Bound and hash the drain PDB's node label

[boddumanohar]

What

ensurePDB built the per-node PDB's selector from the raw Node name, while labelStoragePod labeled the pods that selector must match through sanitizeLabelValue. A Node name may be 253 characters; a label value stops at 63. Three things went wrong at once:

Rejected	For a name over 63 bytes the selector value is illegal, so the API server refuses the PDB — drain protection is never established
Protects nothing	Even if accepted, it selects a value no pod carries, so eviction proceeds unblocked
Collides	sanitizeLabelValue truncated without a digest, so two names sharing a 63-character prefix yield one label value and one PDB name — draining the second node retargets the first node's budget

Fix

sanitizeLabelValue returns an already-legal value unchanged; otherwise it cuts the name to leave room for a digest of the whole original and joins the two. Bounded, readable, deterministic, and it cannot end on a character a label value may not end on. The PDB selector now uses it, so selector and pod label are derived the same way.

node-a                                        -> node-a                     (unchanged)
ip-10-0-4-118.us-east-2.compute.internal      -> ip-10-0-...ute.internal    (unchanged)
ip-10-0-4-118.eu-central-1...example.com (75) -> ip-10-0-4-118.eu-central-1.compute.internal.sub.sub.su-0c4b78d5
<70 a's>-one                                  -> <54 a's>-1a839ba6
<70 a's>-two                                  -> <54 a's>-a23dc5e9

Upgrade

No effect on existing clusters: an already-legal value passes through untouched, so every node name in use today keeps the label value it has, and a drain in flight across the upgrade is unaffected.

Tests

TestDrainPDBLabelIsBoundedAndMatchesPod — red on the unchanged tree in all three cases (illegal value, selector matching no pod, two names colliding), green after. The pre-existing TestSanitizeLabelValue and TestEnsurePDB* cases still pass, which is what pins the unchanged short-name behavior.

Gates

Operator suite (15 packages) passes; make -C operator lint 0 issues; no generator drift.

---

Two notes, neither addressed here:

• The drain coordinator has no test-plan section anywhere under operator/docs/tests/, so there was no matrix to add a row to. Enumerating one is a test-scenarios job, not a drive-by.
• sanitiseDNSLabel (storage.simplyblock.io/worker) and nodeprobe.labelValue are two more hand-rolled variants of this same primitive, and sanitiseDNSLabel has the same unbounded defect on a different label. Consolidating the three into atlas-lib/kube is the obvious follow-up.

🤖 Generated with Claude Code