test(storage): restore userns smoke harness default-off

[devantler]

🤖 Generated by the Daily AI Engineer

What changed

• restored the disposable userns-longhorn-smoke component to its documented default-off state in the Hetzner apps overlay
• retained the standalone Namespace + Job component for future regression checks
• left local/CI behavior and real application user-namespace opt-ins unchanged

Why

The short-lived production proof from #2604/#2605 remained declaratively active after completing. Read-only pre-removal evidence now proves that the Job completed successfully, both init and main containers used non-zero subordinate UID/GID mappings, the Longhorn-backed write/read round trip passed, the volume detached normally, and no attributable Warning events remain.

Refs #2619
Parent: #1807

This PR intentionally does not auto-close #2619. The issue must stay open until the merge-queue rollout has pruned the Namespace, Job/Pod, PVC/PV, and corresponding Longhorn volume and that cleanup is verified.

Validation

• failing-first default-off render assertion: RED found two smoke resources before the change; GREEN found zero in Docker/Hetzner default renders
• standalone component render: exactly one restricted Namespace and one bounded, no-retry, tokenless Job with hostUsers: false and a 256Mi RWO longhorn-wffc generic-ephemeral claim
• python3 scripts/validate-naming.py
• python3 scripts/validate-embedded-json.py
• raw local, production, Hetzner apps, and standalone Kustomize renders
• KSail 7.167.0 local validation: 109 kustomizations / 541 files
• KSail 7.167.0 production validation: 109 kustomizations / 541 files
• ksail workload scan --framework nsa --compliance-threshold 85
• git diff --check
• independent diff review: clean

Rollout follow-up

After promotion and merge-queue deployment, verify the smoke Namespace, Job/Pod, PVC/PV, and Longhorn volume are absent; then record the cleanup on #1807 and close #2619 manually.

[devantler]

🤖 Sent by the Codex Daily AI Engineer instance.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 9d5e3f2842

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Sent by the Codex Daily AI Engineer instance.

@coderabbitai review

[coderabbitai]

@devantler I'll review the changes now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8da2a387-2c9a-4f3e-aef8-16f297119d45

📥 Commits

Reviewing files that changed from the base of the PR and between 9b11400 and 9d5e3f2.

📒 Files selected for processing (1)

• k8s/providers/hetzner/apps/kustomization.yaml

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

k8s/**/kustomization.yaml

📄 CodeRabbit inference engine (AGENTS.md)

Keep the Kustomize build file named exactly kustomization.yaml (kustomize.config.k8s.io); do not rename it for Flux resources.

Files:

• k8s/providers/hetzner/apps/kustomization.yaml

🧠 Learnings (1)

📚 Learning: 2026-07-01T21:13:36.950Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 2359
File: k8s/bases/apps/actual-budget/helm-release.yaml:62-111
Timestamp: 2026-07-01T21:13:36.950Z
Learning: When reviewing Kustomize/Helm YAML in this repo, keep the base vs provider overlay split: `k8s/bases/apps/**` and `k8s/bases/infrastructure/**` should contain each app’s full, environment-agnostic configuration (including base-level postRenderer Kustomize patches such as deployment strategy, topology spread, probes, and env injection). `k8s/providers/{docker,hetzner}/**` should only add small provider-specific deltas (e.g., `interval`, `persistence.size`) via patch files (like `k8s/providers/<provider>/apps/<app>/patches/helm-release-patch.yaml`). If configuration is identical across providers (e.g., OIDC/OAuth env vars where `${domain}` is resolved per cluster via envsubst), it belongs in the base and must not be duplicated into provider overlays.

Applied to files:

• k8s/providers/hetzner/apps/kustomization.yaml

🔇 Additional comments (1)

k8s/providers/hetzner/apps/kustomization.yaml (1)

18-22: LGTM!

---

📝 Walkthrough

Walkthrough

The Hetzner applications kustomization now comments out the userns-longhorn-smoke resource. Its comment identifies the proof as default-off and documents temporarily uncommenting it, capturing the completed Job’s logs, and removing it afterward.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes restoring the userns smoke harness to its default-off state.
Description check	✅ Passed	The description matches the change by explaining the default-off restoration and standalone component retention.
Linked Issues check	✅ Passed	The change satisfies #2619 by removing the default-on inclusion and leaving the standalone smoke component intact.
Out of Scope Changes check	✅ Passed	The diff appears limited to the requested kustomization/comment update, with no unrelated scope added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Sent by the Codex Daily AI Engineer instance.

Merge-queue rollout record for run 29265027478:

• The speculative artifact reconciled far enough to prune the smoke Job and Namespace at 16:19:01Z. The post-run cluster has no matching Namespace, Job, Pod, PVC, PV, Longhorn Volume, Longhorn attachment, or CSI attachment.
• The production deploy then failed health on the two private tenant OCIRepositories plus github-config, and GitHub ejected this PR from the merge queue. The tenant sources returned GHCR DENIED; github-config also hit the known kyverno-policies repository bootstrap/custom-property blocker from .github#94 and platform-template#24.
• The failure-path heal checked out main and pushed main artifact sha256:95684c459f4651928122021ffd29f0c3d1d5499dcf128b1b61a573df69839ccc, but Flux could not fetch it: the source stayed on cached speculative revision 48fff3ca and reported GHCR token DENIED until the 30-minute reconcile timeout.
• The PR is therefore open and unmerged, and in-cluster main restoration is not proven. Do not requeue until the GHCR pull credential tracked by Single source of truth for the ghcr pull credential (OpenBao + ExternalSecret) #2613 is repaired, the repository bootstrap blocker is cleared, and fresh source/application reconciliations succeed.

#2619 stays open: cleanup is currently proven, but it is not durable while main still declares the harness and Flux cannot fetch the healed main artifact.

[botantler-1]

🎉 This PR is included in version 1.116.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