadSecurityContext,
+    ) -> Result<(), types::error::Error> {
+        let effective_run_as_user = security.container.run_as_user.or(security.pod.run_as_user);
+        let effective_run_as_non_root = security
+            .container
+            .run_as_non_root
+            .or(security.pod.run_as_non_root);
+
+        if effective_run_as_user == Some(0) && effective_run_as_non_root == Some(true) {
+            return Err(types::error::Error::InvalidWorkloadSecurityProfile {
+                name: self.name(),
+                message: format!(
+                    "pool '{}' resolves runAsUser to UID 0 while runAsNonRoot is explicitly true; use a non-zero UID or explicitly set the effective runAsNonRoot value to false",
+                    pool.name
+                ),
+            });
+        }
+
+        Ok(())
+    }
+
+    pub fn validate_workload_security_compatibility(&self) -> Result<(), types::error::Error> {
+        self.validate_declared_workload_security_contexts()?;
+
+        let image = super::helper::get_rustfs_image_or_default(self.spec.image.as_ref());
+        let image_compatibility = classify_rustfs_image_for_seccomp(&image);
+
+        for pool in &self.spec.pools {
+            let security = effective_workload_security_context(
+                self.spec.security_context.as_ref(),
+                pool.security_context.as_ref(),
+                self.spec.container_security_context.as_ref(),
+                pool.container_security_context.as_ref(),
+            );
+            self.validate_effective_workload_identity(pool, &security)?;
+
+            let seccomp_type = security
+                .container
+                .seccomp_profile
+                .as_ref()
+                .or(security.pod.seccomp_profile.as_ref())
+                .map(|profile| profile.type_.as_str());
+
+            if seccomp_type != Some("RuntimeDefault") {
+                continue;
+            }
+
+            match image_compatibility {
+                RustfsImageSeccompCompatibility::KnownCompatible => {}
+                RustfsImageSeccompCompatibility::KnownIncompatible { tag } => {
+                    return Err(types::error::Error::WorkloadSecurityIncompatible {
+                        name: self.name(),
+                        message: format!(
+                            "image '{image}' ({tag}) enables Tokio io_uring and cannot run with RuntimeDefault seccomp; upgrade to a RustFS build containing rustfs/rustfs#4364 before reconciling pool '{}', or configure a compatible Localhost seccomp profile",
+                            pool.name
+                        ),
+                    });
+                }
+                RustfsImageSeccompCompatibility::Unverifiable { reason } => {
+                    let image_acknowledged = self
+                        .metadata
+                        .annotations
+                        .as_ref()
+                        .and_then(|annotations| {
+                            annotations.get(RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION)
+                        })
+                        .is_some_and(|acknowledged_image| acknowledged_image == &image);
+                    if !image_acknowledged {
+                        return Err(types::error::Error::WorkloadSecurityIncompatible {
+                            name: self.name(),
+                            message: format!(
+                                "image '{image}' uses a {} and its seccomp compatibility cannot be verified for RuntimeDefault in pool '{}'; pin a verified RustFS 1.0.0-beta.9 or later release tag (for example 1.0.0-beta.10), or verify the image and set metadata.annotations['{RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION}'] to the exact current resolved image reference; mutable references can change without changing the annotation, so a digest-qualified reference is strongly recommended",
+                                reason.description(),
+                                pool.name
+                            ),
+                        });
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
+
     pub(crate) fn rustfs_pool_volume_spec(
         &self,
         pool: &Pool,
@@ -442,6 +1039,8 @@ impl Tenant {
         tls_plan: &TlsPlan,
         cluster_domain: &str,
     ) -> Result<v1::StatefulSet, types::error::Error> {
+        self.validate_declared_workload_security_contexts()?;
+
         let labels = self.pool_labels(pool);
         let selector_labels = self.pool_selector_labels(pool);
 
@@ -574,24 +1173,17 @@ impl Tenant {
         pod_volumes.extend(tls_plan.volumes.clone());
         volume_mounts.extend(tls_plan.volume_mounts.clone());
 
-        // Enforce non-root execution and make mounted volumes writable by RustFS user.
-        // If spec.securityContext overrides are set, use those values instead.
-        let sc = self.spec.security_context.as_ref();
-
-        let pod_security_context = Some(corev1::PodSecurityContext {
-            run_as_user: Some(
-                sc.and_then(|s| s.run_as_user)
-                    .unwrap_or(DEFAULT_RUN_AS_USER),
-            ),
-            run_as_group: Some(
-                sc.and_then(|s| s.run_as_group)
-                    .unwrap_or(DEFAULT_RUN_AS_GROUP),
-            ),
-            fs_group: Some(sc.and_then(|s| s.fs_group).unwrap_or(DEFAULT_FS_GROUP)),
-            fs_group_change_policy: Some("OnRootMismatch".to_string()),
-            run_as_non_root: sc.and_then(|s| s.run_as_non_root),
-            ..Default::default()
-        });
+        let security = effective_workload_security_context(
+            self.spec.security_context.as_ref(),
+            pool.security_context.as_ref(),
+            self.spec.container_security_context.as_ref(),
+            pool.container_security_context.as_ref(),
+        );
+        self.validate_effective_workload_identity(pool, &security)?;
+        let EffectiveWorkloadSecurityContext {
+            pod: pod_security_context,
+            container: container_security_context,
+        } = security;
 
         let container = corev1::Container {
             name: "rustfs".to_owned(),
@@ -630,6 +1222,7 @@ impl Tenant {
             readiness_probe: Some(http_probe("/health/ready", tls_plan.probe_scheme)),
             startup_probe: Some(http_probe("/health", tls_plan.probe_scheme)),
             termination_message_policy: Some("FallbackToLogsOnError".to_string()),
+            security_context: Some(container_security_context),
             ..Default::default()
         };
 
