From 1d8d466ccf8e515a656a4f91e2ec99f3cab18750 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sun, 23 Aug 2026 20:20:29 -0300
Subject: [PATCH] ci(hermes): move WebUI builds off storage nodes

---
 ci/Jenkinsfile.hermes-webui-image          | 7 ++++---
 testing/tests/test_hermes_webui_release.py | 5 ++++-
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/ci/Jenkinsfile.hermes-webui-image b/ci/Jenkinsfile.hermes-webui-image
index 3173e7b4..7a9a1a70 100644
--- a/ci/Jenkinsfile.hermes-webui-image
+++ b/ci/Jenkinsfile.hermes-webui-image
@@ -18,7 +18,6 @@ spec:
     fsGroupChangePolicy: OnRootMismatch
   nodeSelector:
     kubernetes.io/arch: arm64
-    node-role.kubernetes.io/worker: "true"
   affinity:
     nodeAffinity:
       requiredDuringSchedulingIgnoredDuringExecution:
@@ -26,9 +25,11 @@ spec:
           - matchExpressions:
               - key: kubernetes.io/hostname
                 operator: In
+                # Keep disposable Kaniko expansion off the astreae Longhorn
+                # replica nodes. titan-20 is the roomy ARM image builder and
+                # has local NVMe for this transient I/O.
                 values:
-                  - titan-15
-                  - titan-17
+                  - titan-20
   imagePullSecrets:
     - name: harbor-bstein-robot
   containers:
diff --git a/testing/tests/test_hermes_webui_release.py b/testing/tests/test_hermes_webui_release.py
index a33c22af..3cfe7a71 100644
--- a/testing/tests/test_hermes_webui_release.py
+++ b/testing/tests/test_hermes_webui_release.py
@@ -122,10 +122,13 @@ def test_pipeline_builds_latest_main_containing_reviewed_anchor() -> None:
     assert "kaniko" in containers
     assert containers["kaniko"]["resources"]["requests"]["ephemeral-storage"] == "10Gi"
     assert containers["kaniko"]["resources"]["limits"]["ephemeral-storage"] == "20Gi"
+    assert spec["nodeSelector"] == {"kubernetes.io/arch": "arm64"}
     build_nodes = spec["affinity"]["nodeAffinity"][
         "requiredDuringSchedulingIgnoredDuringExecution"
     ]["nodeSelectorTerms"][0]["matchExpressions"][0]["values"]
-    assert build_nodes == ["titan-15", "titan-17"]
+    assert build_nodes == ["titan-20"]
+    storage_nodes = {"titan-13", "titan-15", "titan-17", "titan-19"}
+    assert storage_nodes.isdisjoint(build_nodes)
     assert "docker.sock" not in source and "hostPath" not in source
     for container in containers.values():
         assert container["securityContext"]["allowPrivilegeEscalation"] is False