underpost 3.2.80 → 3.3.0

package/src/cli/cluster.js

@@ -4,9 +4,26 @@
  * @namespace UnderpostCluster
  */
 
-import { getNpmRootPath } from '../server/conf.js';
+import { clusterTypeFactory, gatewayApiEnabledFactory, resolveReplicaCount } from '../server/conf.js';
+import { getNpmRootPath, HOST_VOLUME_ROOT } from '../server/environment.js';
 import { loggerFactory } from '../server/logger.js';
 import { shellExec } from '../server/process.js';
+import { crictlCommandFactory, resolveCriSocket } from '../server/cri.js';
+import {
+  runSELinuxCommands,
+  selinuxContainerSharedContextCommandsFactory,
+  selinuxEnforcingCommandsFactory,
+  selinuxPackagesCommandFactory,
+  selinuxRestoreconCommandFactory,
+} from '../server/selinux.js';
+import { UNDERPOST_GATEWAY, seedDefaultStatusPage } from '../server/underpost-gateway.js';
+import {
+  UNDERPOST_INGRESS,
+  gatewayBackendFactory,
+  underpostIngressConfFactory,
+  underpostIngressHostMapFactory,
+  underpostIngressManifestsFactory,
+} from '../server/underpost-ingress.js';
 import { MONGODB_DEFAULT_REPLICA_COUNT } from '../db/mongo/MongooseDB.js';
 import { MongoBootstrap } from '../db/mongo/MongoBootstrap.js';
 import os from 'os';
@@ -15,6 +32,32 @@ import Underpost from '../index.js';
 
 const logger = loggerFactory(import.meta);
 
+const GATEWAY_API_RELEASE = 'v1.5.1';
+const ENVOY_GATEWAY_VERSION = 'v1.8.3';
+const CONTOUR_NAMESPACE = 'projectcontour';
+const KUBEADM_CONTAINER_MOUNT_PATHS = ['/etc/kubernetes', '/var/lib/etcd', '/var/lib/calico'];
+const HOST_VOLUME_PATHS = ['/data', '/opt/local-path-provisioner', HOST_VOLUME_ROOT];
+const K3S_SELINUX_PATHS = [
+  '/usr/local/bin/k3s',
+  '/etc/rancher',
+  '/var/lib/rancher',
+  '/var/lib/kubelet',
+  '/var/lib/cni',
+];
+
+const shareWithContainers = (paths = []) => {
+  for (const path of paths) shellExec(`sudo mkdir -p ${path}`);
+  runSELinuxCommands(selinuxContainerSharedContextCommandsFactory(paths), { execute: shellExec });
+};
+
+const enforceSELinux = (paths = []) => {
+  shellExec(
+    `if [ -f /etc/redhat-release ] && command -v dnf >/dev/null 2>&1 && { ! command -v restorecon >/dev/null 2>&1 || ! command -v semanage >/dev/null 2>&1; }; then ${selinuxPackagesCommandFactory()}; fi`,
+  );
+  const commands = selinuxEnforcingCommandsFactory({ restorePaths: paths });
+  runSELinuxCommands(commands, { execute: shellExec });
+};
+
 /**
  * @class UnderpostCluster
  * @description Manages Kubernetes cluster initialization, configuration, and component deployment.
@@ -41,9 +84,11 @@ class UnderpostCluster {
      * @param {boolean} [options.ipfs=false] - Deploy ipfs-cluster statefulset.
      * @param {boolean} [options.info=false] - Display extensive Kubernetes cluster information.
      * @param {boolean} [options.certManager=false] - Deploy Cert-Manager for certificate management.
+     * @param {boolean} [options.gatewayApi=false] - Install the Gateway API control plane (CRDs, Envoy Gateway, and the GatewayClass generated Gateways attach to). Exposure follows the environment: host network in `--dev`, NodePort otherwise.
+     * @param {string} [options.gatewayClass=''] - GatewayClass name to provision; must match the one baked into generated manifests.
      * @param {boolean} [options.listPods=false] - List Kubernetes pods.
      * @param {boolean} [options.reset=false] - Perform a comprehensive reset of Kubernetes and container environments.
-     * @param {boolean} [options.resetMongodb=false] - Perform a targeted reset of MongoDB components without restarting the entire cluster.
+     * @param {boolean} [options.resetMongodb=false] - Perform a targeted reset of MongoDB components without restarting the entire cluster. Combined with `--mongodb` it instead wipes the retained volumes as part of that deploy.
      * @param {boolean} [options.dev=false] - Run in development mode (adjusts paths).
      * @param {string} [options.nsUse=''] - Set the current kubectl namespace (creates namespace if it doesn't exist).
      * @param {string} [options.namespace='default'] - Kubernetes namespace for cluster operations.
@@ -118,7 +163,7 @@ class UnderpostCluster {
 
       if (options.config) return options.k3s ? Underpost.cluster.configMinimalK3s() : Underpost.cluster.config();
 
-      if (options.chown) return Underpost.cluster.chown(options.k3s ? 'k3s' : options.kubeadm ? 'kubeadm' : 'kind');
+      if (options.chown) return Underpost.cluster.chown(clusterTypeFactory(options));
 
       const npmRoot = getNpmRootPath();
       const underpostRoot = options.dev ? '.' : `${npmRoot}/underpost`;
@@ -165,9 +210,13 @@ class UnderpostCluster {
         });
       }
 
-      // Targeted MongoDB-only reset (does not restart the whole node)
-      if (options.resetMongodb) {
-        const clusterType = options.k3s ? 'k3s' : options.kubeadm ? 'kubeadm' : 'kind';
+      // Targeted MongoDB-only reset (does not restart the whole node). Combined
+      // with --mongodb it is a modifier instead: the deploy below wipes the
+      // retained volumes before rolling the StatefulSet out. `--reset` cannot
+      // serve that purpose — it short-circuits into the whole-node reset above,
+      // which is why `initReplicaSet`'s reset branch was unreachable from the CLI.
+      if (options.resetMongodb && !options.mongodb) {
+        const clusterType = clusterTypeFactory(options);
         return await MongoBootstrap.reset({
           namespace: options.namespace,
           clusterType,
@@ -200,8 +249,11 @@ class UnderpostCluster {
           // balancer. The platform exposes services explicitly via Project
           // Contour / Envoy and NodePort services (see --node-port); leaving the
           // K3s built-ins enabled would bind the same host ports and conflict.
-          shellExec(`curl -sfL https://get.k3s.io | sh -s - --disable=traefik --disable=servicelb`);
+          shellExec(
+            `curl -sfL https://get.k3s.io | sh -s - $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi) --disable=traefik --disable=servicelb`,
+          );
           logger.info('K3s installation completed.');
+          runSELinuxCommands([selinuxRestoreconCommandFactory(K3S_SELINUX_PATHS)], { execute: shellExec });
 
           Underpost.cluster.chown('k3s');
 
