fix(oci): keep Proxmox tags editable on native stack members

- Accept tag changes in the native stack check before recreate or update
- Keep identity and every other setting checked as before
- Add a regression test for the native stack check

oci/remote/oci_instances.py

@@ -230,8 +230,9 @@ def identity(config):
     return match.group(1) if match else None
 
 
-def same_config_except_notes(record, config):
+def same_config_except_notes(record, config, ignore_tags=False):
-    """Accept a presentation-only note edit, never a changed OCI identity or LXC setting."""
+    """Accept a presentation-only note edit, never a changed OCI identity or LXC setting.
+    With `ignore_tags`, Proxmox tags may differ too: the operation keeps them as they are."""
     previous = record['observed']['config'].encode()
     expected = record['installation_id']
     if identity(previous) != expected or identity(config) != expected:
@@ -242,7 +243,8 @@ def same_config_except_notes(record, config):
         notes = [line for line in lines if line.startswith(b'description: ')]
         if len(notes) != 1:
             return None
-        return b''.join(line for line in lines if not line.startswith(b'description: '))
+        dropped = (b'description: ', b'tags: ') if ignore_tags else (b'description: ',)
+        return b''.join(line for line in lines if not line.startswith(dropped))
 
     original = without_notes(previous)
     return original is not None and original == without_notes(config)

oci/remote/oci_stack_native.py

@@ -192,7 +192,7 @@ class NativeAdapter:
                 config = instances.command('pct', 'config', str(vmid))
                 if instances.identity(config) != record['installation_id']:
                     raise ValueError(translate('The identity of a member was replaced'))
-                if (not self.journal.exists() or not self.state().get('replacement_intent')) and not instances.same_config_except_notes(record, config):
+                if (not self.journal.exists() or not self.state().get('replacement_intent')) and not instances.same_config_except_notes(record, config, ignore_tags=True):
                     raise ValueError(translate('A member configuration changed during the preparation'))
             else:
                 if Path('/etc/pve/lxc/%s.conf' % vmid).exists():

oci/tests/test_external_tags.py

@@ -166,6 +166,20 @@ die() { printf '%s\\n' "$*" >&2; exit 1; }
                     self.assertEqual(state['preserved_stack_config']['tags'], tags or '')
 
     @unittest.skipUnless(shutil.which('bash') and shutil.which('jq'), 'bash and jq are needed')
+    def test_native_stack_check_accepts_tag_edits_and_nothing_else(self):
+        saved = record()
+        instances = transaction.instances
+        for new in ('homelab;oci;proxmenux', 'proxmenux;oci', '', None):
+            with self.subTest(new=new):
+                self.assertTrue(instances.same_config_except_notes(saved, config(new), ignore_tags=True))
+                self.assertFalse(instances.same_config_except_notes(saved, config(new)))
+        changed = config('homelab').replace(b'cores: 2', b'cores: 4')
+        self.assertFalse(instances.same_config_except_notes(saved, changed, ignore_tags=True))
+        other = config('homelab').replace(MARKER.encode(), b'22222222-2222-4222-8222-222222222222')
+        self.assertFalse(instances.same_config_except_notes(saved, other, ignore_tags=True))
+        source = (ROOT / 'remote/oci_stack_native.py').read_text()
+        self.assertIn('same_config_except_notes(record, config, ignore_tags=True)', source)
+
     def test_installer_still_refuses_unsupported_kept_settings(self):
         installer = (ROOT / 'remote/install_oci.sh').read_text()
         function = re.search(r'^apply_kept_settings\(\) \{\n.*?^\}\n', installer, re.M | re.S).group(0)