@@ -666,7 +1259,7 @@ impl Tenant {
                     spec: Some(corev1::PodSpec {
                         service_account_name: Some(self.service_account_name()),
                         containers: vec![container],
-                        security_context: pod_security_context,
+                        security_context: Some(pod_security_context),
                         volumes: Some(pod_volumes),
                         scheduler_name: self.spec.scheduler.clone(),
                         // Pool-level priority class overrides tenant-level
@@ -887,6 +1480,13 @@ impl Tenant {
             return Ok(true);
         }
 
+        // Check RustFS container security context.
+        if serde_json::to_value(&existing_container.security_context)?
+            != serde_json::to_value(&desired_container.security_context)?
+        {
+            return Ok(true);
+        }
+
         // Check environment variables (compare as JSON for deep equality)
         if serde_json::to_value(&existing_container.env)?
             != serde_json::to_value(&desired_container.env)?
@@ -1138,12 +1738,17 @@ impl Tenant {
 #[cfg(test)]
 #[allow(clippy::unwrap_used, clippy::expect_used)]
 mod tests {
-    use super::{DEFAULT_FS_GROUP, DEFAULT_RUN_AS_GROUP, DEFAULT_RUN_AS_USER};
+    use super::{
+        DEFAULT_FS_GROUP, DEFAULT_RUN_AS_GROUP, DEFAULT_RUN_AS_USER,
+        MAX_APP_ARMOR_LOCALHOST_PROFILE_LENGTH, RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION,
+        validate_declared_app_armor_profile, validate_declared_seccomp_profile,
+    };
     use crate::types::v1alpha1::encryption::{
         EncryptionConfig, KmsBackendType, LocalKmsConfig, LocalKmsMasterKeySecretRef,
     };
     use crate::types::v1alpha1::logging::{LoggingConfig, LoggingMode};
-    use crate::types::v1alpha1::tenant::RpcSecretRef;
+    use crate::types::v1alpha1::security_context::{MAX_KUBERNETES_ID, PodSecurityContextOverride};
+    use crate::types::v1alpha1::tenant::{RpcSecretRef, Tenant};
     use crate::types::v1alpha1::tls::{SecretKeyReference, TlsPlan};
     use k8s_openapi::api::core::v1 as corev1;
 
@@ -1157,52 +1762,294 @@ mod tests {
         TlsPlan::for_test("server-tls", hash)
     }
 
-    fn env_value<'a>(container: &'a corev1::Container, name: &str) -> Option<&'a str> {
-        container
-            .env
-            .as_ref()?
-            .iter()
-            .find(|var| var.name == name)?
-            .value
-            .as_deref()
+    fn runtime_default_seccomp_profile() -> corev1::SeccompProfile {
+        corev1::SeccompProfile {
+            type_: "RuntimeDefault".to_string(),
+            ..Default::default()
+        }
     }
 
-    fn set_env_value(container: &mut corev1::Container, name: &str, value: &str) {
-        let env = container
-            .env
-            .as_mut()
-            .expect("container should have environment variables");
-        if let Some(var) = env.iter_mut().find(|var| var.name == name) {
-            var.value = Some(value.to_string());
-        } else {
-            env.push(corev1::EnvVar {
-                name: name.to_string(),
-                value: Some(value.to_string()),
-                ..Default::default()
-            });
-        }
+    fn acknowledge_runtime_default_image(tenant: &mut Tenant, image: &str) {
+        tenant.metadata.annotations.get_or_insert_default().insert(
+            RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION.to_string(),
+            image.to_string(),
+        );
     }
 
-    fn local_master_key_selector() -> LocalKmsMasterKeySecretRef {
-        LocalKmsMasterKeySecretRef {
-            name: "local-kms-master-key".to_string(),
-            key: "local-master-key".to_string(),
+    fn invalid_security_profile_error_message(tenant: &Tenant) -> String {
+        match tenant.validate_workload_security_compatibility() {
+            Err(crate::types::error::Error::InvalidWorkloadSecurityProfile { message, .. }) => {
+                message
+            }
+            Ok(()) => panic!("workload security validation should fail"),
+            Err(error) => panic!("unexpected workload security error: {error}"),
         }
     }
 
-    #[test]
-    fn disabled_tls_statefulset_keeps_http_and_has_no_tls_wiring() {
-        let tenant = crate::tests::create_test_tenant(None, None);
-        let pool = &tenant.spec.pools[0];
+    type SetDeclaredId = fn(&mut Tenant, i64);
 
-        let statefulset = tenant
-            .new_statefulset(pool)
-            .expect("Should create StatefulSet without TLS");
+    fn declared_security_context_id_fields() -> Vec<(&'static str, SetDeclaredId)> {
+        vec![
+            ("spec.securityContext.runAsUser", |tenant, value| {
+                tenant
+                    .spec
+                    .security_context
+                    .get_or_insert_default()
+                    .run_as_user = Some(value);
+            }),
+            ("spec.securityContext.runAsGroup", |tenant, value| {
+                tenant
+                    .spec
+                    .security_context
+                    .get_or_insert_default()
+                    .run_as_group = Some(value);
+            }),
+            ("spec.securityContext.fsGroup", |tenant, value| {
+                tenant
+                    .spec
+                    .security_context
+                    .get_or_insert_default()
+                    .fs_group = Some(value);
+            }),
+            (
+                "spec.containerSecurityContext.runAsUser",
+                |tenant, value| {
+                    tenant
+                        .spec
+                        .container_security_context
+                        .get_or_insert_default()
+                        .run_as_user = Some(value);
+                },
+            ),
+            (
+                "spec.containerSecurityContext.runAsGroup",
+                |tenant, value| {
+                    tenant
+                        .spec
+                        .container_security_context
+                        .get_or_insert_default()
+                        .run_as_group = Some(value);
+                },
+            ),
+            (
+                "spec.pools[name=pool-0].securityContext.runAsUser",
+                |tenant, value| {
+                    tenant.spec.pools[0]
+                        .security_context
+                        .get_or_insert_default()
+                        .run_as_user = Some(value);
+                },
+            ),
+            (
+                "spec.pools[name=pool-0].securityContext.runAsGroup",
+                |tenant, value| {
+                    tenant.spec.pools[0]
+                        .security_context
+                        .get_or_insert_default()
+                        .run_as_group = Some(value);
+                },
+            ),
+            (
+                "spec.pools[name=pool-0].securityContext.fsGroup",
+                |tenant, value| {
+                    tenant.spec.pools[0]
+                        .security_context
+                        .get_or_insert_default()
+                        .fs_group = Some(value);
+                },
+            ),
+            (
+                "spec.pools[name=pool-0].containerSecurityContext.runAsUser",
+                |tenant, value| {
+                    tenant.spec.pools[0]
+                        .container_security_context
+                        .get_or_insert_default()
+                        .run_as_user = Some(value);
+                },
+            ),
+            (
+                "spec.pools[name=pool-0].containerSecurityContext.runAsGroup",
+                |tenant, value| {
+                    tenant.spec.pools[0]
+                        .container_security_context
+                        .get_or_insert_default()
+                        .run_as_group = Some(value);
+                },
+            ),
+        ]
+    }
 