@@ -213,22 +265,15 @@ class UnderpostCluster {
         } else if (options.kubeadm) {
           Underpost.cluster.config();
           Underpost.cluster.natSetup({ underpostRoot });
+          shareWithContainers([...KUBEADM_CONTAINER_MOUNT_PATHS, ...HOST_VOLUME_PATHS]);
           logger.info('Initializing Kubeadm control plane...');
           // Set default values if not provided
           const podNetworkCidr = options.podNetworkCidr || '192.168.0.0/16';
           const controlPlaneEndpoint = options.controlPlaneEndpoint || `${os.hostname()}:6443`;
 
-          // Initialize kubeadm control plane.
-          // Use CRI-O socket when available, otherwise fall back to containerd.
-          const crioSocket = 'unix:///var/run/crio/crio.sock';
-          const containerdSocket = 'unix:///run/containerd/containerd.sock';
-          const criSocket =
-            shellExec(`test -S /var/run/crio/crio.sock && echo crio || echo containerd`, {
-              stdout: true,
-              silent: true,
-            }).trim() === 'crio'
-              ? crioSocket
-              : containerdSocket;
+          // Initialize kubeadm control plane against whichever CRI runtime the
+          // host actually exposes.
+          const criSocket = resolveCriSocket(options);
           shellExec(
             `sudo kubeadm init --pod-network-cidr=${podNetworkCidr} --control-plane-endpoint="${controlPlaneEndpoint}" --cri-socket=${criSocket}`,
           );
@@ -253,12 +298,19 @@ class UnderpostCluster {
           shellExec(
             `kubectl apply -f https://cdn.jsdelivr.net/gh/rancher/local-path-provisioner@master/deploy/local-path-storage.yaml`,
           );
+
+          // The CNI lands asynchronously, and the node stays NotReady until it
+          // does. Block here so the deploy steps that follow (MongoDB and the
+          // application workloads) schedule onto a node that can actually run
+          // them, instead of racing the Calico rollout.
+          logger.info('Waiting for the node to become Ready (Calico rollout)...');
+          shellExec(`kubectl wait --for=condition=Ready node --all --timeout=300s`);
         } else {
           Underpost.cluster.config();
           Underpost.cluster.natSetup({ underpostRoot });
           // Kind cluster initialization (default for development)
           logger.info('Initializing Kind cluster...');
-          const devReplicaCount = Math.max(Number(options.replicas) || MONGODB_DEFAULT_REPLICA_COUNT, 3);
+          const devReplicaCount = resolveReplicaCount(options.replicas, MONGODB_DEFAULT_REPLICA_COUNT);
           shellExec(`sudo mkdir -p /data/mongodb`);
           for (let index = 0; index < devReplicaCount; index++) {
             shellExec(`sudo mkdir -p /data/mongodb/v${index}`);
@@ -310,7 +362,7 @@ class UnderpostCluster {
           .readFileSync(`${underpostRoot}/manifests/grafana/deployment.yaml`, 'utf8')
           .replace('{{GF_SERVER_ROOT_URL}}', options.hosts.split(',')[0])}`;
         console.log(yaml);
-        shellExec(`kubectl apply -f - -n ${options.namespace} <<EOF
+        shellExec(`kubectl apply -f - -n ${options.namespace} <<'EOF'
 ${yaml}
 EOF
 `);
@@ -329,7 +381,7 @@ EOF
             .join(',')}]`,
         )}`;
         console.log(yaml);
-        shellExec(`kubectl apply -f - -n ${options.namespace} <<EOF
+        shellExec(`kubectl apply -f - -n ${options.namespace} <<'EOF'
 ${yaml}
 EOF
 `);
@@ -361,9 +413,14 @@ EOF
         await Underpost.ipfs.deploy(options, underpostRoot);
       }
       if (options.mariadb) {
-        shellExec(
-          `sudo kubectl create secret generic mariadb-secret --from-file=username=/home/dd/engine/engine-private/mariadb-username --from-file=password=/home/dd/engine/engine-private/mariadb-password --dry-run=client -o yaml | kubectl apply -f - -n ${options.namespace}`,
-        );
+        // Secrets before workloads: the StatefulSet's secretKeyRef must resolve at pod admission.
+        // Encrypted store first; when no manifest exists the secret is seeded from its origin
+        // seed path below. A manifest that exists but fails validation raises rather than
+        // silently seeding stale credentials.
+        if (!Underpost.secret.sops.applyIfPresent('mariadb-secret', options.namespace))
+          shellExec(
+            `sudo kubectl create secret generic mariadb-secret --from-file=username=/home/dd/engine/engine-private/mariadb-username --from-file=password=/home/dd/engine/engine-private/mariadb-password --dry-run=client -o yaml | kubectl apply -f - -n ${options.namespace}`,
+          );
         shellExec(`kubectl delete statefulset mariadb-statefulset -n ${options.namespace} --ignore-not-found`);
 
         if (options.pullImage) Underpost.cluster.pullImage('mariadb:latest', options);
@@ -371,9 +428,10 @@ EOF
         shellExec(`kubectl apply -k ${underpostRoot}/manifests/mariadb -n ${options.namespace}`);
       }
       if (options.mysql) {
-        shellExec(
-          `sudo kubectl create secret generic mysql-secret --from-file=username=/home/dd/engine/engine-private/mysql-username --from-file=password=/home/dd/engine/engine-private/mysql-password --dry-run=client -o yaml | kubectl apply -f - -n ${options.namespace}`,
-        );
+        if (!Underpost.secret.sops.applyIfPresent('mysql-secret', options.namespace))
+          shellExec(
+            `sudo kubectl create secret generic mysql-secret --from-file=username=/home/dd/engine/engine-private/mysql-username --from-file=password=/home/dd/engine/engine-private/mysql-password --dry-run=client -o yaml | kubectl apply -f - -n ${options.namespace}`,
+          );
         shellExec(`sudo mkdir -p /mnt/data`);
         shellExec(`sudo chmod 777 /mnt/data`);
         shellExec(`sudo chown -R $(whoami):$(whoami) /mnt/data`);
@@ -381,9 +439,10 @@ EOF
       }
       if (options.postgresql) {
         if (options.pullImage) Underpost.cluster.pullImage('postgres:latest', options);
-        shellExec(
-          `sudo kubectl create secret generic postgres-secret --from-file=password=/home/dd/engine/engine-private/postgresql-password --dry-run=client -o yaml | kubectl apply -f - -n ${options.namespace}`,
-        );
+        if (!Underpost.secret.sops.applyIfPresent('postgres-secret', options.namespace))
+          shellExec(
+            `sudo kubectl create secret generic postgres-secret --from-file=password=/home/dd/engine/engine-private/postgresql-password --dry-run=client -o yaml | kubectl apply -f - -n ${options.namespace}`,
+          );
         shellExec(`kubectl apply -k ${underpostRoot}/manifests/postgresql -n ${options.namespace}`);
       }
       if (options.mongodb4) {
@@ -441,13 +500,13 @@ EOF
             });
         }
       } else if (options.mongodb) {
-        const clusterType = options.k3s ? 'k3s' : options.kubeadm ? 'kubeadm' : 'kind';
+        const clusterType = clusterTypeFactory(options);
         await MongoBootstrap.initReplicaSet({
           namespace: options.namespace,
-          replicaCount: Number(options.replicas) || MONGODB_DEFAULT_REPLICA_COUNT,
+          replicaCount: resolveReplicaCount(options.replicas, MONGODB_DEFAULT_REPLICA_COUNT),
           hostList: serviceHostInput,
           pullImage: options.pullImage,
-          reset: options.reset,
+          reset: options.resetMongodb === true,
           clusterType,
           underpostRoot,
         });
@@ -459,20 +518,160 @@ EOF
           });
       }
 
