feat(noderesource): lock seid invocation on HOME env var

[bdchatham]

Summary

Single source of truth for the seid data directory across every seid-running container:

• container.env declares HOME=dataDir (and TMPDIR=dataDir/tmp)
• container.args use $(HOME) (K8s VariableReference) for the canonical seid start --home $(HOME)
• Bash-context paths (seid-init, sidecarWaitCommand) use "$HOME" (shell expansion) against the same env var

spec.Entrypoint is now silently ignored and marked Deprecated; the canonical invocation is injected unconditionally. The field stays in v1alpha1 for backwards compat — manifests don't need updates today — and is slated for removal in v1alpha2.

The failure mode this fixes

Smoke-testing #233 on harbor surfaced mkdir /.sei: permission denied from eth_accounts and a handful of other seid subcommands. Root cause: distroless base images don't carry an /etc/passwd entry for uid 65532, so HOME is unset for the seid process, and Cosmos SDK's ~/.sei default resolves to literal /.sei — on a read-only root filesystem.

Setting HOME at the container level closes that gap: every subcommand that consults os.UserHomeDir() / ~/.sei now sees dataDir, the same path --home is pointing at.

Why $(HOME) (with parens, not braces)

K8s defines two unrelated substitution mechanisms:

Where	Syntax	Expanded by
container.args[], container.command[], env.value	\$(VAR_NAME)	kubelet, before exec
Inside sh -c "<script>" or bash -c "<script>"	\$VAR or \${VAR}	shell, at runtime

The kubelet form uses parens to avoid collision with shell \$VAR — args[] entries are passed directly via execve with no shell in the loop. Ref: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#use-environment-variables-to-define-arguments.

Both codepaths in this PR ultimately resolve from the same HOME env var; only the substitution layer differs.

What this unlocks

The 3-PR sequence we're working toward:

1. This PR — every container references HOME, not a literal /sei. Behavior unchanged (still resolves to /sei).
2. PR 2 — remove spec.entrypoint from any manifest that still sets it (no-op since it's now ignored, but cleans up state).
3. PR 3 — flip platform.DataDir from /sei to the conventional Cosmos SDK layout (~/.sei / /.sei). Single-line change; every container picks it up via HOME. Blocked on Trigger NodeUpdate plan on pod template hash drift (not just spec.image) #235 (pod template hash drift detection).

Rollout — corrected

This is a pod-spec change with no image change. Two semantics matter:

• buildRunningPlan (internal/planner/planner.go:708) builds a NodeUpdate plan only when spec.image != status.currentImage. Env/args changes alone do not trigger a plan.
• StatefulSets use OnDelete update strategy (internal/noderesource/noderesource.go:204), so even if the StatefulSet template is patched, existing pods don't roll.

Net effect on existing chains:

• Pre-feat(noderesource): non-root seid + seid-init via kubelet fsGroup migration #233 chains (seid main container running as root): unaffected. HOME=/root is set by the kernel for uid 0, ~/.sei resolves to /root/.sei, everything works.
• Post-feat(noderesource): non-root seid + seid-init via kubelet fsGroup migration #233 chains (seid main container running as uid 65532 with feat(noderesource): non-root seid + seid-init via kubelet fsGroup migration #233's kubelet fsGroup): currently broken from the mkdir /.sei: permission denied bug. The new pod template includes the fix, but existing pods need a manual roll (kubectl delete pod or kubectl rollout restart sts) for the operator to pick it up. Same operator action as feat: SeiNode validator.operatorKeyring CRD surface (closes #219) #220 and feat(noderesource): non-root seid + seid-init via kubelet fsGroup migration #233 required.
• New SeiNodes created after the controller image bump: get the new template directly. No special handling.

Filed as #235 for the long-term fix: trigger NodeUpdate plans on pod template hash drift, not just spec.image drift. PR 3 is blocked on #235.

Cross-review (Coral trio)

• platform-engineer: approves; flagged the rollout-propagation property → Trigger NodeUpdate plan on pod template hash drift (not just spec.image) #235.
• kubernetes-specialist: approves; K8s VariableReference semantics confirmed, NodeUpdate task interaction clean.
• security-specialist: approves; net positive (closes the spec.Entrypoint arbitrary-binary primitive). Two follow-ups: Validate SeiNode.spec.chainId with a Pattern regex (shell injection sink in seid-init) #236 (ChainID injection — pre-existing, not widened), Audit snapshot uploader scope: dotfiles under dataDir now writable via HOME #237 (snapshot uploader scope — audit what tars from dataDir now that HOME points there).

All three follow-ups are non-blocking for this PR.

Test plan

• go build ./... clean
• go vet ./... clean
• gofmt -l . clean
• go test ./... green
• go test -race ./... green
• golangci-lint run --new-from-rev=origin/main clean
• make manifests generate — CRD doc updates reflect the deprecation
• Coral trio cross-review (platform-engineer + kubernetes-specialist + security-specialist)
• Smoke test on harbor after merge + controller bump: confirm eth_accounts resolves on a freshly-rolled SeiNode, no permission denied regressions — verified indirectly via HOME=/.sei env on rolled pods + zero permission denied errors in seid logs + chain producing blocks. Literal eth_accounts curl wasn't executed (seid bound port 8545 to a non-loopback address; port-forward returned connection refused). Fix is confirmed working in practice.

Follow-up issues filed

• Trigger NodeUpdate plan on pod template hash drift (not just spec.image) #235 — Trigger NodeUpdate plan on pod template hash drift (blocks PR 3)
• Validate SeiNode.spec.chainId with a Pattern regex (shell injection sink in seid-init) #236 — Validate SeiNode.spec.chainId with a Pattern regex (pre-existing injection sink)
• Audit snapshot uploader scope: dotfiles under dataDir now writable via HOME #237 — Audit snapshot uploader scope: dotfiles under dataDir now writable via HOME

🤖 Generated with Claude Code

[cursor]

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.