Permit worker-only RKE2 emptyDir drain opt-in #121

Merged

gitchegumi merged 1 commit from kiyi/rke2-worker-emptydir into main

2026-10-17 19:09:03 -05:00

kiyi commented

2026-10-17 19:01:14 -05:00

Member

Platform activation 5048 upgraded control to v1.36.5+rke2r1, then worker drain stopped on normal UDS/Istio emptyDir volumes. The owner explicitly approved worker-only deleteEmptydirData: true, retaining PVCs and disruption-budget checks. The current reusable validator unconditionally rejects that setting.

Permit an explicit boolean emptyDir opt-in for agent-plan only. Keep server Plans restricted to false, and retain eviction/PDB enforcement, force: false, DaemonSet handling, the 15-minute drain timeout, fixed targets and one-node concurrency. Existing signed-source Plans with false on both roles remain valid. Workflow/job/scan names, credentials, images and privileges are unchanged.

Validation: all 86 RKE2 workflow tests pass, including new worker opt-in/legacy compatibility, server rejection, strict boolean typing and PDB/force/timeout checks. The actual prepared Platform manifests and legacy false/false variants both pass the reusable validator. Changed-file Ruff, diff checks and staged native Gitleaks pass. This source-only change requires the normal Library checks, immutable release and stable-v1 promotion before the updated Plan bundle can be built/activated.

Platform activation [5048](https://git.gitchegumi.com/Homelab/platform/actions/runs/5048) upgraded control to v1.36.5+rke2r1, then worker drain stopped on normal UDS/Istio emptyDir volumes. The owner explicitly approved worker-only `deleteEmptydirData: true`, retaining PVCs and disruption-budget checks. The current reusable validator unconditionally rejects that setting. Permit an explicit boolean emptyDir opt-in for `agent-plan` only. Keep server Plans restricted to false, and retain eviction/PDB enforcement, `force: false`, DaemonSet handling, the 15-minute drain timeout, fixed targets and one-node concurrency. Existing signed-source Plans with false on both roles remain valid. Workflow/job/scan names, credentials, images and privileges are unchanged. Validation: all 86 RKE2 workflow tests pass, including new worker opt-in/legacy compatibility, server rejection, strict boolean typing and PDB/force/timeout checks. The actual prepared Platform manifests and legacy false/false variants both pass the reusable validator. Changed-file Ruff, diff checks and staged native Gitleaks pass. This source-only change requires the normal Library checks, immutable release and stable-v1 promotion before the updated Plan bundle can be built/activated.

kiyi added 1 commit

2026-10-17 19:01:14 -05:00

Permit worker-only RKE2 emptyDir drain opt-in

Workflow acceptance / acceptance (pull_request) Successful in 1m17s

Details

Repository security / security-1 (pull_request) Successful in 3m24s

Details

Library checks / tests (pull_request) Successful in 3m57s

Details

3a6101c63b

kiyi added this to the Homelab Roadmap project

2026-10-17 19:01:58 -05:00

portegumi approved these changes

2026-10-17 19:02:25 -05:00

portegumi left a comment

Reviewed exact head 3a6101c63b: check() ties the worker opt-in to the exactly named agent-plan and the complementary control-plane selectors; server-plan must retain boolean false. check_drain() requires explicit bool and preserves eviction/PDB behavior, force=false, DaemonSet handling and 15m timeout; fixed target and single-node concurrency checks remain. New focused tests exercise legacy false/false, worker true, server rejection, invalid types and drain safeguards. No new UDS policy/routing or package ownership is introduced in the inspected source. Source approved; Library checks, Workflow acceptance and Repository security are still pending and must pass on this head before merge/release. Forgejo omitted patch hunks, so this review is based on the complete authenticated changed-file source and file inventory, not an authenticated base diff or a completed hosted test run.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head 3a6101c63b5e54e9ec803c9f98b537d90d5b1d5d: `check()` ties the worker opt-in to the exactly named `agent-plan` and the complementary control-plane selectors; `server-plan` must retain boolean false. `check_drain()` requires explicit bool and preserves eviction/PDB behavior, force=false, DaemonSet handling and 15m timeout; fixed target and single-node concurrency checks remain. New focused tests exercise legacy false/false, worker true, server rejection, invalid types and drain safeguards. No new UDS policy/routing or package ownership is introduced in the inspected source. Source approved; Library checks, Workflow acceptance and Repository security are still pending and must pass on this head before merge/release. Forgejo omitted patch hunks, so this review is based on the complete authenticated changed-file source and file inventory, not an authenticated base diff or a completed hosted test run. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.