+      // Installing one stack must never break the other. Whichever is already
+      // present decides whether this install takes the node's 80/443 for itself
+      // or joins the underpost ingress, so it is read before anything is applied.
+      const ingressPresence = Underpost.cluster.ingressStackPresence();
+      const sharedIngress =
+        (options.contour && ingressPresence.gateway) || (options.gatewayApi && ingressPresence.contour);
+
       if (options.contour) {
         shellExec(
           `kubectl apply -f https://cdn.jsdelivr.net/gh/projectcontour/contour@release-1.33/examples/render/contour.yaml`,
         );
+        // The NodePort patch belongs to Contour's own namespace: its `app=envoy`
+        // selector only matches the Envoy DaemonSet there. Applied anywhere else
+        // the Service is born with no endpoints, and kube-proxy then answers
+        // EVERY connection to its ports with an ICMP port-unreachable REJECT —
+        // including 443 on every local address, which silently breaks whatever
+        // else serves HTTPS on the node.
+        Underpost.cluster.pruneEndpointlessService({ name: 'envoy', namespace: options.namespace });
+        // Contour's render always claims hostPort 80/443. Left in place beside a
+        // Gateway API data plane it would DNAT every packet away from it, so the
+        // claim is released and both are reached through the underpost ingress instead.
+        if (sharedIngress)
+          Underpost.cluster.releaseHostPortClaim({ name: 'envoy', namespace: CONTOUR_NAMESPACE, ports: [80, 443] });
         if (options.kubeadm) {
           // Envoy service might need NodePort for kubeadm
           shellExec(
-            `sudo kubectl apply -f ${underpostRoot}/manifests/envoy-service-nodeport.yaml -n ${options.namespace}`,
+            `sudo kubectl apply -f ${underpostRoot}/manifests/envoy-service-nodeport.yaml -n ${CONTOUR_NAMESPACE}`,
           );
         }
         // K3s has a built-in LoadBalancer (Klipper-lb) that can expose services,
         // so a specific NodePort service might not be needed or can be configured differently.
       }
 
