From 2b502288dc6e738cac9afd49905611f5528057a1 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Thu, 19 Feb 2026 18:59:44 +0100
Subject: [PATCH 1/2] ci: update storageclass before sync server

---
 .github/workflows/bm_maintenance.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bm_maintenance.yml b/.github/workflows/bm_maintenance.yml
index 081680834c8..8d678e8944d 100644
--- a/.github/workflows/bm_maintenance.yml
+++ b/.github/workflows/bm_maintenance.yml
@@ -94,6 +94,10 @@ jobs:
         with:
           persist-credentials: false
       - uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1
+      - name: Update storageclass
+        run: |
+          nix build .#csi-driver-host-path
+          kubectl apply -k result
       - name: Update sync fifo for GPU platform
         if: ${{ matrix.platform.name == 'Metal-QEMU-SNP-GPU' || matrix.platform.name == 'Metal-QEMU-TDX-GPU' }}
         run: |
@@ -119,10 +123,6 @@ jobs:
             OPTS+=(--blackwell)
           fi
           nix run .#scripts.upgrade-gpu-operator -- "${OPTS[@]}"
-      - name: Update storageclass
-        run: |
-          nix build .#csi-driver-host-path
-          kubectl apply -k result
       - name: Report success
         id: report
         run: |

From 4ba519d5bbee854ed8a96229b91080139cacbbd7 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Thu, 19 Feb 2026 19:07:49 +0100
Subject: [PATCH 2/2] ci: kustomize sync server before applying

---
 .github/workflows/bm_maintenance.yml             |  4 +---
 tools/bm-maintenance/sync-fifo/kustomization.yml | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)
 create mode 100644 tools/bm-maintenance/sync-fifo/kustomization.yml

diff --git a/.github/workflows/bm_maintenance.yml b/.github/workflows/bm_maintenance.yml
index 8d678e8944d..c986a2f8d8b 100644
--- a/.github/workflows/bm_maintenance.yml
+++ b/.github/workflows/bm_maintenance.yml
@@ -101,9 +101,7 @@ jobs:
       - name: Update sync fifo for GPU platform
         if: ${{ matrix.platform.name == 'Metal-QEMU-SNP-GPU' || matrix.platform.name == 'Metal-QEMU-TDX-GPU' }}
         run: |
-          kubectl apply -f https://raw.githubusercontent.com/katexochen/sync/9567164967b5832fb4992088af89dbbd94184043/server/deployment.yml
-          kubectl patch statefulset sync --type='json' -p='[{"op": "replace", "path": "/spec/template/spec/nodeSelector", "value": {"ci.contrast.edgeless.systems/main-runner": "true"}}]'
-          kubectl rollout restart statefulset/sync
+          kubectl apply -k tools/bm-maintenance/sync-fifo
           kubectl rollout status statefulset/sync --timeout=5m
           kubectl wait --for=jsonpath='{.status.loadBalancer.ingress[0].ip}' --timeout=5m svc/sync
           nix run .#scripts.renew-sync-fifo
diff --git a/tools/bm-maintenance/sync-fifo/kustomization.yml b/tools/bm-maintenance/sync-fifo/kustomization.yml
new file mode 100644
index 00000000000..4bc83cb93dd
--- /dev/null
+++ b/tools/bm-maintenance/sync-fifo/kustomization.yml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: default
+
+resources:
+  - https://raw.githubusercontent.com/katexochen/sync/9567164967b5832fb4992088af89dbbd94184043/server/deployment.yml
+
+patches:
+  - patch: |-
+      - op: replace
+        path: /spec/template/spec/nodeSelector
+        value: {"ci.contrast.edgeless.systems/main-runner": "true"}
+    target:
+      kind: StatefulSet