feat(autoscaler): auto-detect Bottlerocket and set super_t

[slashben]

Summary

Makes the node-agent autoscaler auto-detect AWS Bottlerocket nodes and render those node groups' DaemonSets with seLinuxOptions.type: super_t automatically, so customers on Bottlerocket no longer need --set nodeAgent.seLinuxType=super_t. Bottlerocket's strict SELinux policy makes the default spc_t type crash-loop the eBPF node-agent; super_t grants the required privileges.

Changes

• nodeagentautoscaler/nodegrouper.go: new NodeGroup.HasBottlerocket, case-insensitive bottlerocket match on node.Status.NodeInfo.OSImage, OR-ed across a group's nodes; gated by config.
• nodeagentautoscaler/templaterenderer.go: TemplateData.SELinuxType = super_t for Bottlerocket groups else configured default; threaded through NewTemplateRenderer.
• config/config.go: new nodeAgentAutoscaler.seLinuxType (default spc_t) and nodeAgentAutoscaler.bottlerocketAutoDetect (opt-out, default true).
• nodeagentautoscaler/integration_test.go, docs/node-agent-autoscaler.md: integration coverage + docs.

Scope: autoscaler install path only. Standard single-DaemonSet and multipleDaemonSets installs are unchanged. Companion chart PR: kubescape/helm-charts feature/bottlerocket-autoscaler-selinux. Ship this operator image with/before the chart bump (old operator + new template would leave a literal {{ .SELinuxType }}; reverse is a safe fallback).

Testing

go test ./config/ ./nodeagentautoscaler/ → pass (72 tests). go test -tags=integration ./nodeagentautoscaler/ → pass (renders the real Helm template, asserts super_t vs spc_t). go vet ./... and go test -race ./nodeagentautoscaler/ → clean.

Docs

docs/node-agent-autoscaler.md — new "AWS Bottlerocket auto-detection" section (in this PR).

AI Review

Local AI review: subagent-driven-development per-task reviews + final whole-branch review (claude-opus) — clean, no Critical/Important findings; cross-repo contract verified end-to-end.
Scope: full diff (operator changed Go files).

AI Context

Category	Used
Skills	brainstorming, writing-plans, subagent-driven-development, finishing-a-development-branch
MCP Servers	None
Rules/Commands	CLAUDE.md (no AI attribution)

AI-skills: notify-me,superpowers:brainstorming,superpowers:writing-plans,superpowers:subagent-driven-development,superpowers:finishing-a-development-branch

Summary by CodeRabbit

• New Features

  • Added automatic AWS Bottlerocket node detection for node-agent autoscaling.
  • Bottlerocket node groups now receive the appropriate super_t SELinux setting automatically.
  • Added configurable default SELinux type for non-Bottlerocket nodes.
  • Added an option to disable Bottlerocket auto-detection.

• Documentation

  • Documented configuration, detection behavior, rendering rules, and migration guidance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 444be5d5-5307-43eb-8464-18163a84eb66

📥 Commits

Reviewing files that changed from the base of the PR and between 7df14cf and c535bfa.

📒 Files selected for processing (11)

• config/config.go
• config/config_test.go
• docs/node-agent-autoscaler.md
• docs/superpowers/plans/2026-07-20-bottlerocket-autoscaler-selinux.md
• docs/superpowers/specs/2026-07-20-bottlerocket-autoscaler-selinux-design.md
• nodeagentautoscaler/autoscaler.go
• nodeagentautoscaler/autoscaler_test.go
• nodeagentautoscaler/integration_test.go
• nodeagentautoscaler/nodegrouper.go
• nodeagentautoscaler/templaterenderer.go
• nodeagentautoscaler/templaterenderer_test.go

---

📝 Walkthrough

Walkthrough

Changes

The node-agent autoscaler now detects Bottlerocket nodes per node group and selects super_t for their rendered DaemonSets. Non-Bottlerocket groups use the configured spc_t default, with new configuration, tests, integration coverage, and documentation.

Bottlerocket SELinux autoscaler

Layer / File(s)	Summary
Autoscaler configuration contract config/config.go, config/config_test.go, docs/superpowers/...	Adds SELinuxType and BottlerocketAutoDetect configuration fields with defaults of spc_t and true.
Per-group Bottlerocket detection nodeagentautoscaler/nodegrouper.go, nodeagentautoscaler/autoscaler_test.go	Marks groups containing Bottlerocket nodes using case-insensitive OS image matching, with detection controlled by configuration.
Per-group SELinux rendering nodeagentautoscaler/templaterenderer.go, nodeagentautoscaler/autoscaler.go, nodeagentautoscaler/*_test.go	Passes the configured default into the renderer, selects super_t or the default per group, and validates unit and integration rendering behavior.
Behavior and rollout documentation docs/node-agent-autoscaler.md, docs/superpowers/...	Documents autoscaler template placeholders, chart-mode behavior, migration guidance, and rollout constraints.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant NodeGrouper
  participant TemplateRenderer
  participant HelmTemplate
  participant DaemonSet
  NodeGrouper->>TemplateRenderer: provide Bottlerocket group flag
  TemplateRenderer->>TemplateRenderer: choose super_t or spc_t
  TemplateRenderer->>HelmTemplate: pass SELinuxType
  HelmTemplate->>DaemonSet: render SELinux options

Loading

Possibly related PRs

• kubescape/operator#370: Both modify autoscaler renderer wiring and template data.
• kubescape/operator#389: Both extend the node-agent template rendering pipeline.

Suggested reviewers: matthyx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 52.94% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: Bottlerocket auto-detection in the autoscaler and rendering super_t for affected node groups.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/bottlerocket-autoscaler-selinux

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Summary:

• License scan: success
• Credentials scan: failure
• Vulnerabilities scan: failure
• Unit test: success
• Go linting: failure