feat(node): track StatefulSet on Status, switch to typed Get+Update sync, pause scales to 0

[bdchatham]

Summary

Two changes paired:

1. Status-tracked StatefulSet, typed Get+Update sync. The SeiNode now carries Status.StatefulSet={Name, UID}. The controller and the apply-statefulset task both call noderesource.SyncStatefulSet, which fetches the live StatefulSet by name and either creates it, updates it field-by-field, or replaces it if an impostor (UID mismatch) is detected. Server-side apply is removed from this code path; the nolint flagging the deferred ApplyConfiguration migration goes away with it.
2. Pause-scales-to-zero on SeiNode. When Spec.Paused=true, the SeiNode controller's reconcileStatefulSet renders the desired STS with Replicas=0 and the typed Update lands. Pods stop. Unpause restores Replicas=1. The controller is the authoritative writer of replicas.

Architecture

SyncStatefulSet  (noderesource/sync.go)         ← single source of truth, typed
   │
   ├─ called by SeiNode controller's reconcileStatefulSet  ← also writes Status.StatefulSet
   │
   └─ called by apply-statefulset task                     ← still a plan sync point

Lifecycle paths

Live STS state	Status.StatefulSet	Action
Not found	nil	Create + record {Name, UID}
Found	nil	Adopt: record {Name, UID}, then mutate
Not found	set	Recreate + re-record (operator deleted manually)
Found, UID matches	set	Mutate if mutable fields diverge
Found, UID mismatch	set	Delete impostor + Create + re-record

Mutable fields covered

Spec.Replicas (the pause path), Spec.Template, Spec.UpdateStrategy, Spec.MinReadySeconds, Labels, Annotations. Immutable fields (Selector, ServiceName, VolumeClaimTemplates, PodManagementPolicy) are left alone so a deterministic-but-not-byte-identical render never trips the apiserver's immutability check.

Test plan

• go build ./... clean
• go test ./... — all unit tests pass
• make test-integration — envtest 55.9s green, no regression in existing rollout / supersession / stuck / pause tests
• New envtests in seinode_statefulset_test.go:
  • TestSeiNode_StatefulSetTrackedOnStatus — Status.StatefulSet={Name, UID} recorded after first reconcile
  • TestSeiNode_Paused_ScalesStatefulSetToZero — pause flips live STS to Replicas=0, unpause restores
  • TestSeiNode_StatefulSetRecreatedAfterDelete — operator-deleted STS is recreated, new UID re-tracked

Out of scope

• Removing the apply-statefulset plan task entirely. It still runs (now via the typed sync helper) and remains the plan executor's sync gate for replace-pod. Its eventual removal needs a replacement sync mechanism for the rollout plan; tracking separately.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes the SeiNode reconciliation path to continuously manage and sometimes delete/recreate the owned StatefulSet (including scaling replicas to 0 when paused), which can impact running workloads if identity tracking or impostor detection behaves unexpectedly.

Overview
SeiNode now records and relies on status.statefulSet ({name, uid}) to track the specific owned StatefulSet instance, and exposes it via a new kubectl printer column.

The node controller now syncs the StatefulSet on every reconcile via new noderesource.SyncStatefulSet, including impostor detection (UID mismatch triggers delete-then-recreate across reconciles) and stamping the resulting identity back onto status; the apply-statefulset plan task is updated to use the same helper.

spec.paused behavior changes to a hard pause: reconciliation still updates the owned StatefulSet and forces replicas=0 so pods terminate, then restores replicas when unpaused. CRDs/manifests and deepcopy code are regenerated accordingly, and new unit/envtests cover tracking, pause scaling, and delete/impostor recovery.

^{Reviewed by Cursor Bugbot for commit dd2b4ba. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ae5aecc. Configure here.}

[cursor]

Impostor delete races with task creating orphaned StatefulSet

Medium Severity

When reconcileStatefulSet detects an impostor (UID mismatch), it deletes it and returns nil without updating Status.StatefulSet. The controller then continues into the plan executor. If the active task is apply-statefulset, it calls SyncStatefulSet again — this time the Get returns NotFound (impostor just deleted), so it falls through and creates a fresh StatefulSet. However, Status.StatefulSet still holds the original stale UID (only the controller's reconcileStatefulSet stamps it, and it skipped that on nil). On the next reconcile, the controller sees the task-created StatefulSet as another impostor and deletes it, causing unnecessary churn and a brief pod outage.

Additional Locations (2)

• internal/controller/node/controller.go#L114-L117
• internal/task/apply_statefulset.go#L56-L63

 

^{Reviewed by Cursor Bugbot for commit ae5aecc. Configure here.}