-        let template = statefulset.spec.unwrap().template;
-        assert!(
-            template
-                .metadata
+    #[test]
+    fn declared_security_context_ids_reject_out_of_range_values_at_every_scope() {
+        for (field_path, set_value) in declared_security_context_id_fields() {
+            for value in [-1, MAX_KUBERNETES_ID + 1] {
+                let mut tenant = crate::tests::create_test_tenant(None, None);
+                set_value(&mut tenant, value);
+
+                let message = invalid_security_profile_error_message(&tenant);
+                assert!(
+                    message.contains(field_path),
+                    "missing field path for value {value}: {message}"
+                );
+                assert!(
+                    message.contains("between 0 and 2147483647, inclusive"),
+                    "missing valid range for value {value}: {message}"
+                );
+
+                let render_error = tenant
+                    .new_statefulset(&tenant.spec.pools[0])
+                    .expect_err("an out-of-range workload ID must fail before rendering");
+                assert!(matches!(
+                    render_error,
+                    crate::types::error::Error::InvalidWorkloadSecurityProfile { message, .. }
+                        if message.contains(field_path)
+                ));
+            }
+        }
+    }
+
+    #[test]
+    fn declared_security_context_ids_accept_kubernetes_boundaries_at_every_scope() {
+        for (field_path, set_value) in declared_security_context_id_fields() {
+            for value in [0, MAX_KUBERNETES_ID] {
+                let mut tenant = crate::tests::create_test_tenant(None, None);
+                set_value(&mut tenant, value);
+
+                tenant
+                    .validate_workload_security_compatibility()
+                    .unwrap_or_else(|error| {
+                        panic!("{field_path} should accept boundary value {value}: {error}")
+                    });
+                tenant
+                    .new_statefulset(&tenant.spec.pools[0])
+                    .unwrap_or_else(|error| {
+                        panic!("{field_path} should render boundary value {value}: {error}")
+                    });
+            }
+        }
+    }
+
+    #[test]
+    fn seccomp_localhost_profile_uses_kubernetes_descending_path_rules() {
+        validate_declared_seccomp_profile(
+            "spec.securityContext.seccompProfile",
+            "Localhost",
+            Some("profiles/rustfs.json"),
+        )
+        .expect("relative descending path should be valid");
+
+        for (profile, detail) in [
+            ("", "must be nonblank"),
+            ("/profiles/rustfs.json", "must be a relative path"),
+            ("profiles/../rustfs.json", "must not contain '..'"),
+            ("../profiles/rustfs.json", "must not contain '..'"),
+        ] {
+            let error = validate_declared_seccomp_profile(
+                "spec.securityContext.seccompProfile",
+                "Localhost",
+                Some(profile),
+            )
+            .expect_err("invalid seccomp Localhost path should be rejected");
+            assert!(
+                error.contains(detail),
+                "unexpected validation error: {error}"
+            );
+        }
+    }
+
+    #[test]
+    fn app_armor_localhost_profile_uses_kubernetes_name_rules() {
+        validate_declared_app_armor_profile(
+            "spec.containerSecurityContext.appArmorProfile",
+            "Localhost",
+            Some("profiles/rustfs"),
+        )
+        .expect("unpadded AppArmor profile name should be valid");
+
+        let maximum_length = "a".repeat(MAX_APP_ARMOR_LOCALHOST_PROFILE_LENGTH);
+        validate_declared_app_armor_profile(
+            "spec.containerSecurityContext.appArmorProfile",
+            "Localhost",
+            Some(&maximum_length),
+        )
+        .expect("a 4095-byte AppArmor Localhost name should be valid");
+
+        for (profile, detail) in [
+            ("", "must be nonblank"),
+            (" profiles/rustfs", "must not be padded with whitespace"),
+            ("profiles/rustfs ", "must not be padded with whitespace"),
+        ] {
+            let error = validate_declared_app_armor_profile(
+                "spec.containerSecurityContext.appArmorProfile",
+                "Localhost",
+                Some(profile),
+            )
+            .expect_err("invalid AppArmor Localhost name should be rejected");
+            assert!(
+                error.contains(detail),
+                "unexpected validation error: {error}"
+            );
+        }
+
+        let oversized = "a".repeat(MAX_APP_ARMOR_LOCALHOST_PROFILE_LENGTH + 1);
+        let error = validate_declared_app_armor_profile(
+            "spec.containerSecurityContext.appArmorProfile",
+            "Localhost",
+            Some(&oversized),
+        )
+        .expect_err("oversized AppArmor Localhost name should be rejected");
+        assert!(
+            error.contains("must be at most 4095 bytes"),
+            "unexpected validation error: {error}"
+        );
+    }
+
+    fn env_value<'a>(container: &'a corev1::Container, name: &str) -> Option<&'a str> {
+        container
+            .env
+            .as_ref()?
+            .iter()
+            .find(|var| var.name == name)?
+            .value
+            .as_deref()
+    }
+
+    fn set_env_value(container: &mut corev1::Container, name: &str, value: &str) {
+        let env = container
+            .env
+            .as_mut()
+            .expect("container should have environment variables");
+        if let Some(var) = env.iter_mut().find(|var| var.name == name) {
+            var.value = Some(value.to_string());
+        } else {
+            env.push(corev1::EnvVar {
+                name: name.to_string(),
+                value: Some(value.to_string()),
+                ..Default::default()
+            });
+        }
+    }
+
+    fn local_master_key_selector() -> LocalKmsMasterKeySecretRef {
+        LocalKmsMasterKeySecretRef {
+            name: "local-kms-master-key".to_string(),
+            key: "local-master-key".to_string(),
+        }
+    }
+
+    #[test]
+    fn disabled_tls_statefulset_keeps_http_and_has_no_tls_wiring() {
+        let tenant = crate::tests::create_test_tenant(None, None);
+        let pool = &tenant.spec.pools[0];
+
+        let statefulset = tenant
+            .new_statefulset(pool)
+            .expect("Should create StatefulSet without TLS");
+
+        let template = statefulset.spec.unwrap().template;
+        assert!(
+            template
+                .metadata
                 .as_ref()
                 .and_then(|metadata| metadata.annotations.as_ref())
                 .is_none_or(|annotations| !annotations.contains_key("operator.rustfs.com/tls-hash"))
@@ -1993,6 +2840,10 @@ mod tests {
             .template
             .spec
             .expect("Pod template should have spec");
+        assert_eq!(
+            pod_spec.containers[0].image.as_deref(),
+            Some("rustfs/rustfs:1.0.0-beta.10")
+        );
 
