Homelab/infra-core
6
0
Fork 2
Code Issues Pull requests 35 Projects Releases 1 Packages Wiki Activity Actions

Spec 016: the ld-launch implementer cap as a read-only ConfigMap mount (sandbox chart) #932

Closed
pi-landing wants to merge 1 commit from ld/spec-016-launch-cap into main
pull from: ld/spec-016-launch-cap
merge into: Homelab:main
Conversation 0 Commits 1 Files changed 3 +40
pi-landing commented 2026-11-11 09:35:02 +00:00
Collaborator
Copy link

Spec 016 (run LR-20261111-016), the second of the spec's two PRs. The tool half is Homelab/lab-director#306 (ld-launch); this PR delivers the cap file it reads.

What

  • core/charts/apps/sandbox/values.yaml: documented launchCap: block (enabled: false, cap: 3, mountPath: /home/ld/etc/ld-launch). The cap value changes ONLY through a reviewed PR to this file.
  • core/charts/apps/sandbox/templates/launch-cap-configmap.yaml (new): a <fullname>-launch-cap ConfigMap holding cap, rendered only when launchCap.enabled.
  • core/charts/apps/sandbox/templates/deployment.yaml: mounts the ConfigMap read-only at launchCap.mountPath in the main sandbox container, same guard. Mounted file: /home/ld/etc/ld-launch/cap — exactly the path ld-launch opens and refuses when missing or writable by its own uid.

Provenance / proof

  • Flow 1 of the spec (the cap is a read-only ConfigMap-mount file, value 3, changed only by a reviewed infra-core PR): proven by construction — the chart default is disabled, the value lives only in values.yaml, the mount is readOnly: true, and ld-launch (lab-director #306, 12-scenario fixture suite, scenarios f/k) refuses any cap file an agent can write or relocate.
  • Render check: helm template is not installed in the dev pod; template guard balance, nindent usage and indentation were verified by hand against neighbouring templates. The repo's helm-validate CI job is the authoritative render.
  • Enablement for sbx-lab (its ArgoCD app setting launchCap.enabled=true) rides the held sbx-lab recreate; other sandbox instances stay untouched (out of scope per spec).

Seats and landing (per the brief)

Seats on this PR: comment only — NO verdict-cli. This is Homelab/infra-core: GO NEEDED from El Director before landing.

no independent walk: implementer-run checks only

Lab-Run: LR-20261111-016

Spec 016 (run LR-20261111-016), the second of the spec's two PRs. The tool half is Homelab/lab-director#306 (`ld-launch`); this PR delivers the cap file it reads. ## What - `core/charts/apps/sandbox/values.yaml`: documented `launchCap:` block (`enabled: false`, `cap: 3`, `mountPath: /home/ld/etc/ld-launch`). The cap value changes ONLY through a reviewed PR to this file. - `core/charts/apps/sandbox/templates/launch-cap-configmap.yaml` (new): a `<fullname>-launch-cap` ConfigMap holding `cap`, rendered only when `launchCap.enabled`. - `core/charts/apps/sandbox/templates/deployment.yaml`: mounts the ConfigMap **read-only** at `launchCap.mountPath` in the main sandbox container, same guard. Mounted file: `/home/ld/etc/ld-launch/cap` — exactly the path `ld-launch` opens and refuses when missing or writable by its own uid. ## Provenance / proof - Flow 1 of the spec (the cap is a read-only ConfigMap-mount file, value 3, changed only by a reviewed infra-core PR): proven by construction — the chart default is disabled, the value lives only in values.yaml, the mount is `readOnly: true`, and `ld-launch` (lab-director #306, 12-scenario fixture suite, scenarios f/k) refuses any cap file an agent can write or relocate. - Render check: `helm template` is not installed in the dev pod; template guard balance, `nindent` usage and indentation were verified by hand against neighbouring templates. The repo's `helm-validate` CI job is the authoritative render. - Enablement for sbx-lab (its ArgoCD app setting `launchCap.enabled=true`) rides the held sbx-lab recreate; other sandbox instances stay untouched (out of scope per spec). ## Seats and landing (per the brief) Seats on this PR: **comment only — NO verdict-cli**. This is Homelab/infra-core: **GO NEEDED** from El Director before landing. no independent walk: implementer-run checks only Lab-Run: LR-20261111-016
sandbox chart: the ld-launch implementer cap as a read-only ConfigMap mount (spec 016)
All checks were successful
Release / release (pull_request) Has been skipped
Details
ccc2aa732e 
Values-gated (default off; sbx-lab enables at its held recreate). When
enabled, renders a <fullname>-launch-cap ConfigMap holding the cap value
and mounts it read-only at /home/ld/etc/ld-launch in the main sandbox
container, giving the file /home/ld/etc/ld-launch/cap that ld-launch
(Homelab/lab-director fleet image, spec 016 / LR-20261111-016) reads and
refuses a launch at or over. The value changes only through a reviewed PR
to this file.

Lab-Run: LR-20261111-016
pi-landing closed this pull request 2026-11-11 09:36:01 +00:00
All checks were successful
Release / release (pull_request) Has been skipped
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels
operator-review
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Homelab/infra-core!932
No description provided.