From ce219cea8f8eca8d02f60a0adc314fc6034fb5b7 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Mon, 4 May 2026 14:38:21 +0200
Subject: [PATCH 1/2] ci: use node selector for bm cleanup jobs

---
 tools/bm-maintenance/cleanup-containerd.yml | 2 ++
 tools/bm-maintenance/cleanup-namespaces.yml | 2 ++
 tools/bm-maintenance/cleanup.yml            | 2 ++
 tools/bm-maintenance/nix-gc.yml             | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/tools/bm-maintenance/cleanup-containerd.yml b/tools/bm-maintenance/cleanup-containerd.yml
index df7c0552a8d..48865ec3aa5 100644
--- a/tools/bm-maintenance/cleanup-containerd.yml
+++ b/tools/bm-maintenance/cleanup-containerd.yml
@@ -13,6 +13,8 @@ spec:
     metadata:
       name: containerd-cleanup-maintenance
     spec:
+      nodeSelector:
+        ci.contrast.edgeless.systems/main-runner: "true"
       containers:
         - name: cleanup
           image: "@@REPLACE_IMAGE@@"
diff --git a/tools/bm-maintenance/cleanup-namespaces.yml b/tools/bm-maintenance/cleanup-namespaces.yml
index 427e9443ac0..d6bb4885959 100644
--- a/tools/bm-maintenance/cleanup-namespaces.yml
+++ b/tools/bm-maintenance/cleanup-namespaces.yml
@@ -48,6 +48,8 @@ spec:
     spec:
       template:
         spec:
+          nodeSelector:
+            ci.contrast.edgeless.systems/main-runner: "true"
           serviceAccountName: namespace-cleanup-sa
           containers:
             - name: namespace-cleanup
diff --git a/tools/bm-maintenance/cleanup.yml b/tools/bm-maintenance/cleanup.yml
index 1a91883e4d2..c2eac159929 100644
--- a/tools/bm-maintenance/cleanup.yml
+++ b/tools/bm-maintenance/cleanup.yml
@@ -50,6 +50,8 @@ spec:
     metadata:
       name: cleanup-maintenance
     spec:
+      nodeSelector:
+        ci.contrast.edgeless.systems/main-runner: "true"
       serviceAccountName: cleanup-sa
       hostPID: true
       containers:
diff --git a/tools/bm-maintenance/nix-gc.yml b/tools/bm-maintenance/nix-gc.yml
index 59cf6f76045..c42524d9c7d 100644
--- a/tools/bm-maintenance/nix-gc.yml
+++ b/tools/bm-maintenance/nix-gc.yml
@@ -13,6 +13,8 @@ spec:
     metadata:
       name: nix-garbage-collection
     spec:
+      nodeSelector:
+        ci.contrast.edgeless.systems/main-runner: "true"
       hostPID: true
       containers:
         - name: nix-garbage-collection

From 589d3405787f56914489742b1980cb0dc941d732 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Tue, 5 May 2026 14:37:11 +0200
Subject: [PATCH 2/2] ci: use yq instead of dasel for cleanup

---
 overlays/nixpkgs.nix           | 13 +++++++++++++
 packages/cleanup-bare-metal.sh |  8 ++++----
 packages/scripts.nix           |  2 +-
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/overlays/nixpkgs.nix b/overlays/nixpkgs.nix
index 95b4b535011..5c219d3b3a0 100644
--- a/overlays/nixpkgs.nix
+++ b/overlays/nixpkgs.nix
@@ -103,4 +103,17 @@ final: prev:
       ];
     }
   );
+
+  yq-go = prev.yq-go.overrideAttrs (
+    finalAttrs: _prevAttrs: {
+      version = "4.53.2";
+      src = final.fetchFromGitHub {
+        owner = "mikefarah";
+        repo = "yq";
+        rev = "v${finalAttrs.version}";
+        hash = "sha256-So0yUblAxLgbw1/BrOp6zj9wGMTtsspjk2UQaBIBIYE=";
+      };
+      vendorHash = "sha256-t+u3rJNbe8JcfWBb+jMaZuTcSWYmhMiCeKbI2noVaCo=";
+    }
+  );
 }
diff --git a/packages/cleanup-bare-metal.sh b/packages/cleanup-bare-metal.sh
index 69d3c0408e9..6aee955b90b 100755
--- a/packages/cleanup-bare-metal.sh
+++ b/packages/cleanup-bare-metal.sh
@@ -17,7 +17,7 @@ else
 fi
 echo "Using containerd config file: ${configFile}"
 
-configVersion=$(dasel --file "${configFile}" --read toml version)
+configVersion=$(yq -p toml -o yaml '.version' "${configFile}")
 if [[ ${configVersion} != "2" && ${configVersion} != "3" ]]; then
   echo "Unsupported containerd config version: ${configVersion}. Exiting."
   exit 1
@@ -81,14 +81,14 @@ for runtimeClass in "${unusedRuntimeClasses[@]}"; do
   echo "Removing ${runtimeClass} from ${configFile} ..."
   case "${configVersion}" in
   "2")
-    dasel delete --file "${configFile}" --indent 0 --read toml --write toml "plugins.io\.containerd\.grpc\.v1\.cri.containerd.runtimes.${runtimeClass}" || true
+    yq -i -p toml -o toml "del(.plugins[\"io.containerd.grpc.v1.cri\"].containerd.runtimes[\"${runtimeClass}\"])" "${configFile}" || true
     ;;
   "3")
-    dasel delete --file "${configFile}" --indent 0 --read toml --write toml "plugins.io\.containerd\.cri\.v1\.runtime.containerd.runtimes.${runtimeClass}" || true
+    yq -i -p toml -o toml "del(.plugins[\"io.containerd.cri.v1.runtime\"].containerd.runtimes[\"${runtimeClass}\"])" "${configFile}" || true
     ;;
   esac
 
-  dasel delete --file "${configFile}" --indent 0 --read toml --write toml "proxy_plugins.${SNAPSHOTTER}-${runtimeClass}" 2>/dev/null || true
+  yq -i -p toml -o toml "del(.proxy_plugins[\"${SNAPSHOTTER}-${runtimeClass}\"])" "${configFile}" 2>/dev/null || true
 done
 
 echo "Cleanup finished"
diff --git a/packages/scripts.nix b/packages/scripts.nix
index 08ef5536ad2..51dddf19a43 100644
--- a/packages/scripts.nix
+++ b/packages/scripts.nix
@@ -393,7 +393,7 @@ lib.makeScope pkgs.newScope (scripts: {
     runtimeInputs = with pkgs; [
       busybox
       kubectl
-      dasel
+      yq-go
       scripts.cleanup-images
     ];
     text = builtins.readFile ./cleanup-bare-metal.sh;