         let security_context = pod_spec
             .security_context
@@ -2019,6 +2870,731 @@ mod tests {
             Some("OnRootMismatch".to_string()),
             "fsGroup change policy should be set for PVC mounts"
         );
+        assert_eq!(security_context.run_as_non_root, Some(true));
+        assert_eq!(
+            security_context
+                .seccomp_profile
+                .as_ref()
+                .map(|profile| profile.type_.as_str()),
+            Some("RuntimeDefault")
+        );
+
+        let container_security_context = pod_spec.containers[0]
+            .security_context
+            .as_ref()
+            .expect("RustFS container should have securityContext");
+        assert_eq!(
+            container_security_context.allow_privilege_escalation,
+            Some(false)
+        );
+        assert_eq!(
+            container_security_context
+                .capabilities
+                .as_ref()
+                .and_then(|capabilities| capabilities.drop.as_ref()),
+            Some(&vec!["ALL".to_string()])
+        );
+        assert_eq!(
+            container_security_context.read_only_root_filesystem, None,
+            "readOnlyRootFilesystem is configurable but not required by restricted"
+        );
+    }
+
+    #[test]
+    fn known_tokio_io_uring_images_are_blocked_with_runtime_default_seccomp() {
+        for image in [
+            "rustfs/rustfs:1.0.0-alpha.99",
+            "rustfs/rustfs:1.0.0-beta.8",
+            "docker.io/rustfs/rustfs:1.0.0-beta.8-glibc",
+            "ghcr.io/rustfs/rustfs:1.0.0-beta.8-glibc",
+            "quay.io/rustfs/rustfs:1.0.0-beta.8-glibc",
+            "registry-1.docker.io/rustfs/rustfs:v1.0.0-beta.7-glibc",
+        ] {
+            let mut tenant = crate::tests::create_test_tenant(None, None);
+            tenant.spec.image = Some(image.to_string());
+
+            let error = match tenant.validate_workload_security_compatibility() {
+                Ok(()) => panic!("image {image} should be blocked"),
+                Err(error) => error,
+            };
+
+            assert!(matches!(
+                error,
+                crate::types::error::Error::WorkloadSecurityIncompatible { message, .. }
+                    if message.contains("rustfs/rustfs#4364")
+                        && message.contains("pool-0")
+                        && message.contains(image)
+            ));
+        }
+
+        let image = "rustfs/rustfs:1.0.0-beta.8";
+        let mut acknowledged_incompatible = crate::tests::create_test_tenant(None, None);
+        acknowledged_incompatible.spec.image = Some(image.to_string());
+        acknowledge_runtime_default_image(&mut acknowledged_incompatible, image);
+        let error = acknowledged_incompatible
+            .validate_workload_security_compatibility()
+            .expect_err("an image acknowledgement must not override a known incompatibility");
+        assert!(matches!(
+            error,
+            crate::types::error::Error::WorkloadSecurityIncompatible { message, .. }
+                if message.contains("rustfs/rustfs#4364")
+        ));
+    }
+
+    #[test]
+    fn compatible_localhost_profile_allows_legacy_rustfs_image() {
+        for image in [
+            "docker.io/rustfs/rustfs:1.0.0-alpha.99",
+            "docker.io/rustfs/rustfs:1.0.0-beta.8",
+        ] {
+            let mut tenant = crate::tests::create_test_tenant(None, None);
+            tenant.spec.image = Some(image.to_string());
+            tenant.spec.security_context = Some(PodSecurityContextOverride {
+                seccomp_profile: Some(corev1::SeccompProfile {
+                    localhost_profile: Some("profiles/rustfs-io-uring.json".to_string()),
+                    type_: "Localhost".to_string(),
+                }),
+                ..Default::default()
+            });
+
+            tenant
+                .validate_workload_security_compatibility()
+                .unwrap_or_else(|error| {
+                    panic!("image {image} should allow an explicit Localhost profile: {error}")
+                });
+        }
+    }
+
+    #[test]
+    fn verified_compatible_rustfs_release_tags_are_accepted() {
+        for image in [
+            "rustfs/rustfs:1.0.0-beta.9",
+            "docker.io/rustfs/rustfs:1.0.0-beta.9-glibc",
+            "ghcr.io/rustfs/rustfs:1.0.0-beta.9-glibc",
+            "quay.io/rustfs/rustfs:1.0.0-beta.9-glibc",
+            "index.docker.io/rustfs/rustfs:v1.0.0-beta.10-glibc",
+            "rustfs/rustfs:1.0.0",
+            "rustfs/rustfs:1.0.1-glibc",
+        ] {
+            let mut tenant = crate::tests::create_test_tenant(None, None);
+            tenant.spec.image = Some(image.to_string());
+
+            tenant
+                .validate_workload_security_compatibility()
+                .unwrap_or_else(|error| panic!("image {image} should not be blocked: {error}"));
+        }
+    }
+
+    #[test]
+    fn unverifiable_images_are_blocked_with_implicit_runtime_default_seccomp() {
+        for image in [
+            "rustfs/rustfs:latest",
+            "rustfs/rustfs",
+            "rustfs/rustfs@sha256:0123456789abcdef",
+            "rustfs/rustfs:1.0.0-beta.10@sha256:0123456789abcdef",
+            "rustfs/rustfs:1.0.0-beta.10-preview.5",
+            "rustfs/rustfs:nightly",
+            "rustfs/rustfs:01.0.0",
+            "rustfs/rustfs:1.00.0",
+            "rustfs/rustfs:1.0.00",
+            "rustfs/rustfs:1.0.0-beta.09",
+            "rustfs/rustfs:1.0.0-beta.09-glibc",
+            "registry.example.com/rustfs/rustfs:1.0.0-beta.10",
+        ] {
+            let mut tenant = crate::tests::create_test_tenant(None, None);
+            tenant.spec.image = Some(image.to_string());
+
+            let error = tenant
+                .validate_workload_security_compatibility()
+                .expect_err("unverifiable image should be blocked with implicit RuntimeDefault");
+            assert!(matches!(
+                error,
+                crate::types::error::Error::WorkloadSecurityIncompatible { message, .. }
+                    if message.contains(image)
+                        && message.contains("cannot be verified")
+                        && message.contains(RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION)
+                        && message.contains("pool-0")
+            ));
+        }
+    }
+
+    #[test]
+    fn runtime_default_image_ack_must_exactly_match_the_resolved_image() {
+        let image = "rustfs/rustfs:latest";
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(image.to_string());
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            seccomp_profile: Some(runtime_default_seccomp_profile()),
+            ..Default::default()
+        });
+
+        tenant
+            .validate_workload_security_compatibility()
+            .expect_err("an explicit RuntimeDefault profile must not acknowledge the image");
+
+        acknowledge_runtime_default_image(&mut tenant, "rustfs/rustfs:nightly");
+        tenant
+            .validate_workload_security_compatibility()
+            .expect_err("a mismatched image acknowledgement must not be accepted");
+
+        acknowledge_runtime_default_image(&mut tenant, image);
+        tenant
+            .validate_workload_security_compatibility()
+            .expect("a matching acknowledgement should permit an unverifiable mutable image");
+
+        tenant.spec.image = Some("rustfs/rustfs:nightly".to_string());
+        tenant
+            .validate_workload_security_compatibility()
+            .expect_err("changing the image must invalidate its previous acknowledgement");
+    }
+
+    #[test]
+    fn digest_is_authoritative_over_a_legacy_looking_tag() {
+        // Kubernetes pulls tag@digest references by digest, so the tag cannot prove which build
+        // runs. A matching acknowledgement may therefore permit even a beta.8-looking digest.
+        let image = "rustfs/rustfs:1.0.0-beta.8@sha256:0123456789abcdef";
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(image.to_string());