+      if (options.gatewayApi) {
+        // Gateway API stack: the CRDs, the implementation that serves them, and
+        // the GatewayClass every generated Gateway attaches to. Envoy Gateway is
+        // the implementation because the manifests this repo generates use two of
+        // its ClientTrafficPolicy extension, which carries the QUIC/HTTP3
+        // listener config. Both versions are pinned so a rebuild provisions the
+        // same control plane.
+        const env = options.dev ? 'development' : 'production';
+        // Envoy Gateway provisions and owns its own data plane Service in
+        // envoy-gateway-system. Any hand-managed Service elsewhere that publishes
+        // the same ports without endpoints would have kube-proxy reject 80/443
+        // out from under it, and any DaemonSet holding hostPort 80/443 would
+        // swallow the traffic before the data plane's listener sees it.
+        Underpost.cluster.pruneEndpointlessService({ name: 'envoy', namespace: options.namespace });
+        // Contour keeps serving beside this stack when it is already installed —
+        // it only gives up the node's ports, which the underpost ingress takes over.
+        // With no Contour present the claim is removed outright, since a leftover
+        // DaemonSet from an uninstalled stack has nothing left to serve.
+        if (sharedIngress)
+          Underpost.cluster.releaseHostPortClaim({ name: 'envoy', namespace: CONTOUR_NAMESPACE, ports: [80, 443] });
+        else Underpost.cluster.pruneHostPortClaim({ name: 'envoy', namespace: CONTOUR_NAMESPACE, ports: [80, 443] });
+        shellExec(
+          `kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/${GATEWAY_API_RELEASE}/standard-install.yaml`,
+        );
+        shellExec(
+          `helm upgrade --install eg oci://docker.io/envoyproxy/gateway-helm --version ${ENVOY_GATEWAY_VERSION} ` +
+            `--namespace envoy-gateway-system --create-namespace`,
+        );
+        // The GatewayClass is rejected while the webhook is still coming up.
+        shellExec(
+          `kubectl wait --namespace envoy-gateway-system --for=condition=Available --timeout=5m deployment/envoy-gateway`,
+          { silentOnError: true },
+        );
+        // Validate against the live CRD schema before creating anything. These
+        // are vendor CRDs whose optional fields move between releases, and
+        // kubectl applies documents independently: without the pre-flight, a
+        // field the installed Envoy Gateway does not know leaves a GatewayClass
+        // pointing at an EnvoyProxy that never applied.
+        const gatewayClassYaml = Underpost.deploy.gatewayClassYamlFactory({
+          env,
+          options: { ...options, sharedIngress },
+        });
+        shellExec(`kubectl apply --dry-run=server -f - <<'EOF'
+${gatewayClassYaml}
+EOF
+`);
+        shellExec(`kubectl apply -f - <<'EOF'
+${gatewayClassYaml}
+EOF
+`);
+        // The static utility that serves status pages and intercepted contexts.
+        // It belongs to the gateway tier, not to any one deploy: a single Nginx
+        // holds every host's documents, and routes reach it as an ordinary
+        // backend — which is what removes the 4096-byte direct-response ceiling.
+        //
+        // The heredoc delimiter is quoted, as it must be for every generated
+        // manifest: the values are already substituted by the template literal,
+        // so anything the shell expands here is content. This one carries
+        // `nginx.conf`, whose `$uri` an unquoted delimiter deletes — leaving a
+        // `try_files` that matches nothing and answers every host's status page
+        // with the shared default.
+        const underpostGatewayYaml = Underpost.deploy.underpostGatewayYamlFactory(options);
+        shellExec(`kubectl apply -f - -n ${options.namespace} <<'EOF'
+${underpostGatewayYaml}
+EOF
+`);
+        const underpostGatewayRoot = Underpost.deploy.underpostGatewayRootFactory(options);
+        seedDefaultStatusPage(underpostGatewayRoot);
+        logger.info('Gateway static utility applied', {
+          name: UNDERPOST_GATEWAY.name,
+          root: underpostGatewayRoot,
+        });
+
+        logger.info('Gateway API control plane installed', {
+          gatewayApiRelease: GATEWAY_API_RELEASE,
+          envoyGateway: ENVOY_GATEWAY_VERSION,
+          gatewayClass: Underpost.deploy.gatewayApiConfigFactory(options).gatewayClassName,
+          env,
+        });
+      }
+
+      // Both stacks are now installed, so the node's 80/443 belong to neither of
+      // them. Contour was installed first and Envoy Gateway is arriving, or the
+      // reverse — either way this is the point where the underpost ingress has to exist,
+      // and the data plane that just came up has to stop binding the host.
+      if (sharedIngress) {
+        if (options.contour && ingressPresence.gateway) {
+          // `--contour` against a cluster that already runs Envoy Gateway: its
+          // data plane is still on the host network from a single-stack install,
+          // so the EnvoyProxy is re-applied to move it behind the underpost ingress.
+          const gatewayClassYaml = Underpost.deploy.gatewayClassYamlFactory({
+            env: options.dev ? 'development' : 'production',
+            options: { ...options, sharedIngress: true },
+          });
+          shellExec(`kubectl apply -f - <<'EOF'
+${gatewayClassYaml}
+EOF
+`);
+          shellExec(`kubectl rollout status deployment/envoy-gateway -n envoy-gateway-system --timeout=5m`, {
+            silentOnError: true,
+          });
+        }
+        // The edge binds the node directly, so it can only come up once both data
+        // planes have actually let go — not merely once their templates say so.
+        if (!Underpost.cluster.awaitHostPortsFree({ ports: [80, 443] })) {
+          logger.error('Skipping the underpost ingress: it would not be able to bind the node ports', {
+            hint: 'resolve the holder above, then re-run this command',
+          });
+        } else {
+          Underpost.cluster.installUnderpostIngress({ namespace: options.namespace, options });
+          shellExec(
+            `kubectl rollout status deployment/${UNDERPOST_INGRESS.name} -n ${options.namespace} --timeout=3m`,
+            { silentOnError: true },
+          );
+          logger.info('Both ingress stacks are live behind the underpost ingress', {
+            ingress: UNDERPOST_INGRESS.name,
+            note: 'HTTP/3 is served only by the Gateway API data plane; see the underpost-ingress module',
+          });
+        }
+      }
+
       if (options.certManager) {
         if (!Underpost.kubectl.get('cert-manager').find((p) => p.STATUS === 'Running')) {
           shellExec(`helm repo add jetstack https://charts.jetstack.io --force-update`);
@@ -637,27 +836,540 @@ EOF
           `for node in $(kind get nodes); do cat ${tarPath} | docker exec -i $node ctr --namespace=k8s.io images import -; done`,
         );
         shellExec(`rm -f ${tarPath}`);
-      } else if (options.k3s) {
-        // K3s uses its own embedded containerd socket, not the host-level one
-        // used by kubeadm/containerd installations.
-        shellExec(
-          `sudo env PATH="$PATH:/usr/local/bin:/usr/bin" crictl --runtime-endpoint unix:///run/k3s/containerd/containerd.sock pull ${image}`,
+      } else {
+        // Kubeadm / K3s: pull directly into the active CRI runtime.
+        shellExec(crictlCommandFactory(`pull ${image}`, options));
+      }
+    },
+
+    /**
+     * @method pruneHostPortClaim
+     * @description Removes a DaemonSet that reserves node ports the caller needs.
+     * A `hostPort` is not a soft claim: the CNI hostport plugin installs a DNAT
+     * that rewrites every packet arriving on that port to the claiming pod,
+     * ahead of any process listening on the node. A second ingress stack bound
+     * to the same port therefore never sees a single packet, and the symptom is
+     * a connection refused by the *other* stack — with nothing in its own logs.
+     *
+     * Only a DaemonSet that actually claims one of `ports` is removed.
+     * @param {string} name - DaemonSet name.
+     * @param {string} namespace - Namespace to inspect.
+     * @param {Array<number>} ports - Host ports the caller requires.
+     * @returns {boolean} True when a DaemonSet was pruned.
+     * @memberof UnderpostCluster
+     */
+    pruneHostPortClaim({ name, namespace, ports = [80, 443] }) {
+      const claimed = shellExec(
+        `kubectl get daemonset ${name} -n ${namespace} ` +
+          `-o jsonpath='{.spec.template.spec.containers[*].ports[*].hostPort}'`,
+        { stdout: true, silent: true, silentOnError: true },
+      );
+      const claimedPorts = `${claimed || ''}`
+        .split(/\s+/)
+        .map((port) => parseInt(port, 10))
+        .filter((port) => !isNaN(port));
+      const conflicts = claimedPorts.filter((port) => ports.includes(port));
+      if (conflicts.length === 0) return false;
+      logger.warn(`Pruning DaemonSet ${namespace}/${name}: it reserves host ports needed by this ingress stack`, {
+        conflicts,
+        reason: 'the CNI hostport DNAT redirects those ports before any node listener receives them',
+      });
+      shellExec(`kubectl delete daemonset ${name} -n ${namespace} --ignore-not-found`);
+      return true;
+    },
+
+    /**
+     * @method releaseHostPortClaim
+     * @description Strips a DaemonSet's `hostPort` claims without removing the
+     * workload, so it keeps serving through its ClusterIP.
+     *
+     * The non-destructive half of {@link UnderpostCluster.pruneHostPortClaim}.
+     * Deleting the DaemonSet is right when one stack replaces the other, and
+     * wrong when both are meant to stay: here the data plane is still wanted,
+     * it just must not hold the node's ports any more — the underpost ingress does.
+     *
+     * Applied as a JSON Patch, one `remove` op per claiming port. A
+     * strategic-merge patch cannot express this: `ports` is a list merged by
+     * `containerPort`, so a patch that simply omits `hostPort` merges into the
+     * existing element and leaves the claim exactly where it was — reported as
+     * `patched (no change)` while the port stays held. Removing an object field
+     * does not shift array indices, so every op in one patch stays valid.
+     * @param {string} name - DaemonSet name.
+     * @param {string} namespace - Namespace to inspect.
+     * @param {Array<number>} [ports] - Host ports to release.
+     * @returns {boolean} True when the claim is gone afterwards.
+     * @memberof UnderpostCluster
+     */
+    releaseHostPortClaim({ name, namespace, ports = [80, 443] }) {
+      const readClaims = () => {
+        const raw = shellExec(
+          `kubectl get daemonset ${name} -n ${namespace} -o jsonpath='{.spec.template.spec.containers}'`,
+          { stdout: true, silent: true, silentOnError: true },
         );
-      } else if (options.kubeadm) {
-        // Kubeadm / K3s: use crictl to pull directly into the active CRI runtime.
-        // crictl is not in sudo's secure_path; pass full PATH through env.
-        // Point crictl at CRI-O when the socket exists, otherwise fall back to containerd.
-        const criSock =
-          shellExec(`test -S /var/run/crio/crio.sock && echo crio || echo containerd`, {
+        try {
+          const containers = JSON.parse(`${raw || ''}`);
+          return Array.isArray(containers) ? containers : null;
+        } catch {
+          return null;
+        }
+      };
+
+      const containers = readClaims();
+      if (!containers) return false;
+      const operations = [];
+      containers.forEach((container, containerIndex) =>
+        (container.ports || []).forEach((port, portIndex) => {
+          if (port.hostPort === undefined || !ports.includes(port.hostPort)) return;
+          operations.push({
+            op: 'remove',
+            path: `/spec/template/spec/containers/${containerIndex}/ports/${portIndex}/hostPort`,
+          });
+        }),
+      );
+      if (operations.length === 0) return false;
+
+      logger.warn(`Releasing host ports on DaemonSet ${namespace}/${name}: the underpost ingress owns them now`, {
+        ports,
+        reason:
+          'its ClusterIP keeps the data plane reachable, and the hostPort DNAT would outrank the underpost ingress listener',
+      });
+      shellExec(`kubectl patch daemonset ${name} -n ${namespace} --type=json -p '${JSON.stringify(operations)}'`);
+
+      // Verified rather than assumed: this silently did nothing once already,
+      // and the failure only surfaced later as an unschedulable edge.
+      const remaining = (readClaims() || [])
+        .flatMap((container) => container.ports || [])
+        .filter((port) => ports.includes(port.hostPort));
+      if (remaining.length > 0) {
+        logger.error(`Failed to release host ports on DaemonSet ${namespace}/${name}`, {
+          stillClaimed: remaining.map((port) => port.hostPort),
+        });
+        return false;
+      }
+      shellExec(`kubectl rollout status daemonset/${name} -n ${namespace} --timeout=3m`, { silentOnError: true });
+      return true;
+    },
+
+    /**
+     * @method awaitHostPortsFree
+     * @description Blocks until no known ingress data plane still holds the node's ports.
+     *
+     * Releasing a claim edits a template; the pod holding the socket goes away
+     * only once the rollout completes. Applying the edge before that leaves it
+     * either unschedulable or crash-looping on `bind() … Address in use`, and
+     * neither failure names the pod that is actually holding the port.
+     * @param {Array<number>} [ports] - Host ports that must be free.
+     * @param {string} [contourNamespace] - Namespace holding Contour.
+     * @param {number} [timeoutMs] - How long to wait.
+     * @returns {boolean} True once nothing claims them.
+     * @memberof UnderpostCluster
+     */
+    awaitHostPortsFree({ ports = [80, 443], contourNamespace = CONTOUR_NAMESPACE, timeoutMs = 3 * 60 * 1000 } = {}) {
+      const deadline = Date.now() + timeoutMs;
+      const holders = () => {
+        const found = [];
+        const contourPorts = `${
+          shellExec(
+            `kubectl get daemonset envoy -n ${contourNamespace} ` +
+              `-o jsonpath='{.spec.template.spec.containers[*].ports[*].hostPort}'`,
+            { stdout: true, silent: true, silentOnError: true },
+          ) || ''
+        }`
+          .split(/\s+/)
+          .map((port) => parseInt(port, 10))
+          .filter((port) => ports.includes(port));
+        if (contourPorts.length > 0) found.push(`${contourNamespace}/envoy hostPort ${contourPorts.join(',')}`);
+        // The Gateway API data plane takes the ports through the host network
+        // rather than a hostPort, so its claim is the network mode itself.
+        const gatewayHostNetwork = `${
+          shellExec(
+            `kubectl get deployment -n envoy-gateway-system -l app.kubernetes.io/name=envoy ` +
