Remove the Headlamp user-namespace mapping probe once its evidence is recorded

[devantler]

🤖 Generated by the Agentic Engineer

Why

#2857 adds a disposable Job (k8s/providers/hetzner/apps/userns-headlamp-mapping-probe/) that measures the subordinate UID/GID mapping a user-namespaced pod receives in the headlamp namespace, closing the last open acceptance criterion of #2651.

It is deliberately temporary. Filing its removal at the same time it is born, so it cannot quietly become a permanent completed Job sitting in the apps overlay — the same lifecycle discipline the platform applies to release flags.

What

Once the completed Job's logs are recorded on #2651:

• Remove the userns-headlamp-mapping-probe/ resource entry from k8s/providers/hetzner/apps/kustomization.yaml, including its explanatory comment block.
• Delete the k8s/providers/hetzner/apps/userns-headlamp-mapping-probe/ component.
• Confirm Flux prunes the Job from the headlamp namespace, and that Headlamp itself is untouched — still Available 1/1, pod 2/2 Ready, same PVC bound.

Not yet actionable

Blocked until #2857 merges, the merge-queue deploy runs the Job, and its output is on #2651. Removing it before that discards the measurement it exists to take.

[coderabbitai]

🔗 Related PRs

#2488 - feat(tenants): prune-protect the ascoachingogvaner skeleton for the KRO handover [merged]
#2620 - test(storage): restore userns smoke harness default-off [merged]
#2652 - feat(headlamp): add default-off user namespace gate [merged]
#2793 - feat(cilium): activate homogeneous device selection [merged]
#2842 - feat(headlamp): run inside a user namespace [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

The probe is now active — and this checklist is one step short of leaving CI green

#2958 uncomments the component, so the next merge-queue deploy runs the Job and produces the criterion-5 reading. Once that log is on #2651, this issue is unblocked.

Before it is worked, though: removing only the component and its resource entry reds the build. The probe has a test suite (scripts/tests/test-userns-headlamp-mapping-probe.sh) that extracts the script from the shipped manifest rather than copying it, so the manifest is a hard dependency. Measured just now by deleting the component in a worktree and running the suite:

exit=1
::error::probe manifest not found at …/userns-headlamp-mapping-probe/job.yaml

It fails closed with a clear message — that is the suite behaving correctly, not a defect — but it is a red required check on whichever PR does the cleanup.

The suite is also wired into ci.yaml in two places that outlive the component: the 🔬 Validate the user-namespace mapping probe step in the validate job, and two k8s filter path entries (k8s/providers/hetzner/apps/userns-headlamp-mapping-probe/** and the test path itself).

Suggested additions to the What list

• Delete scripts/tests/test-userns-headlamp-mapping-probe.sh.
• Remove the 🔬 Validate the user-namespace mapping probe step from the validate job in .github/workflows/ci.yaml.
• Remove the two probe path entries from the k8s filter in the same workflow.

One more thing to know when you get here: #2958 inverts the suite's staged-component arm to assert the probe is active, so during the cleanup that arm is expected to fail — it disappears with the file rather than needing to be flipped back.