[MPC] Fix /var/tmp permissions for linux-root-{amd64,arm64} platforms

[sshedmake]

Summary

Fix /var/tmp permission issues for linux-root-amd64 and linux-root-arm64 build platforms by adding user-data initialization scripts with proper directory permissions.

Problem

Builds using the linux-root/amd64 platform are failing with permission errors:

Error: creating a temporary directory: mkdir /var/tmp/container_images_storage548378450: permission denied

This occurs because:

1. Remote build VMs run podman as ec2-user (uid 1001)
2. /var/tmp on these VMs doesn't have proper permissions for non-root users
3. Podman needs to create temporary storage directories when pulling images

This is blocking bootc image builds that require privileged-nested mode with /dev/fuse for fuse-overlayfs.

Solution

Apply the same fix from PR #10595 (which fixed linux-c6gd2xlarge-arm64) to the linux-root-{amd64,arm64} platforms:

1. Add user-data initialization scripts that:

   • Mount NVMe storage to /home
   • Bind mount /home/var-tmp to /var/tmp
   • Set proper permissions: chmod 1777 /var/tmp (sticky bit + world writable)
   • Set ownership: chown root:root /var/tmp
   • Apply SELinux context with restorecon

2. Fix key naming from sudoCommands to sudo-commands to match conventions used in other platform configurations

Changes

• Modified: components/multi-platform-controller/staging/host-values.yaml
  • Added user-data configuration for linux-root-amd64
  • Added user-data configuration for linux-root-arm64
  • Fixed parameter naming consistency

Testing

After this change is deployed to staging:

1. Builds using linux-root/amd64 platform should succeed
2. Podman image pulls on remote VMs should complete without permission errors
3. Bootc image builds with privileged-nested mode should work correctly

Related

• Related to: [MPC] Fix ec2-user access to tmp folder in linux-c6gd2xlarge-arm64 pr… #10595 (fixed same issue for linux-c6gd2xlarge-arm64)
• Fixes: automation-portal-bootc builds failing with /var/tmp permission denied
• Upstream issue: https://github.com/ansible-automation-platform/automation-portal-bootc-container (bootc builds requiring fuse-overlayfs)

Deployment

This change affects:

• Staging: components/multi-platform-controller/staging/
• Production: Will need follow-up PRs for production environments after staging validation

/hold

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sshedmake
Once this PR has been reviewed and has the lgtm label, please assign hugares for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• components/multi-platform-controller/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @sshedmake. Thanks for your PR.

I'm waiting for a redhat-appstudio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

🤖 Gemini AI Assistant Available

Hi @sshedmake! I'm here to help with your pull request. You can interact with me using the following commands:

Available Commands

• @gemini-cli /review - Request a comprehensive code review

  • Example: @gemini-cli /review Please focus on security and performance

• @gemini-cli <your question> - Ask me anything about the codebase

  • Example: @gemini-cli How can I improve this function?
  • Example: @gemini-cli What are the best practices for error handling here?

How to Use

1. Simply type one of the commands above in a comment on this PR
2. I'll analyze your code and provide detailed feedback
3. You can track my progress in the workflow logs

Permissions

Only OWNER, MEMBER, or COLLABORATOR users can trigger my responses. This ensures secure and appropriate usage.

---

This message was automatically added to help you get started with the Gemini AI assistant. Feel free to delete this comment if you don't need assistance.

[github-actions]

🤖 Hi @sshedmake, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.