feat(ensure_pvc): accept ReadWriteOncePod on imported archive PVCs

[bdchatham]

Closes #213.

Summary

Relaxes the imported-PVC validator to accept either ReadWriteOnce or ReadWriteOncePod. Both are single-writer access modes that satisfy the validator's intent. Previously the validator rejected RWOP-only PVCs with "accessModes does not include ReadWriteOnce".

This is the controller-side prerequisite for landing the SELinux-mount-labeling optimization on EKS 1.34. Platform-repo archive manifests will then ship accessModes: [ReadWriteOncePod], which activates SELinuxMountReadWriteOncePod (GA since K8s 1.27, default-on) and skips the ~20-minute recursive setxattr walk on the archive PVC every pod start.

Why RWOP and not seLinuxChangePolicy: MountOption

The cleaner standard fix (seLinuxChangePolicy: MountOption) requires the upstream SELinuxMount feature gate at the API server — default-off in K8s 1.33–1.36 and not exposed to customers on managed EKS (containers-roadmap#512, still open). RWOP sidesteps that constraint entirely.

Background and prior attempts: #202 (reverted by #206) and #207 (closed). #213 has the full analysis.

Files

File	Change
internal/task/ensure_pvc.go	Validator now accepts RWO or RWOP (3-line change)
internal/task/ensure_pvc_test.go	New test: RWOP-only PVC passes validation; existing wrong-access-mode test still passes
.agent/runbooks/operating-archive-node-byov.md	New §6.4 documenting the rationale, manifest examples updated, migration procedure for existing RWO archives, pre-flight checklist updated

Test plan

• make test green locally for ./internal/task/... (the Error 1 from make test is a go-toolchain-version mismatch in my local env; the tests themselves all pass — ok internal/task 1.680s coverage: 46.1%)
• CI test+lint green
• Existing test TestEnsureDataPVC_Import_WrongAccessMode_Terminal still passes (verified locally — it now triggers because ReadOnlyMany doesn't include either RWO or RWOP)
• New test TestEnsureDataPVC_Import_ReadWriteOncePod_AccessMode_Completes passes (verified locally)

Follow-ups (separate PRs, in sei-protocol/platform)

• archive-1.yaml authored with RWOP from creation (eu-central-1a; pending fpsync completion)
• archive-2.yaml ships RWOP from creation (future, eu-central-1c)
• archive-0.yaml migration PR queued for next natural pod-restart event (next chain upgrade or image bump). Migration procedure documented in the updated runbook.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches controller-side validation for imported PVCs; a mistake could incorrectly accept/reject volumes and block node startup, though the change is small and covered by tests.

Overview
Allows imported data PVCs to satisfy the controller’s import validator with either ReadWriteOnce or ReadWriteOncePod (treated as acceptable single-writer modes), updating the terminal error message accordingly.

Adds a regression test ensuring an RWOP-only PV/PVC pair validates successfully, and updates the BYOV archive runbook to recommend RWOP by default, document SELinux mount-labeling performance implications, and provide a delete/recreate migration procedure plus checklist updates.

^{Reviewed by Cursor Bugbot for commit b85f8f7. Bugbot is set up for automated code reviews on this repo. Configure here.}