+        acknowledge_runtime_default_image(&mut tenant, image);
+
+        tenant
+            .validate_workload_security_compatibility()
+            .expect("a matching acknowledgement should permit a digest-qualified image");
+    }
+
+    #[test]
+    fn invalid_declared_security_profiles_are_rejected_before_image_compatibility() {
+        let legacy_image = "rustfs/rustfs:1.0.0-beta.8".to_string();
+        let mut cases = Vec::new();
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                type_: "Localhost".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.securityContext.seccompProfile.localhostProfile",
+            "must be nonblank",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                localhost_profile: Some("profiles/invalid.json".to_string()),
+                type_: "RuntimeDefault".to_string(),
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.containerSecurityContext.seccompProfile.localhostProfile",
+            "must be omitted",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                type_: "Invalid".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.containerSecurityContext.appArmorProfile.type",
+            "must be RuntimeDefault, Localhost, or Unconfined",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                localhost_profile: Some("   ".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.pools[name=pool-0].securityContext.seccompProfile.localhostProfile",
+            "must be nonblank",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                type_: "Unknown".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.pools[name=pool-0].containerSecurityContext.seccompProfile.type",
+            "must be RuntimeDefault, Localhost, or Unconfined",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                localhost_profile: Some("/profiles/rustfs.json".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.securityContext.seccompProfile.localhostProfile",
+            "must be a relative path",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                localhost_profile: Some("profiles/../rustfs.json".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.pools[name=pool-0].containerSecurityContext.seccompProfile.localhostProfile",
+            "must not contain '..'",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                localhost_profile: Some(" profiles/rustfs".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.containerSecurityContext.appArmorProfile.localhostProfile",
+            "must not be padded with whitespace",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image.clone());
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                localhost_profile: Some("a".repeat(MAX_APP_ARMOR_LOCALHOST_PROFILE_LENGTH + 1)),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.pools[name=pool-0].containerSecurityContext.appArmorProfile.localhostProfile",
+            "must be at most 4095 bytes",
+        ));
+
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some(legacy_image);
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                localhost_profile: Some("profiles/invalid".to_string()),
+                type_: "Unconfined".to_string(),
+            }),
+            ..Default::default()
+        });
+        cases.push((
+            tenant,
+            "spec.pools[name=pool-0].containerSecurityContext.appArmorProfile.localhostProfile",
+            "must be omitted",
+        ));
+
+        for (tenant, field, detail) in cases {
+            let message = invalid_security_profile_error_message(&tenant);
+            assert!(message.contains(field), "missing field path in: {message}");
+            assert!(
+                message.contains(detail),
+                "missing validation detail in: {message}"
+            );
+            assert!(
+                !message.contains("io_uring"),
+                "profile validation must run before image compatibility: {message}"
+            );
+        }
+    }
+
+    #[test]
+    fn valid_declared_security_profiles_are_accepted_at_every_scope() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.image = Some("rustfs/rustfs:1.0.0-beta.8-glibc".to_string());
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                type_: "RuntimeDefault".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                type_: "RuntimeDefault".to_string(),
+                ..Default::default()
+            }),
+            seccomp_profile: Some(corev1::SeccompProfile {
+                type_: "Unconfined".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride {
+            seccomp_profile: Some(corev1::SeccompProfile {
+                type_: "Unconfined".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                localhost_profile: Some("profiles/rustfs-apparmor".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            seccomp_profile: Some(corev1::SeccompProfile {
+                localhost_profile: Some("profiles/rustfs-seccomp.json".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+
+        tenant
+            .validate_workload_security_compatibility()
+            .expect("valid Localhost container override should allow the legacy image");
+    }
+
+    #[test]
+    fn security_context_overrides_merge_from_tenant_and_pool() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            run_as_user: Some(20_001),
+            run_as_non_root: Some(false),
+            seccomp_profile: Some(corev1::SeccompProfile {
+                localhost_profile: Some("profiles/rustfs.json".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            capabilities: Some(corev1::Capabilities {
+                add: Some(vec!["NET_BIND_SERVICE".to_string()]),
+                ..Default::default()
+            }),
+            read_only_root_filesystem: Some(true),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].security_context = Some(PodSecurityContextOverride {
+            run_as_group: Some(30_001),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            allow_privilege_escalation: Some(true),
+            capabilities: Some(corev1::Capabilities {
+                drop: Some(vec![]),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("Should create StatefulSet");
+        let pod_spec = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec");
+        let pod_context = pod_spec
+            .security_context
+            .expect("Pod should have securityContext");
+
+        assert_eq!(pod_context.run_as_user, Some(20_001));
+        assert_eq!(pod_context.run_as_group, Some(30_001));
+        assert_eq!(pod_context.fs_group, Some(DEFAULT_FS_GROUP));
+        assert_eq!(pod_context.run_as_non_root, Some(false));
+        assert_eq!(
+            pod_context
+                .seccomp_profile
+                .as_ref()
+                .map(|profile| profile.type_.as_str()),
+            Some("Localhost")
+        );
+
+        let container_context = pod_spec.containers[0]
+            .security_context
+            .as_ref()
+            .expect("RustFS container should have securityContext");
+        assert_eq!(container_context.allow_privilege_escalation, Some(true));
+        assert_eq!(container_context.read_only_root_filesystem, Some(true));
+        assert_eq!(container_context.run_as_non_root, None);
+        assert_eq!(container_context.seccomp_profile, None);
+        assert_eq!(
+            container_context
+                .capabilities
+                .as_ref()
+                .and_then(|capabilities| capabilities.add.as_ref()),
+            Some(&vec!["NET_BIND_SERVICE".to_string()])
+        );
+        assert_eq!(
+            container_context
+                .capabilities
+                .as_ref()
+                .and_then(|capabilities| capabilities.drop.as_ref()),
+            Some(&vec![])
+        );
+    }
+
+    #[test]
+    fn partial_container_override_preserves_safe_defaults() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            read_only_root_filesystem: Some(true),