+              `-o jsonpath='{.items[*].spec.template.spec.hostNetwork}'`,
+            { stdout: true, silent: true, silentOnError: true },
+          ) || ''
+        }`.trim();
+        if (gatewayHostNetwork.includes('true')) found.push('envoy-gateway-system data plane hostNetwork');
+        return found;
+      };
+
+      let current = holders();
+      while (current.length > 0 && Date.now() < deadline) {
+        logger.info('Waiting for the node ports to be released', { ports, heldBy: current });
+        shellExec('sleep 5', { silent: true });
+        current = holders();
+      }
+      if (current.length > 0) {
+        logger.error('Node ports are still held; the underpost ingress cannot bind them', {
+          ports,
+          heldBy: current,
+        });
+        return false;
+      }
+      return true;
+    },
+
+    /**
+     * @method ingressStackPresence
+     * @description Which ingress data planes are installed right now.
+     *
+     * Read from the cluster rather than from the flags, because the whole point
+     * is to react to what a previous invocation left behind: `--contour` run
+     * against a cluster that already has Envoy Gateway has to behave differently
+     * from `--contour` on an empty one.
+     * @param {string} [contourNamespace] - Namespace holding Contour.
+     * @returns {{contour: boolean, gateway: boolean}} Presence of each stack.
+     * @memberof UnderpostCluster
+     */
+    ingressStackPresence(contourNamespace = CONTOUR_NAMESPACE) {
+      const exists = (cmd) =>
+        `${shellExec(cmd, { stdout: true, silent: true, silentOnError: true }) || ''}`.trim().length > 0;
+      return {
+        contour: exists(`kubectl get daemonset envoy -n ${contourNamespace} -o name`),
+        gateway: exists(`kubectl get deployment envoy-gateway -n envoy-gateway-system -o name`),
+      };
+    },
+
+    /**
+     * @method refreshUnderpostIngress
+     * @description Rebuilds the underpost ingress host table after routes change.
+     *
+     * The table maps each hostname to the data plane that has a route object for
+     * it, so it goes stale the moment a host is published — a hostname added
+     * after the last build falls through to the default backend, which is the
+     * *other* stack, and answers 404 for a workload that is running perfectly.
+     * Every path that publishes a route therefore ends here.
+     *
+     * A no-op when the ingress is not installed, which is the single-stack case:
+     * there is no table to keep, because the one data plane owns the ports.
+     * The rendered config is unchanged by a blue/green promotion — the table is
+     * host to stack, not host to colour — so an ordinary deploy re-applies the
+     * same bytes and nothing restarts.
+     * @param {string} [namespace] - Namespace holding the ingress.
+     * @param {object} [options] - Cluster options. `ingressNode` is the only
+     * placement override; application `node` / `nodeName` flags are ignored.
+     * @returns {boolean} True when the table was rebuilt.
+     * @memberof UnderpostCluster
+     */
+    refreshUnderpostIngress({ namespace = 'default', options = {} } = {}) {
+      const installed = `${
+        shellExec(`kubectl get deployment ${UNDERPOST_INGRESS.name} -n ${namespace} -o name`, {
+          stdout: true,
+          silent: true,
+          silentOnError: true,
+        }) || ''
+      }`.trim();
+      if (!installed) return false;
+      return Underpost.cluster.installUnderpostIngress({ namespace, options });
+    },
+
+    /**
+     * @method installUnderpostIngress
+     * @description Installs or refreshes the underpost ingress in front of both data planes.
+     *
+     * The host table is built from the route objects that actually exist, so a
+     * hostname reaches the stack that describes it no matter which flag was used
+     * last. Rebuilt on every call, which is what keeps it correct after routes
+     * move between stacks.
+     * @param {string} [namespace] - Namespace to deploy the underpost ingress into.
+     * @param {object} [options] - Cluster options. Use `ingressNode` to
+     * explicitly place or recover the public listener.
+     * @returns {boolean} True when the underpost ingress was applied.
+     * @memberof UnderpostCluster
+     */
+    installUnderpostIngress({ namespace = 'default', options = {} } = {}) {
+      const presence = Underpost.cluster.ingressStackPresence();
+      // Each kind names its hosts in its own field, so each is read with its own
+      // jsonpath rather than one expression that happens to tolerate the other's
+      // shape being absent.
+      const HOST_FIELD = { httpproxy: '.spec.virtualhost.fqdn', httproute: '.spec.hostnames[*]' };
+      const hostsOf = (kind) =>
+        `${
+          shellExec(`kubectl get ${kind} -A -o jsonpath='{range .items[*]}{${HOST_FIELD[kind]}}{" "}{end}'`, {
             stdout: true,
             silent: true,
-          }).trim() === 'crio'
-            ? 'unix:///var/run/crio/crio.sock'
-            : 'unix:///run/containerd/containerd.sock';
-        shellExec(`sudo env PATH="$PATH:/usr/local/bin:/usr/bin" crictl --runtime-endpoint ${criSock} pull ${image}`);
+            silentOnError: true,
+          }) || ''
+        }`
+          .split(/\s+/)
+          .map((host) => host.trim())
+          .filter(Boolean);
+
+      const backends = {};
+      if (presence.contour) backends.contour = UNDERPOST_INGRESS.backends.contour;
+      if (presence.gateway) {
+        // Envoy Gateway names its own data plane Service, so it is discovered
+        // rather than assumed; without it the underpost ingress would proxy to nothing.
+        const service = `${
+          shellExec(
+            `kubectl get svc -n envoy-gateway-system -l app.kubernetes.io/name=envoy -o jsonpath='{.items[0].metadata.name}'`,
+            { stdout: true, silent: true, silentOnError: true },
+          ) || ''
+        }`.trim();
+        if (service) backends.gateway = gatewayBackendFactory(service);
+        else logger.warn('Envoy Gateway is installed but has provisioned no data plane Service yet');
+      }
+      if (Object.keys(backends).length === 0) {
+        logger.warn('No ingress data plane installed; skipping the underpost ingress');
+        return false;
       }
+
+      const { entries, conflicts } = underpostIngressHostMapFactory({
+        contourHosts: presence.contour ? hostsOf('httpproxy') : [],
+        gatewayHosts: presence.gateway ? hostsOf('httproute') : [],
+        // During migration both route kinds deliberately coexist. Point the
+        // host at the destination stack before the old object is deleted; a
+        // fixed Gateway preference would create a 404 window when migrating in
+        // the opposite direction (Gateway API -> Contour).
+        preferred: gatewayApiEnabledFactory(options) ? 'gateway' : 'contour',
+      });
+      if (conflicts.length > 0)
+        logger.warn('Hosts described by both stacks; the destination stack wins until the old route is removed', {
+          conflicts,
+          destination: gatewayApiEnabledFactory(options) ? 'gateway' : 'contour',
+        });
+
+      const conf = underpostIngressConfFactory({
+        entries,
+        backends,
+        resolver: Underpost.deploy.clusterDnsFactory(),
+        defaultBackend: backends.gateway ? 'gateway' : 'contour',
+      });
+      const liveNode = `${
+        shellExec(
+          `kubectl get deployment ${UNDERPOST_INGRESS.name} -n ${namespace} ` +
+            `-o jsonpath='{.spec.template.spec.nodeSelector.kubernetes\\.io/hostname}'`,
+          { stdout: true, silent: true, silentOnError: true },
+        ) || ''
+      }`.trim();
+      // `node` and `nodeName` place application workloads. Reusing either here
+      // relocates the public listener during an ordinary deploy; with Recreate
+      // that first deletes the healthy edge and can leave the whole site on
+      // connection-refused if the destination cannot pull Nginx. Only the
+      // dedicated ingressNode option may move this workload. Every route-table
+      // refresh otherwise preserves the established edge node.
+      const requestedNode = options.ingressNode || '';
+      const chosenNode =
+        requestedNode ||
+        liveNode ||
+        Underpost.deploy.resolveDeployNode({
+          node: '',
+          kind: options.kind,
+          kubeadm: options.kubeadm,
+          k3s: options.k3s,
+          env: options.dev ? 'development' : 'production',
+        });
+      // The chosen name is a guess unless it came from `--ingress-node`: the
+      // cluster-type default reads `--dev` as kind, and `liveNode` re-reads
+      // whatever a previous run wrote. This workload is pinned by `nodeSelector`
+      // with `hostNetwork`, so a name no node carries does not degrade — the pod
+      // stays Pending and every rollout wait times out.
+      const { node: ingressNode, corrected } = Underpost.deploy.resolveSchedulableNode({ node: chosenNode });
+      if (corrected && requestedNode)
+        throw new Error(
+          `[underpost-ingress] --ingress-node ${requestedNode} is not a node in this cluster (schedulable: ${ingressNode})`,
+        );
+      if (corrected)
+        logger.warn('Ingress node does not exist in this cluster; using a schedulable node instead', {
+          chosen: chosenNode,
+          from: liveNode === chosenNode ? 'the live deployment' : 'the cluster-type default',
+          using: ingressNode,
+        });
+      const liveMount = `${
+        shellExec(
+          `kubectl get deployment ${UNDERPOST_INGRESS.name} -n ${namespace} ` +
+            `-o jsonpath='{.spec.template.spec.containers[0].volumeMounts[?(@.name=="nginx-conf")].mountPath}'`,
+          { stdout: true, silent: true, silentOnError: true },
+        ) || ''
+      }`.trim();
+      const liveReady = `${
+        shellExec(
+          `kubectl get deployment ${UNDERPOST_INGRESS.name} -n ${namespace} -o jsonpath='{.status.readyReplicas}'`,
+          { stdout: true, silent: true, silentOnError: true },
+        ) || ''
+      }`.trim();
+      const canHotReload = liveMount === '/etc/underpost-ingress' && parseInt(liveReady || '0', 10) > 0;
+      const changesNode = !!liveNode && ingressNode !== liveNode;
+      const execIngress = (command, execOptions = {}) =>
+        shellExec(`kubectl exec -n ${namespace} deploy/${UNDERPOST_INGRESS.name} -- ${command}`, execOptions);
+
+      if (changesNode) {
+        // Prove the destination can start the exact edge image before Recreate
+        // removes the listener that is serving now. This pod has no hostNetwork,
+        // so it cannot contend for 80/443. On an offline node, IfNotPresent uses
+        // the cache; a missing image fails here while the current edge remains.
+        const preflightPod = `${UNDERPOST_INGRESS.name}-image-preflight`;
+        shellExec(`kubectl delete pod ${preflightPod} -n ${namespace} --ignore-not-found`, {
+          silent: true,
+          silentOnError: true,
+        });
+        try {
+          shellExec(`kubectl apply -f - -n ${namespace} <<'EOF'
+apiVersion: v1
+kind: Pod
+metadata:
+  name: ${preflightPod}
+  namespace: ${namespace}
+spec:
+  restartPolicy: Never
+  nodeSelector:
+    kubernetes.io/hostname: ${ingressNode}
+  containers:
+    - name: nginx
+      image: ${UNDERPOST_INGRESS.image}
+      imagePullPolicy: IfNotPresent
+      command: ['/bin/sh', '-c', 'nginx -v && sleep 300']
+EOF
+`);
+          shellExec(`kubectl wait --for=condition=Ready pod/${preflightPod} -n ${namespace} --timeout=2m`, {
+            silent: true,
+          });
+        } finally {
+          shellExec(`kubectl delete pod ${preflightPod} -n ${namespace} --ignore-not-found`, {
+            silent: true,
+            silentOnError: true,
+          });
+        }
+      }
+      const liveConf = canHotReload
+        ? `${
+            execIngress('cat /tmp/nginx.conf', {
+              stdout: true,
+              silent: true,
+              silentOnError: true,
+            }) || ''
+          }`
+        : '';
+      const shouldHotReload = canHotReload && liveConf.trimEnd() !== `${conf}`.trimEnd();
+
+      if (shouldHotReload) {
+        // Validate the exact candidate before either the running master or the
+        // persisted ConfigMap sees it. The quoted heredoc preserves every Nginx
+        // variable and keeps a malformed host table from reaching the edge.
+        shellExec(`kubectl exec -i -n ${namespace} deploy/${UNDERPOST_INGRESS.name} -- sh -c 'cat > /tmp/nginx.candidate.conf' <<'EOF'
+${conf}
+EOF
+`);
+        execIngress('nginx -t -c /tmp/nginx.candidate.conf', { silent: true });
+        try {
+          execIngress(
+            `sh -c 'cp /tmp/nginx.conf /tmp/nginx.previous.conf && ` +
+              `cp /tmp/nginx.candidate.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`,
+            { silent: true },
+          );
+        } catch (error) {
+          execIngress(`sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`, {
+            silent: true,
+            silentOnError: true,
+          });
+          throw error;
+        }
+      }
+
+      try {
+        shellExec(`kubectl apply -f - -n ${namespace} <<'EOF'
+${underpostIngressManifestsFactory({
+  namespace,
+  conf,
+  nodeName: ingressNode,
+})}
+EOF
+`);
+      } catch (error) {
+        if (shouldHotReload)
+          execIngress(`sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`, {
+            silent: true,
+            silentOnError: true,
+          });
+        throw error;
+      }
+      if (shouldHotReload)
+        execIngress('rm -f /tmp/nginx.previous.conf /tmp/nginx.candidate.conf', {
+          silent: true,
+          silentOnError: true,
+        });
+      // A live pod before apply is not proof the desired template rolled out.
+      // In particular, changing nodeSelector uses Recreate and invalidates the
+      // ready replica that made canHotReload true. Do not let the caller delete
+      // the old route kind until the replacement edge is actually Available.
+      if (!canHotReload || changesNode)
+        shellExec(`kubectl rollout status deployment/${UNDERPOST_INGRESS.name} -n ${namespace} --timeout=5m`, {
+          silent: true,
+        });
+      else if (shouldHotReload)
+        // `nginx -s reload` returns after signalling the master. Give it one
+        // scheduling turn to start the new workers before the caller removes
+        // the old stack's route object.
+        shellExec('sleep 1', { silent: true });
+      shellExec(
+        `kubectl wait --for=condition=Available deployment/${UNDERPOST_INGRESS.name} ` + `-n ${namespace} --timeout=5m`,
+        { silent: true },
+      );
+      execIngress('nginx -t -c /tmp/nginx.conf', { silent: true });
+      logger.info('Underpost ingress applied', {
+        namespace,
+        backends: Object.keys(backends),
+        hosts: entries.length,
+        node: ingressNode,
+        hotReloaded: shouldHotReload,
+      });
+      return true;
     },
 
