Homelab/infra-core
6
0
Fork 2
Code Issues Pull requests 35 Projects Releases 1 Packages Wiki Activity Actions

LR-20261111-016: feat(sbx-lab): mount the spec-016 implementer cap read-only at /home/ld/etc/ld-launch #951

Open
pi-landing wants to merge 1 commit from lr-20261111-016-launchcap into live
pull from: lr-20261111-016-launchcap
merge into: Homelab:live
Conversation 0 Commits 1 Files changed 3 +43
pi-landing commented 2026-11-12 00:06:29 +00:00
Collaborator
Copy link

Spec 016's missing step, time-boxed for the ~02:00Z recreate. sbx-lab ONLY.

Why this shape

infra-core #933 (4374edf2) added the sandbox chart's launchCap with enabled: false and the comment "sbx-lab sets it true at its held recreate" — but sbx-lab is NOT chart-rendered: core/manifests/apps/sbx-lab is hand-maintained kustomize (the StatefulSet was adopted field-owner by field-owner by ArgoCD; see its header), so #933's chart change can never reach this pod and the values change never landed. homelab-88's live template check (21:5xZ) confirmed: no /home/ld/etc/ld-launch mount. This PR is the delivery — the mount is added to sbx-lab's own StatefulSet, with the cap value in a reviewed file, exactly as the chart would have done.

The change (three files, sbx-lab only)

  1. launch-cap.yaml (new) — ConfigMap sbx-lab-launch-cap, cap: "3". The value changes ONLY through a reviewed PR to this file: a launcher that could edit its own cap would have no cap at all, which is why it is a read-only ConfigMap mount and why ld-launch also refuses a cap file its own uid can write.
  2. statefulset.yaml — the sandbox container gains the read-only mount at the FIXED path /home/ld/etc/ld-launch; the pod gains the launch-cap volume (configMap, defaultMode: 292 = 0444, no uid in the pod can write through the mode).
  3. kustomization.yaml — resources: gains launch-cap.yaml (the epic test requires every *.yaml listed).

Render proof (kubectl kustomize, before vs after)

The render diff is EXACTLY four added lines, nothing else: the ConfigMap sbx-lab-launch-cap, the volume, and the mount. sbx-gits and sbx-sendrast render zero launch-cap references — no other sandbox gains anything.

Guard (scripts/gits-sbx-epic-test.sh, same runner)

Head FAIL 21/722 vs the pre-change baseline FAIL 20/722. The ONE new failure class is the expected pre-recreate delta, named verbatim by the test: volumenes-anadidos: launch-cap mounts-anadidos: /home/ld/etc/ld-launch (the render/kind-name set differs from live until the held recreate applies this directory). Every other FAIL is unchanged from the baseline (pre-existing, temp-dir noise aside).

Sequencing

Must land before ~01:30Z for the ~02:00Z recreate; if it misses, the recreate ships without the cap and this waits for the next one. No pod restart is triggered by this PR itself (StatefulSet spec change; updateStrategy: OnDelete — the restart is the supervisor's held step).

