From 5faefee54b18a5bd18bdb376e4269887fed0dc3e Mon Sep 17 00:00:00 2001
From: evangelostsak <baggtsak55@gmail.com>
Date: Fri, 9 Oct 2026 23:33:11 +0200
Subject: [PATCH] perf(swarm-test): take the sudo prompt off the lab
 administrator

Three runs of the transport benchmark, per module call:

              become off   become on
  docker          247ms       246ms
  ssh over mesh   215ms      1259ms

The connection is not the cost - ssh through the tunnel beats docker exec by
13% - and the tunnel is 4%. What the meshed arm pays is the sudo prompt: free
over the container connection, which runs as root, and 1046ms per escalated
call over ssh as the administrator. That is the 414ms per task the three-arm
comparison measured across a whole deploy.

A lab-only sudoers drop-in removes it. It is applied from the mesh prologue
while the inventory still reaches the nodes as root, so it is in place before
anything logs in as the administrator, and it touches no role: production
keeps 'administrator ALL=(ALL) ALL' and its password prompt.

The cost is that CI no longer exercises password sudo over the mesh. It never
exercised it on the direct arm either, which connects as root, and a wrong
password fails loudly rather than silently.
---
 lab-sudo.yml                | 14 ++++++++++++++
 utils/tests/swarm/matrix.py |  3 +++
 utils/tests/swarm/mesh.py   | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 lab-sudo.yml

diff --git a/lab-sudo.yml b/lab-sudo.yml
new file mode 100644
index 0000000000..1b80308d3e
--- /dev/null
+++ b/lab-sudo.yml
@@ -0,0 +1,14 @@
+---
+- name: "🔓 Let the lab's administrator escalate without a prompt"
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: "🔓 Drop the lab sudoers override"
+      ansible.builtin.copy:
+        content: "administrator ALL=(ALL) NOPASSWD: ALL\n"
+        dest: /etc/sudoers.d/zz-swarm-lab-administrator
+        owner: root
+        group: root
+        mode: "0440"
+        validate: "visudo -cf %s"
diff --git a/utils/tests/swarm/matrix.py b/utils/tests/swarm/matrix.py
index fc38b54bce..28a31cbbf7 100644
--- a/utils/tests/swarm/matrix.py
+++ b/utils/tests/swarm/matrix.py
@@ -15,6 +15,7 @@ from utils.tests.swarm.extend_inventory import mesh_enabled
 from utils.tests.swarm.mesh import (
     bootstrap_mesh,
     converge_mesh,
+    lab_sudo_without_prompt,
     mesh_controller,
     switch_to_mesh_transport,
     transport_bench,
@@ -276,6 +277,8 @@ def _mesh_prologue(
         round_variants: the round's ``{app_id: variant_index}`` map.
     """
     rc = bootstrap_mesh(inv_dir=inv_dir)
+    if rc == 0:
+        rc = lab_sudo_without_prompt(inv_dir=inv_dir)
     if rc == 0:
         rc = _reset_credentials(
             app_id=app_id, inv_dir=inv_dir, round_variants=round_variants
diff --git a/utils/tests/swarm/mesh.py b/utils/tests/swarm/mesh.py
index 56c146d062..ebbbe9df47 100644
--- a/utils/tests/swarm/mesh.py
+++ b/utils/tests/swarm/mesh.py
@@ -14,6 +14,7 @@ _MESH_NAME = "swarm"
 _CONTROLLER = "localhost"
 _PLAYBOOK = "playbook-mesh.yml"
 _BENCH_PLAYBOOK = "transport-bench.yml"
+_SUDO_PLAYBOOK = "lab-sudo.yml"
 _SWARM_EXTRAS_VARS = "inventories/development/swarm.yml"
 _DEFAULT_ADMIN_KEY = "/tmp/swarm-nfs-admin.key"  # noqa: S108 - ephemeral swarm-test path, overridable via KEY_PATH
 
@@ -131,6 +132,37 @@ def mesh_controller(*, inv_dir: str) -> int:
     )
 
 
+def lab_sudo_without_prompt(*, inv_dir: str) -> int:
+    """Take the sudo prompt off the lab's administrator before the switch.
+
+    Measured over the mesh, an escalated module call costs 1046ms more than an
+    unescalated one, while over the container connection -- which runs as root
+    and so never prompts -- escalation is free. The prompt, not the transport,
+    is what the meshed arm was paying: SSH through the tunnel is itself faster
+    per call than docker exec.
+
+    Runs while the inventory still reaches the nodes as root, so it is in place
+    before anything logs in as the administrator.
+
+    Args:
+        inv_dir: inventory directory of the round.
+    """
+    if not mesh_enabled():
+        return 0
+    return run_step(
+        [
+            "ansible-playbook",
+            "-i",
+            f"{inv_dir}/devices.yml",
+            "--vault-password-file",
+            f"{inv_dir}/.password",
+            _SUDO_PLAYBOOK,
+        ],
+        env=os.environ.copy(),
+        label="take the sudo prompt off the lab administrator",
+    )
+
+
 def transport_bench(*, inv_dir: str, extras_path: str, label: str) -> int:
     """Time a fixed number of module calls over whatever transport is in force.