add-module: honor the max-per-node label

[DavidePrincipi]

Some applications must run as a single instance per node. Their image declares this with the org.nethserver.max-per-node label: for example CrowdSec has org.nethserver.max-per-node=1, because two instances on the same node make no sense and compete for the same resources.

The Software Center respects this limit and does not offer nodes that already have the maximum number of instances. The add-module command, instead, ignores the label: an administrator (or an automated tool, like an AI agent) can install a second CrowdSec instance on the same node without any warning. This is an easy mistake to make, and it is not obvious to administrators who expect the command line to follow the same rules as the web interface.

Proposed solution

• By default, add-module checks the org.nethserver.max-per-node label of the image and refuses to install a new instance on a node that has already reached the limit. It prints a clear error message that names the limit and the existing instances.
• A new --force option keeps the current behavior, skipping the check. This is useful for developers and for special cases.
• The check should apply to both module names from the repositories and explicit image URLs.
• Document the --force option in the developer manual.

Alternative solutions

Leave the command as it is and only document the limitation. This does not prevent the mistake.

Additional context

The same limit is already computed for the Software Center by the list-modules action (install destinations with reject reason max_per_node_limit), so the logic can be reused.

[gsanchietti]

Fresh install:

curl https://raw.githubusercontent.com/NethServer/ns8-core/main/core/install.sh > install.sh
bash install.sh ghcr.io/nethserver/core:latest ghcr.io/nethserver/core:add-module-max-per-node

Update an existing cluster (docs):
update-core ghcr.io/nethserver/core:add-module-max-per-node

Test case 1

• On the leader, run add-module crowdsec 1. CrowdSec is installed as crowdsec1.
• Run add-module crowdsec 1 again. The command must fails with: Node 1 has reached the max-per-node limit of 1 for ghcr.io/nethserver/crowdsec. Existing instances: crowdsec1. Use --force to ignore the limit
• Open the Software Center and check that only one CrowdSec instance is listed.

Test case 2: install by image address

• On a node with CrowdSec, run add-module ghcr.io/nethserver/crowdsec:latest 1. It fails with the same message.

Test case 3: force the install

• Run add-module --force crowdsec 1. A second instance, crowdsec2, is installed.
• Remove it with remove-module --no-preserve crowdsec2.

Test case 4: application without a limit

• Install twice an applications that does not have any node limit. Both instances are installed, as before.
• Remove the test instances.

Test case 5: multi-node cluster

• On the leader, run add-module crowdsec 2. CrowdSec is installed on node 2, because the limit applies to each node separately.
• On the worker node, run add-module crowdsec 2. It fails at once with add-module must be run on the leader node, and nothing is downloaded.