+            ..Default::default()
+        });
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("Should create StatefulSet");
+        let context = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec")
+            .containers[0]
+            .security_context
+            .clone()
+            .expect("RustFS container should have securityContext");
+
+        assert_eq!(context.allow_privilege_escalation, Some(false));
+        assert_eq!(context.read_only_root_filesystem, Some(true));
+        assert_eq!(
+            context
+                .capabilities
+                .as_ref()
+                .and_then(|capabilities| capabilities.drop.as_ref()),
+            Some(&vec!["ALL".to_string()])
+        );
+    }
+
+    #[test]
+    fn legacy_root_override_disables_implicit_run_as_non_root() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            run_as_user: Some(0),
+            ..Default::default()
+        });
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("Should create StatefulSet");
+        let context = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec")
+            .security_context
+            .expect("Pod should have securityContext");
+
+        assert_eq!(context.run_as_user, Some(0));
+        assert_eq!(context.run_as_non_root, Some(false));
+    }
+
+    #[test]
+    fn container_root_override_derives_non_root_false_at_tenant_and_pool_scopes() {
+        for pool_scope in [false, true] {
+            let mut tenant = crate::tests::create_test_tenant(None, None);
+            let root_context = corev1::SecurityContext {
+                run_as_user: Some(0),
+                ..Default::default()
+            };
+            if pool_scope {
+                tenant.spec.pools[0].container_security_context = Some(root_context);
+            } else {
+                tenant.spec.container_security_context = Some(root_context);
+            }
+
+            tenant
+                .validate_workload_security_compatibility()
+                .expect("implicit container runAsNonRoot should follow the container UID");
+            let statefulset = tenant
+                .new_statefulset(&tenant.spec.pools[0])
+                .expect("root container override should render consistently");
+            let pod_spec = statefulset
+                .spec
+                .expect("StatefulSet should have spec")
+                .template
+                .spec
+                .expect("Pod template should have spec");
+            let container_context = pod_spec.containers[0]
+                .security_context
+                .as_ref()
+                .expect("RustFS container should have securityContext");
+
+            assert_eq!(
+                pod_spec.security_context.unwrap().run_as_non_root,
+                Some(true)
+            );
+            assert_eq!(container_context.run_as_user, Some(0));
+            assert_eq!(container_context.run_as_non_root, Some(false));
+        }
+    }
+
+    #[test]
+    fn explicit_root_and_non_root_true_is_rejected_before_rendering() {
+        let mut cases = Vec::new();
+
+        let mut tenant_container = crate::tests::create_test_tenant(None, None);
+        tenant_container.spec.container_security_context = Some(corev1::SecurityContext {
+            run_as_user: Some(0),
+            run_as_non_root: Some(true),
+            ..Default::default()
+        });
+        cases.push(tenant_container);
+
+        let mut pool_container = crate::tests::create_test_tenant(None, None);
+        pool_container.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            run_as_user: Some(0),
+            run_as_non_root: Some(true),
+            ..Default::default()
+        });
+        cases.push(pool_container);
+
+        let mut inherited_pod_true = crate::tests::create_test_tenant(None, None);
+        inherited_pod_true.spec.security_context = Some(PodSecurityContextOverride {
+            run_as_non_root: Some(true),
+            ..Default::default()
+        });
+        inherited_pod_true.spec.pools[0].container_security_context =
+            Some(corev1::SecurityContext {
+                run_as_user: Some(0),
+                ..Default::default()
+            });
+        cases.push(inherited_pod_true);
+
+        for tenant in cases {
+            let error = tenant
+                .validate_workload_security_compatibility()
+                .expect_err("UID 0 with explicit runAsNonRoot=true should be rejected");
+            assert!(matches!(
+                error,
+                crate::types::error::Error::InvalidWorkloadSecurityProfile { message, .. }
+                    if message.contains("pool-0")
+                        && message.contains("UID 0")
+                        && message.contains("explicitly true")
+            ));
+
+            let render_error = tenant
+                .new_statefulset(&tenant.spec.pools[0])
+                .expect_err("contradictory identity must fail before StatefulSet rendering");
+            assert!(matches!(
+                render_error,
+                crate::types::error::Error::InvalidWorkloadSecurityProfile { .. }
+            ));
+        }
+    }
+
+    #[test]
+    fn container_non_root_uid_overrides_implicit_pod_root_identity() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.security_context = Some(PodSecurityContextOverride {
+            run_as_user: Some(0),
+            ..Default::default()
+        });
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            run_as_user: Some(20_001),
+            ..Default::default()
+        });
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("container non-root UID should override the Pod root identity");
+        let pod_spec = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec");
+        let container_context = pod_spec.containers[0]
+            .security_context
+            .as_ref()
+            .expect("RustFS container should have securityContext");
+
+        assert_eq!(
+            pod_spec.security_context.unwrap().run_as_non_root,
+            Some(false)
+        );
+        assert_eq!(container_context.run_as_user, Some(20_001));
+        assert_eq!(container_context.run_as_non_root, Some(true));
+    }
+
+    #[test]
+    fn pool_replaces_tagged_container_security_profiles_atomically() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                localhost_profile: Some("profiles/tenant-apparmor".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            seccomp_profile: Some(corev1::SeccompProfile {
+                localhost_profile: Some("profiles/tenant-seccomp.json".to_string()),
+                type_: "Localhost".to_string(),
+            }),
+            ..Default::default()
+        });
+        tenant.spec.pools[0].container_security_context = Some(corev1::SecurityContext {
+            app_armor_profile: Some(corev1::AppArmorProfile {
+                type_: "RuntimeDefault".to_string(),
+                ..Default::default()
+            }),
+            seccomp_profile: Some(corev1::SeccompProfile {
+                type_: "RuntimeDefault".to_string(),
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("Should create StatefulSet");
+        let context = statefulset
+            .spec
+            .expect("StatefulSet should have spec")
+            .template
+            .spec
+            .expect("Pod template should have spec")
+            .containers[0]
+            .security_context
+            .clone()
+            .expect("RustFS container should have securityContext");
+
+        let app_armor = context
+            .app_armor_profile
+            .expect("AppArmor profile should be set");
+        assert_eq!(app_armor.type_, "RuntimeDefault");
+        assert_eq!(app_armor.localhost_profile, None);
+
+        let seccomp = context
+            .seccomp_profile
+            .expect("Seccomp profile should be set");
+        assert_eq!(seccomp.type_, "RuntimeDefault");
+        assert_eq!(seccomp.localhost_profile, None);
     }
 
