[olcedar] d8 platform olcedar node add for static immutable nodes

[borg-z]

What

Adds d8 platform olcedar node add <address> --group <nodegroup> — one command in place of the five-step manual flow for introducing a static node running the immutable OS (olcedar):

# before
d8 k get nodeconfigtemplate worker -o yaml > template.yaml
curl http://<machine>:50000/inventory > machine.yaml
# uncomment the disk in machine.yaml
yq eval-all 'select(fi==0) * select(fi==1)' template.yaml machine.yaml > worker-0.yaml
yq -i '.metadata.name = "worker-0" | .spec.nodeName = "worker-0"' worker-0.yaml
curl -X PUT --data-binary @worker-0.yaml http://<machine>:50000/config

# after
d8 platform olcedar node add 10.12.4.55 --group worker

Neither side can do this alone: the cluster does not know the machine's disks, the machine does not know the cluster's bootstrap token. The CLI sees both — and, unlike a file, it can ask.

Flow

1. GET /whoami — a machine already held by the node agent is refused by node name, resolved from its InternalIP.
2. Read nodeconfigtemplates.templates.internal.deckhouse.io/v1alpha1 for the group. A 404 is explained against the NodeGroup itself (missing / wrong nodeType / wrong systemType), never shown as "not found".
3. GET /inventory.json. An image too old to serve it is refused — there is nothing to pick a disk out of.
4. Ask the disk, the network and the node name.
5. Build internal.deckhouse.io/v1alpha1 NodeConfig, PUT /config, wait for the node to register.

Adopting a disk, and never erasing one by accident

init decides for itself whether anything is installed. resolveSystemDisk (images/init/src/0.1/disk.go) finds one disk carrying BOOT/CONFIG/DATA and answers install=false; initmode.go then computes provision := install || cfg.Spec.Storage.Wipe. So wipe: true is the one thing that can force a provision where none is needed — and that provision is destructive first and sourced second: provisionDisk erases, and only afterwards copy-boot-assets looks for the UKI and the rootfs under /run/media. A machine booted from its own disk (every disk cloned from an image, so every DVP node) has no such media: the erase succeeds, the copy fails, and nothing is left to boot from.

This command therefore:

• adopts a disk that already carries the layout — the document names no storage at all, because init identifies that disk itself, and a selector disagreeing with the pin writeDiskPin recorded at install is itself a reason for it to reinstall;
• writes wipe only from an explicit --wipe, which reads as "reinstall, from installation media" and says what it costs without one;
• calls out a second disk carrying the layout: the node identifies its disk by that layout before it reads any selector, so it would take that one and leave the named disk alone.

What those notes warn about cannot be settled from an inventory — diskState spells installer media and an installed system the same way (inventory.go:101), and only the machine knows which disk it booted from. Teaching the inventory that fact belongs to the initramfs repository, where bootedDisk() already computes it.

The three documents this produces:

# blank disk, no --wipe                 # layout already there (adopt)      # --wipe
storage:                                storage: {}                         storage:
  diskSelector:                                                               diskSelector:
    serial: S3Z8NB0K700002                                                      serial: ZA20ABCD
                                                                              wipe: true

The rest of what is never decided silently

• The single blank disk is the default but still confirmed. Two blank disks and no answer → refusal naming --disk-selector.
• The disk is named by the most stable attribute it reports (wwid → serial → busPath → name), so the document survives sda becoming sdb.
• The interface the CLI reached the machine on is the default, proven by the connection itself. An address belonging to no interface (a port forward, a NAT) is asked about, or named with --network-interface.
• DHCP unless the operator pins the current address; --network dhcp|static decides it up front.
• Without a TTY and without --yes the command refuses instead of choosing.

Secrets

The template carries a live bootstrap token, registry.auth and the registry-packages-proxy token on every read. The document is assembled in memory, is never logged or written to a file, and --dry-run prints it with those three fields redacted. There is a test asserting the fixture token value does not appear in the redacted output.

Non-interactive

d8 platform olcedar node add 10.12.4.55 --group worker \
  --name worker-1 --disk-selector serial=S3Z8NB0K700002 --network dhcp --yes

--group completes to Static+Immutable NodeGroups only — a group that cannot take a machine is never offered.

On not importing dhctl

The machine-facing HTTP contract (/whoami, /inventory.json, /config) and the inventory types mirror dhctl/pkg/immutable of the deckhouse repository rather than importing it. CheckDocumentAgainstInventory there reaches dhctl/pkg/config and dhctl/pkg/global, so importing it means pulling dhctl's whole dependency tree into the CLI for some 250 lines of net/http. The copies carry a mirror comment naming the original.

Its disk-vs-inventory check is not ported wholesale either: TemplateStorage.render blanks spec.storage and spec.network before serving, so both halves are filled in by this command out of the inventory it just read — checking them back against it checks the CLI against itself. What is ported is the part that catches a live mistake: a --disk-selector from a human must resolve to exactly one disk.

Tests

go test ./internal/olcedar/... ./internal/system/... → 222 passed in 44 packages. Among them:

• refusal on agent,
• refusal without a TTY and without --yes,
• worker-0 taken → worker-1 offered (and hole-filling, and other groups ignored),
• a system-layout disk adopted with no storage in the document,
• wipe present only when --wipe was passed,
• the missing-media and second-layout-disk warnings,
• the fixture token absent from --dry-run output.

Still to do

A live run on a stand — machine in installer → command → node registers, d8 k get nodeconfig <name> showing the chosen network and disk — is not part of this PR; that is what the draft state is for.

🤖 Generated with Claude Code