fix(backup): apply configured podSecurityContext to backup CronJob (#1655)

The backup CronJob controller does not set podSecurityContext on the
backup Job pod spec, even though DevWorkspaceOperatorConfig documents
that podSecurityContext applies to all workspace-related pods. This can
cause permission or SELinux failures when the backup container reads
workspace PVC data on clusters with a custom podSecurityContext.

Apply the configured podSecurityContext from DevWorkspaceOperatorConfig
to the backup Job pod template, consistent with workspace deployments
and PVC cleanup jobs.

Fixes: #1636

Assisted-by: Claude Code

Signed-off-by: Chris Brown <chribrow@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: snecklifter

controllers/backupcronjob/backupcronjob_controller.go

@@ -400,6 +400,7 @@ func (r *BackupCronJobReconciler) createBackupJob(
 				Spec: corev1.PodSpec{
 					ServiceAccountName: JobRunnerSAName + "-" + workspace.Status.DevWorkspaceId,
 					RestartPolicy:      corev1.RestartPolicyNever,
+					SecurityContext:    dwOperatorConfig.Config.Workspace.PodSecurityContext,
 					Containers: []corev1.Container{
 						{
 							Name: "backup-workspace",

controllers/backupcronjob/backupcronjob_controller_test.go

@@ -426,6 +426,80 @@ var _ = Describe("BackupCronJobReconciler", func() {
 			Expect(*jobList.Items[0].Spec.BackoffLimit).To(Equal(int32(2)))
 		})
 
+		It("creates a Job with configured podSecurityContext", func() {
+			enabled := true
+			schedule := "* * * * *"
+			fsGroupChangeOnRootMismatch := corev1.FSGroupChangeOnRootMismatch
+			customPodSecurityContext := &corev1.PodSecurityContext{
+				FSGroupChangePolicy: &fsGroupChangeOnRootMismatch,
+				SELinuxOptions:      &corev1.SELinuxOptions{Type: "spc_t"},
+			}
+			dwoc := &controllerv1alpha1.DevWorkspaceOperatorConfig{
+				ObjectMeta: metav1.ObjectMeta{Name: nameNamespace.Name, Namespace: nameNamespace.Namespace},
+				Config: &controllerv1alpha1.OperatorConfiguration{
+					Workspace: &controllerv1alpha1.WorkspaceConfig{
+						PodSecurityContext: customPodSecurityContext,
+						BackupCronJob: &controllerv1alpha1.BackupCronJobConfig{
+							Enable:   &enabled,
+							Schedule: schedule,
+							Registry: &controllerv1alpha1.RegistryConfig{
+								Path: "fake-registry",
+							},
+						},
+					},
+				},
+			}
+			Expect(fakeClient.Create(ctx, dwoc)).To(Succeed())
+			dw := createDevWorkspace("dw-secctx", "ns-a", false, metav1.NewTime(time.Now().Add(-10*time.Minute)))
+			dw.Status.Phase = dwv2.DevWorkspaceStatusStopped
+			dw.Status.DevWorkspaceId = "id-secctx"
+			Expect(fakeClient.Create(ctx, dw)).To(Succeed())
+
+			pvc := &corev1.PersistentVolumeClaim{ObjectMeta: metav1.ObjectMeta{Name: "claim-devworkspace", Namespace: dw.Namespace}}
+			Expect(fakeClient.Create(ctx, pvc)).To(Succeed())
+
+			Expect(reconciler.executeBackupSync(ctx, dwoc, log)).To(Succeed())
+
+			jobList := &batchv1.JobList{}
+			Expect(fakeClient.List(ctx, jobList, &client.ListOptions{Namespace: dw.Namespace})).To(Succeed())
+			Expect(jobList.Items).To(HaveLen(1))
+			Expect(jobList.Items[0].Spec.Template.Spec.SecurityContext).To(Equal(customPodSecurityContext))
+		})
+
+		It("does not set podSecurityContext when not configured", func() {
+			enabled := true
+			schedule := "* * * * *"
+			dwoc := &controllerv1alpha1.DevWorkspaceOperatorConfig{
+				ObjectMeta: metav1.ObjectMeta{Name: nameNamespace.Name, Namespace: nameNamespace.Namespace},
+				Config: &controllerv1alpha1.OperatorConfiguration{
+					Workspace: &controllerv1alpha1.WorkspaceConfig{
+						BackupCronJob: &controllerv1alpha1.BackupCronJobConfig{
+							Enable:   &enabled,
+							Schedule: schedule,
+							Registry: &controllerv1alpha1.RegistryConfig{
+								Path: "fake-registry",
+							},
+						},
+					},
+				},
+			}
+			Expect(fakeClient.Create(ctx, dwoc)).To(Succeed())
+			dw := createDevWorkspace("dw-no-secctx", "ns-a", false, metav1.NewTime(time.Now().Add(-10*time.Minute)))
+			dw.Status.Phase = dwv2.DevWorkspaceStatusStopped
+			dw.Status.DevWorkspaceId = "id-no-secctx"
+			Expect(fakeClient.Create(ctx, dw)).To(Succeed())
+
+			pvc := &corev1.PersistentVolumeClaim{ObjectMeta: metav1.ObjectMeta{Name: "claim-devworkspace", Namespace: dw.Namespace}}
+			Expect(fakeClient.Create(ctx, pvc)).To(Succeed())
+
+			Expect(reconciler.executeBackupSync(ctx, dwoc, log)).To(Succeed())
+
+			jobList := &batchv1.JobList{}
+			Expect(fakeClient.List(ctx, jobList, &client.ListOptions{Namespace: dw.Namespace})).To(Succeed())
+			Expect(jobList.Items).To(HaveLen(1))
+			Expect(jobList.Items[0].Spec.Template.Spec.SecurityContext).To(BeNil())
+		})
+
 		It("creates a Job with configured imagePullPolicy", func() {
 			enabled := true
 			schedule := "* * * * *"