     // Test: Default logging mode is stdout (no volumes)
@@ -2396,6 +3972,50 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_statefulset_container_security_context_change_detected() {
+        let mut tenant = crate::tests::create_test_tenant(None, None);
+        let statefulset = tenant
+            .new_statefulset(&tenant.spec.pools[0])
+            .expect("Should create StatefulSet");
+
+        tenant.spec.container_security_context = Some(corev1::SecurityContext {
+            read_only_root_filesystem: Some(true),
+            ..Default::default()
+        });
+
+        let needs_update = tenant
+            .statefulset_needs_update(&statefulset, &tenant.spec.pools[0])
+            .expect("Should check update need");
+
+        assert!(needs_update, "Container security changes should roll Pods");
+    }
+
+    #[test]
+    fn test_statefulset_without_container_security_defaults_needs_update() {
+        let tenant = crate::tests::create_test_tenant(None, None);
+        let pool = &tenant.spec.pools[0];
+        let mut statefulset = tenant
+            .new_statefulset(pool)
+            .expect("Should create StatefulSet");
+        statefulset
+            .spec
+            .as_mut()
+            .and_then(|spec| spec.template.spec.as_mut())
+            .expect("Pod template should have spec")
+            .containers[0]
+            .security_context = None;
+
+        let needs_update = tenant
+            .statefulset_needs_update(&statefulset, pool)
+            .expect("Should check update need");
+
+        assert!(
+            needs_update,
+            "Legacy StatefulSets should receive safe defaults"
+        );
+    }
+
     // Test: StatefulSet diff detection - image change
     #[test]
     fn test_statefulset_image_change_detected() {

