ci: fix bare-metal maintenance

.github/workflows/bm_maintenance.yml

@@ -94,12 +94,14 @@ jobs:
         with:
           persist-credentials: false
       - uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1
+      - name: Update storageclass
+        run: |
+          nix build .#csi-driver-host-path
+          kubectl apply -k result
       - name: Update sync fifo for GPU platform
         if: ${{ matrix.platform.name == 'Metal-QEMU-SNP-GPU' || matrix.platform.name == 'Metal-QEMU-TDX-GPU' }}
         run: |
-          kubectl apply -f https://raw.githubusercontent.com/katexochen/sync/9567164967b5832fb4992088af89dbbd94184043/server/deployment.yml
-          kubectl patch statefulset sync --type='json' -p='[{"op": "replace", "path": "/spec/template/spec/nodeSelector", "value": {"ci.contrast.edgeless.systems/main-runner": "true"}}]'
-          kubectl rollout restart statefulset/sync
+          kubectl apply -k tools/bm-maintenance/sync-fifo
           kubectl rollout status statefulset/sync --timeout=5m
           kubectl wait --for=jsonpath='{.status.loadBalancer.ingress[0].ip}' --timeout=5m svc/sync
           nix run .#scripts.renew-sync-fifo
@@ -119,10 +121,6 @@ jobs:
             OPTS+=(--blackwell)
           fi
           nix run .#scripts.upgrade-gpu-operator -- "${OPTS[@]}"
-      - name: Update storageclass
-        run: |
-          nix build .#csi-driver-host-path
-          kubectl apply -k result
       - name: Report success
         id: report
         run: |

tools/bm-maintenance/sync-fifo/kustomization.yml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: default
+
+resources:
+  - https://raw.githubusercontent.com/katexochen/sync/9567164967b5832fb4992088af89dbbd94184043/server/deployment.yml
+
+patches:
+  - patch: |-
+      - op: replace
+        path: /spec/template/spec/nodeSelector
+        value: {"ci.contrast.edgeless.systems/main-runner": "true"}
+    target:
+      kind: StatefulSet