Tenant SA lacks dragonflydb.io CRD permissions. Use a standard Valkey Deployment+Service instead. Also re-enable CNPG (created via kubectl), migrate job, and add seccompProfile to migrate pod.