From 1db0d6b2cb22c173e55eb0ada467a92bd04d5af7 Mon Sep 17 00:00:00 2001
From: GatewayJ <18332154+GatewayJ@users.noreply.github.com>
Date: Sun, 19 Jul 2026 11:55:38 +0800
Subject: [PATCH 2/2] fix(console): validate tenant before namespace creation

---
 src/console/handlers/tenants.rs | 103 ++++++++++++++++++++++----------
 1 file changed, 72 insertions(+), 31 deletions(-)

diff --git a/src/console/handlers/tenants.rs b/src/console/handlers/tenants.rs
index d615d48..8ee74d9 100755
--- a/src/console/handlers/tenants.rs
+++ b/src/console/handlers/tenants.rs
@@ -234,32 +234,33 @@ pub async fn create_tenant(
     Extension(claims): Extension<Claims>,
     Json(req): Json<CreateTenantRequest>,
 ) -> Result<Json<TenantListItem>> {
+    let tenant = tenant_from_create_request(req)?;
+    let (name, namespace) = tenant_identity(&tenant)?;
+    let name = name.to_string();
+    let namespace = namespace.to_string();
+
+    // Validate the complete request before creating any Kubernetes resource. A rejected Tenant
+    // must not leave an empty Namespace behind.
+    let client = create_client(&claims).await?;
+    ensure_namespace_exists(&client, &namespace).await?;
+
+    let api: Api<Tenant> = Api::namespaced(client, &namespace);
+    let created = api
+        .create(&Default::default(), &tenant)
+        .await
+        .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", name)))?;
+
+    Ok(Json(tenant_to_list_item(created)))
+}
+
+fn tenant_from_create_request(req: CreateTenantRequest) -> Result<Tenant> {
     // Validate tenant name is DNS-1035 compliant before hitting the K8s API
     if let Err(e) = crate::types::v1alpha1::tenant::validate_dns1035_label(&req.name) {
         return Err(Error::BadRequest {
             message: format!("{}", e),
         });
     }
-
-    let client = create_client(&claims).await?;
-
-    // Preserve the existing JSON-create behavior; the complete YAML endpoint performs
-    // stricter namespace validation before reaching Kubernetes.
-    let ns_api: Api<corev1::Namespace> = Api::all(client.clone());
-    let ns_exists = ns_api.get(&req.namespace).await.is_ok();
-    if !ns_exists {
-        let ns = corev1::Namespace {
-            metadata: k8s_openapi::apimachinery::pkg::apis::meta::v1::ObjectMeta {
-                name: Some(req.namespace.clone()),
-                ..Default::default()
-            },
-            ..Default::default()
-        };
-        ns_api
-            .create(&Default::default(), &ns)
-            .await
-            .map_err(|e| error::map_kube_error(e, format!("Namespace '{}'", req.namespace)))?;
-    }
+    validate_namespace_name(&req.namespace).map_err(|message| Error::BadRequest { message })?;
 
     // Build Tenant object
     let pools: Vec<Pool> = req
@@ -331,16 +332,7 @@ pub async fn create_tenant(
         status: None,
     };
     validate_tenant_for_write(&tenant)?;
-
-    let api: Api<Tenant> = Api::namespaced(client, &req.namespace);
-    let created = api
-        .create(&Default::default(), &tenant)
-        .await
-        .map_err(|e| error::map_kube_error(e, format!("Tenant '{}'", req.name)))?;
-
-    let item = tenant_to_list_item(created);
-
-    Ok(Json(item))
+    Ok(tenant)
 }
 
 /// Create a Tenant from its complete YAML representation.
@@ -961,9 +953,10 @@ fn summarize_tenant_states(tenants: &[Tenant]) -> TenantStateCountsResponse {
 mod tests {
     use super::{
         apply_tenant_yaml_update, ensure_namespace_exists, parse_tenant_yaml,
-        parse_tenant_yaml_for_create, state_matches_filter,
+        parse_tenant_yaml_for_create, state_matches_filter, tenant_from_create_request,
     };
     use crate::console::error::Error;
+    use crate::console::models::tenant::{CreatePoolRequest, CreateTenantRequest};
     use crate::types::v1alpha1::tenant::RUNTIME_DEFAULT_IMAGE_ACK_ANNOTATION;
     use kube::{Client, client::Body};
     use std::sync::{
@@ -986,6 +979,54 @@ spec:
         volumesPerServer: 1
 "#;
 
+    fn minimal_create_request(image: Option<&str>) -> CreateTenantRequest {
+        CreateTenantRequest {
+            name: "tenant-a".to_string(),
+            namespace: "storage".to_string(),
+            pools: vec![CreatePoolRequest {
+                name: "pool-0".to_string(),
+                servers: 1,
+                volumes_per_server: 1,
+                storage_size: "1Gi".to_string(),
+                storage_class: None,
+            }],
+            image: image.map(str::to_string),
+            mount_path: None,
+            creds_secret: None,
+            policies: None,
+            users: None,
+            buckets: None,
+            security_context: None,
+        }
+    }
+
+    #[test]
+    fn json_create_rejects_invalid_tenant_before_kubernetes_work() {
+        let error = tenant_from_create_request(minimal_create_request(Some(
+            "rustfs/rustfs:1.0.0-alpha.99",
+        )))
+        .expect_err("an incompatible image must be rejected during request preparation");
+
+        assert!(matches!(
+            error,
+            Error::BadRequest { message } if message.contains("Tokio io_uring")
+        ));
+    }
+
+    #[test]
+    fn json_create_validates_namespace_before_kubernetes_work() {
+        let mut request = minimal_create_request(Some("rustfs/rustfs:1.0.0-beta.10"));
+        request.namespace = "Storage_Team".to_string();
+
+        let error = tenant_from_create_request(request)
+            .expect_err("an invalid namespace must be rejected during request preparation");
+
+        assert!(matches!(
+            error,
+            Error::BadRequest { message } if message.contains("metadata.namespace")
+        ));
+    }
+
     #[test]
     fn raw_yaml_update_validates_image_and_acknowledgement_from_the_same_request() {
         let mut current = crate::tests::create_test_tenant(None, None);