+    /**
+     * @method pruneEndpointlessService
+     * @description Removes a Service that resolves to nothing. kube-proxy does
+     * not ignore such a Service — it installs an ICMP port-unreachable REJECT
+     * for every port it publishes, so an orphan is not inert: it actively
+     * refuses connections on those ports, and the refusal looks exactly like
+     * "no server is listening" even while one is.
+     *
+     * Only an endpointless Service is removed, so a healthy one of the same name
+     * is never touched.
+     * @param {string} name - Service name.
+     * @param {string} [namespace] - Namespace to inspect.
+     * @returns {boolean} True when a Service was pruned.
+     * @memberof UnderpostCluster
+     */
+    pruneEndpointlessService({ name, namespace = 'default' }) {
+      const exists = shellExec(`kubectl get svc ${name} -n ${namespace} -o name`, {
+        stdout: true,
+        silent: true,
+        silentOnError: true,
+      });
+      if (!exists || !`${exists}`.trim()) return false;
+      // EndpointSlice rather than the deprecated Endpoints API.
+      const addresses = shellExec(
+        `kubectl get endpointslice -n ${namespace} -l kubernetes.io/service-name=${name} ` +
+          `-o jsonpath='{.items[*].endpoints[*].addresses[*]}'`,
+        { stdout: true, silent: true, silentOnError: true },
+      );
+      if (addresses && `${addresses}`.trim()) return false;
+      logger.warn(`Pruning endpointless Service ${namespace}/${name}`, {
+        reason: 'kube-proxy REJECTs every port a Service with no endpoints publishes',
+      });
+      shellExec(`kubectl delete svc ${name} -n ${namespace} --ignore-not-found`);
+      return true;
+    },
+
+    /**
+     * @method resolveCriSocket
+     * @description CLI-facing binding of {@link CriEndpoint.resolveCriSocket}.
+     * @param {object} [options] - Cluster options (`k3s`, `criSocket`).
+     * @returns {string} CRI endpoint URI.
+     * @memberof UnderpostCluster
+     */
+    resolveCriSocket,
+
+    /**
+     * @method crictlCommandFactory
+     * @description CLI-facing binding of {@link CriEndpoint.crictlCommandFactory}.
+     * @param {string} args - crictl subcommand and arguments (e.g. `pull mongo:latest`).
+     * @param {object} [options] - Cluster options (`k3s`, `criSocket`).
+     * @returns {string} Full shell command.
+     * @memberof UnderpostCluster
+     */
+    crictlCommandFactory,
+
     /**
      * @method config
      * @description Configures host-level settings required for Kubernetes.
@@ -671,26 +1383,17 @@ EOF
     config(options = { underpostRoot: '.' }) {
       const { underpostRoot } = options;
       console.log('Applying host configuration: SELinux, Docker, Containerd, and Sysctl settings.');
-      // Disable SELinux (permissive mode)
-      shellExec(`sudo setenforce 0`, {
-        silentOnError: true,
-      });
-      shellExec(`sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config`, {
-        silentOnError: true,
-      });
+      enforceSELinux(['/var/lib/kubelet', '/var/lib/containerd']);
 