Lab-Run: LR-20261111-016

Spec 016's missing step, time-boxed for the ~02:00Z recreate. **sbx-lab ONLY.** ## Why this shape infra-core #933 (`4374edf2`) added the sandbox chart's `launchCap` with `enabled: false` and the comment "sbx-lab sets it true at its held recreate" — but **sbx-lab is NOT chart-rendered**: `core/manifests/apps/sbx-lab` is hand-maintained kustomize (the StatefulSet was adopted field-owner by field-owner by ArgoCD; see its header), so #933's chart change can never reach this pod and the values change never landed. homelab-88's live template check (21:5xZ) confirmed: no `/home/ld/etc/ld-launch` mount. **This PR is the delivery** — the mount is added to sbx-lab's own StatefulSet, with the cap value in a reviewed file, exactly as the chart would have done. ## The change (three files, sbx-lab only) 1. `launch-cap.yaml` (new) — ConfigMap `sbx-lab-launch-cap`, `cap: "3"`. The value changes ONLY through a reviewed PR to this file: a launcher that could edit its own cap would have no cap at all, which is why it is a read-only ConfigMap mount and why `ld-launch` also refuses a cap file its own uid can write. 2. `statefulset.yaml` — the `sandbox` container gains the read-only mount at the FIXED path `/home/ld/etc/ld-launch`; the pod gains the `launch-cap` volume (configMap, `defaultMode: 292` = 0444, no uid in the pod can write through the mode). 3. `kustomization.yaml` — `resources:` gains `launch-cap.yaml` (the epic test requires every `*.yaml` listed). ## Render proof (kubectl kustomize, before vs after) The render diff is EXACTLY four added lines, nothing else: the ConfigMap `sbx-lab-launch-cap`, the volume, and the mount. `sbx-gits` and `sbx-sendrast` render **zero** launch-cap references — no other sandbox gains anything. ## Guard (scripts/gits-sbx-epic-test.sh, same runner) Head FAIL 21/722 vs the pre-change baseline FAIL 20/722. The ONE new failure class is the expected pre-recreate delta, named verbatim by the test: `volumenes-anadidos: launch-cap mounts-anadidos: /home/ld/etc/ld-launch` (the render/kind-name set differs from live until the held recreate applies this directory). Every other FAIL is unchanged from the baseline (pre-existing, temp-dir noise aside). ## Sequencing Must land before ~01:30Z for the ~02:00Z recreate; if it misses, the recreate ships without the cap and this waits for the next one. No pod restart is triggered by this PR itself (StatefulSet spec change; `updateStrategy: OnDelete` — the restart is the supervisor's held step). Lab-Run: LR-20261111-016
feat(sbx-lab): mount the spec-016 implementer cap read-only at /home/ld/etc/ld-launch (LR-20261111-016)
All checks were successful
CI Review / runner-manifest-test (pull_request) Successful in 6s
Details
CI Review / receiver-test (pull_request) Successful in 6s
Details
CI Review / helm-validate (pull_request) Successful in 11s
Details
Build Lab Director Dispatcher Image / preflight (pull_request) Successful in 4s
Details
Lint & Validate / shellcheck (pull_request) Successful in 7s
Details
CI Review / alert-receiver-test (pull_request) Successful in 21s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 33s
Details
CI Review / record-sql-test (pull_request) Successful in 2m45s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 3m27s
Details
CI Review / cockpit-test (pull_request) Successful in 4m42s
Details
Build Lab Director Dispatcher Image / build-and-push (pull_request) Successful in 4m45s
Details
CI Review / cockpit-e2e (pull_request) Successful in 5m6s
Details
CI Review / dispatcher-test (pull_request) Successful in 6m37s
Details
c1836bfb5b 
infra-core #933 (4374edf2) added the sandbox chart's launchCap with
enabled: false and the comment 'sbx-lab sets it true at its held
recreate' — but sbx-lab is NOT chart-rendered (core/manifests/apps/
sbx-lab is hand-maintained kustomize, adopted field-owner by field-owner
by ArgoCD), so the chart change can never reach this pod and the values
change never landed (homelab-88's live template check: no
/home/ld/etc/ld-launch mount).

This PR is the delivery, sbx-lab only: a ConfigMap (launch-cap.yaml,
cap '3') plus the read-only volume and the container mount at the FIXED
path. The value changes ONLY through a reviewed PR to that file — a
launcher that could edit its own cap would have no cap at all. sbx-gits
and sbx-sendrast render nothing (render proof in the PR body).

Guard: the gits-sbx epic test gains exactly ONE expected failure class
pre-recreate — the render/kind-name set differs from live by the added
launch-cap objects (volumenes-anadidos: launch-cap,
mounts-anadidos: /home/ld/etc/ld-launch); it resolves when the held
recreate applies this directory.

Lab-Run: LR-20261111-016
All checks were successful
CI Review / runner-manifest-test (pull_request) Successful in 6s
Details
CI Review / receiver-test (pull_request) Successful in 6s
Details
CI Review / helm-validate (pull_request) Successful in 11s
Required
Details
Build Lab Director Dispatcher Image / preflight (pull_request) Successful in 4s
Details
Lint & Validate / shellcheck (pull_request) Successful in 7s
Required
Details
CI Review / alert-receiver-test (pull_request) Successful in 21s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 33s
Required
Details
CI Review / record-sql-test (pull_request) Successful in 2m45s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 3m27s
Required
Details
CI Review / cockpit-test (pull_request) Successful in 4m42s
Details
Build Lab Director Dispatcher Image / build-and-push (pull_request) Successful in 4m45s
Details
CI Review / cockpit-e2e (pull_request) Successful in 5m6s
Details
CI Review / dispatcher-test (pull_request) Successful in 6m37s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin lr-20261111-016-launchcap:lr-20261111-016-launchcap
git switch lr-20261111-016-launchcap
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels
operator-review
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Homelab/infra-core!951
No description provided.