       // Enable and start Docker and Kubelet services
       shellExec(`sudo systemctl enable --now docker`); // Docker might not be needed for K3s
       shellExec(`sudo systemctl enable --now kubelet`); // Kubelet might not be needed for K3s (K3s uses its own agent)
 
-      // Configure containerd for SystemdCgroup and explicitly disable SELinux
-      // This is crucial for kubelet/k3s to interact correctly with containerd
+      // Configure containerd for systemd cgroups and SELinux labeling.
       shellExec(`containerd config default | sudo tee /etc/containerd/config.toml > /dev/null`);
       shellExec(`sudo sed -i -e "s/SystemdCgroup = false/SystemdCgroup = true/g" /etc/containerd/config.toml`);
-      // Add a new line to disable SELinux for the runc runtime
-      // shellExec(
-      //   `sudo sed -i '/SystemdCgroup = true/a       selinux_disabled = true' /etc/containerd/config.toml`,
-      // );
+      shellExec(`sudo sed -i -e "s/enable_selinux = false/enable_selinux = true/g" /etc/containerd/config.toml`);
+      runSELinuxCommands([selinuxRestoreconCommandFactory('/etc/containerd')], { execute: shellExec });
       // Restart docker after containerd config changes. Rocky 9 uses systemctl,
       // not the legacy service command.
       shellExec(`sudo systemctl restart docker || sudo service docker restart || true`);
@@ -721,7 +1424,7 @@ EOF
      * This applies only what K3s genuinely requires, and every step is guarded
      * so it is a no-op when the relevant tooling is absent (e.g. minimal images
      * without SELinux userspace):
-     *   - SELinux → permissive (only if SELinux tooling is present).
+     *   - SELinux remains Enforcing.
      *   - swap off (Kubernetes best practice).
      *   - br_netfilter + bridge/forward sysctls (pod networking).
      *   - inotify limits.
@@ -736,16 +1439,8 @@ EOF
       // forever (the upstream unit ships TimeoutStartSec=0).
       shellExec(`if systemctl is-active --quiet firewalld; then sudo systemctl disable --now firewalld; fi`);
 
-      // SELinux → permissive, but only when the tooling exists. Rocky has it;
-      // minimal LXD images may not. K3s also installs k3s-selinux for enforcing
-      // mode, so this is a best-effort dev convenience, not a hard requirement.
-      shellExec(`if command -v setenforce >/dev/null 2>&1; then sudo setenforce 0; fi`, {
-        silentOnError: true,
-      });
-      shellExec(
-        `if [ -f /etc/selinux/config ]; then sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config; fi`,
-        { silentOnError: true },
-      );
+      enforceSELinux(K3S_SELINUX_PATHS);
+      shareWithContainers(HOST_VOLUME_PATHS);
 
       // Disable swap. `swapoff -a` is a no-op without swap; the sed only edits
       // fstab when a swap line is present.
@@ -889,7 +1584,7 @@ net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-k3s.conf > /dev/null`,
      * @param {object} [options]
      * @param {boolean} [options.all=true] - Remove all unused images, not just dangling ones.
      * @param {boolean} [options.crictl=false] - Also prune the CRI runtime via crictl.
-     * @param {string} [options.criSocket] - Optional crictl --runtime-endpoint override.
+     * @param {string} [options.criSocket] - Optional CRI endpoint override; otherwise the live runtime is resolved.
      * @private
      */
     _pruneContainerCaches(options = {}) {
@@ -906,11 +1601,9 @@ net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-k3s.conf > /dev/null`,
         silentOnError: true,
       });
       if (options.crictl) {
-        const ep = options.criSocket ? `--runtime-endpoint ${options.criSocket} ` : '';
-        shellExec(
-          `if command -v crictl >/dev/null 2>&1; then sudo env PATH="$PATH:/usr/local/bin:/usr/bin" crictl ${ep}rmi --prune; fi`,
-          { silentOnError: true },
-        );
+        shellExec(`if command -v crictl >/dev/null 2>&1; then ${crictlCommandFactory('rmi --prune', options)}; fi`, {
+          silentOnError: true,
+        });
       }
       Underpost.cluster._unmountOrphanContainerOverlays();
     },
@@ -1020,17 +1713,8 @@ fi`);
       if (options.removeVolumeHostPaths) Underpost.cluster._cleanHostPathPvs();
       else logger.info('  -> Skipping (pass --remove-volume-host-paths to enable).');
 
-      logger.info('Phase 2/7: SELinux permissive + restore contexts (when present)...');
-      shellExec(`if command -v setenforce >/dev/null 2>&1; then sudo setenforce 0; fi`);
-      shellExec(
-        `if [ -f /etc/selinux/config ]; then sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config; fi`,
-      );
-      shellExec(
-        `if command -v restorecon >/dev/null 2>&1 && [ -d /var/lib/kubelet ]; then sudo restorecon -Rv /var/lib/kubelet; fi`,
-      );
-      shellExec(
-        `if command -v restorecon >/dev/null 2>&1 && [ -d /var/lib/containerd ]; then sudo restorecon -Rv /var/lib/containerd; fi`,
-      );
+      logger.info('Phase 2/7: Enforcing SELinux and restoring runtime contexts...');
+      enforceSELinux(['/var/lib/kubelet', '/var/lib/containerd']);
 
       logger.info('Phase 3/7: Stopping host kubelet and container runtimes (kubeadm-scope only)...');
       shellExec(`if systemctl is-active --quiet kubelet; then sudo systemctl stop kubelet; fi`);
@@ -1039,11 +1723,15 @@ fi`);
       Underpost.cluster._lazyUmountKubeletMounts();
 
       logger.info('Phase 4/7: Killing control-plane processes and running kubeadm reset...');
-      shellExec(`if command -v crictl >/dev/null 2>&1; then sudo crictl rm -a -f; fi`, { silentOnError: true });
+      shellExec(`if command -v crictl >/dev/null 2>&1; then ${crictlCommandFactory('rm -a -f')}; fi`, {
+        silentOnError: true,
+      });
       // Remove CNI config before stopping sandboxes so Calico's CNI delete hook is
       // not invoked (the API server is already down and the hook would fail).
       shellExec(`sudo rm -rf /etc/cni/net.d/*`);
-      shellExec(`if command -v crictl >/dev/null 2>&1; then sudo crictl rmp -a -f; fi`, { silentOnError: true });
+      shellExec(`if command -v crictl >/dev/null 2>&1; then ${crictlCommandFactory('rmp -a -f')}; fi`, {
+        silentOnError: true,
+      });
       shellExec(`if systemctl is-active --quiet etcd; then sudo systemctl stop etcd; fi`);
       for (const port of [6443, 10259, 10257, 2379, 2380]) {
         shellExec(`if sudo fuser ${port}/tcp >/dev/null 2>&1; then sudo fuser -k ${port}/tcp; fi`);
@@ -1226,6 +1914,10 @@ EOF`);
         shellExec(`sudo rm -rf get_helm.sh`);
       }
 
+      // SOPS and Age for Git-native encrypted secret manifests. Owned by UnderpostSecret so the
+      // same idempotent install backs `underpost secret --install-tools`.
+      Underpost.secret.sops.installTooling();
+
       // Install snap
       shellExec(`sudo yum install -y snapd`);
       shellExec(`sudo systemctl enable --now snapd.socket`);
@@ -1296,10 +1988,8 @@ EOF`);
       shellExec(`sudo rm -f /etc/sysctl.d/99-k8s-ipforward.conf`);
       shellExec(`sudo rm -f /etc/sysctl.d/99-k8s.conf`);
 
-      // Restore SELinux to enforcing
-      console.log('Restoring SELinux to enforcing mode...');
-      // shellExec(`sudo setenforce 1`);
-      // shellExec(`sudo sed -i 's/^SELINUX=permissive$/SELINUX=enforcing/' /etc/selinux/config`);
+      console.log('Keeping SELinux in enforcing mode...');
+      enforceSELinux();
 
       console.log('Uninstall process completed.');
     },