chore(microvm): remove legacy LB Alpine image build pipeline

Phase 3 microvm removal — strip the PC-machine LB image build
artifacts that direct-boot no longer needs. The microvm initramfs
already carries lb-agent + HAProxy via build-microvm-image, so the
lb.conf manifest, lb-setup.sh chroot script, build-lb-image target,
dev-install / reset-dev-env import steps, and ansible LB-image tasks
all become dead.

build-system-image stays — other manifests (e.g. GPU images) still
use it.

Makefile

@@ -79,9 +79,6 @@ ifndef IMAGE
 endif
 	./scripts/build-system-image.sh scripts/images/$(IMAGE).conf
 
-build-lb-image: ## Build LB Alpine image
-	$(MAKE) build-system-image IMAGE=lb
-
 MICROVM_OUT_DIR := build/microvm
 MICROVM_ARTIFACTS := $(MICROVM_OUT_DIR)/vmlinuz $(MICROVM_OUT_DIR)/initramfs.cpio.gz
 MICROVM_INPUTS := scripts/build-microvm-image.sh $(MICROVM_OUT_DIR)/init.sh $(MICROVM_OUT_DIR)/inittab bin/lb-agent
@@ -278,7 +275,7 @@ ansible-dev-reset:
 ansible-dev-deploy:
 	cd scripts/ansible && ansible-playbook playbooks/dev-deploy.yml
 
-.PHONY: build build-ui build-installer build-lb-agent build-system-image build-lb-image build-microvm-image install-microvm go_build go_run preflight test test-cover test-race diff-coverage bench run \
+.PHONY: build build-ui build-installer build-lb-agent build-system-image build-microvm-image install-microvm go_build go_run preflight test test-cover test-race diff-coverage bench run \
 	deploy reinstall clean \
 	install-system install-go install-aws quickinstall \
 	lint fix govulncheck \

scripts/ansible/README.md

@@ -84,7 +84,6 @@ Useful overrides:
 | `spinifex_region` | `ap-southeast-2` | Region passed to `spx admin init` |
 | `spinifex_az` | `{{ region }}a` | AZ passed to `spx admin init` |
 | `spinifex_external_mode` | `pool` | `pool` \| `nat` external networking |
-| `spinifex_build_lb_image` | `true` | Build + import LB system image after init |
 
 `dev-reset.yml` automatically captures `region`, `az`, `external_mode`,
 pool range, gateway, prefix-len, nat gateway_ip from the existing

scripts/ansible/roles/init/tasks/main.yml

@@ -74,19 +74,6 @@
   delay: 2
   changed_when: false
 
-- name: init — build LB agent
-  ansible.builtin.command:
-    cmd: make build-lb-agent
-    chdir: "{{ spinifex_root }}"
-  changed_when: true
-  when: spinifex_build_lb_image | bool
-
-- name: init — import LB system image
-  ansible.builtin.command:
-    cmd: "{{ spinifex_root }}/scripts/build-system-image.sh {{ spinifex_lb_image_conf }} --import --quiet"
-  changed_when: true
-  when: spinifex_build_lb_image | bool
-
 - name: init — summary
   ansible.builtin.debug:
     msg: |
@@ -95,4 +82,3 @@
         external_mode={{ spinifex_external_mode }}
         spinifex.target: started
         CA: {{ spinifex_ca_trust_path }}
-        LB image: {{ 'imported' if spinifex_build_lb_image else 'skipped' }}

scripts/ansible/vars/defaults.yml

@@ -79,10 +79,6 @@ mulga_root: "{{ lookup('pipe', 'readlink -f ' ~ playbook_dir ~ '/../../../..') }
 # Build output.
 build_tarball_path: /tmp/spinifex-local.tar.gz
 
-# LB system image (built + imported at end of init).
-spinifex_build_lb_image: true
-spinifex_lb_image_conf: "{{ spinifex_root }}/scripts/images/lb.conf"
-
 # Smoketest image — parameterised so tofu examples can share the same base.
 spinifex_smoketest_distro: debian
 spinifex_smoketest_version: "13"

scripts/dev-install.sh

@@ -91,12 +91,8 @@ if ! id -Gn 2>/dev/null | grep -qw spinifex; then
     newgrp spinifex
 fi
 
-echo "=== Building and importing LB image ==="
-cd "$PROJECT_ROOT" && make build-lb-agent
-"$PROJECT_ROOT/scripts/build-system-image.sh" "$PROJECT_ROOT/scripts/images/lb.conf" --import --quiet
-
 echo "=== Building and installing microVM artifacts ==="
-cd "$PROJECT_ROOT" && make install-microvm
+cd "$PROJECT_ROOT" && make build-lb-agent install-microvm
 
 echo "=== Done ==="
 echo "Services: sudo systemctl status spinifex.target"

scripts/images/lb-setup.sh

@@ -1,55 +0,0 @@
-#!/bin/sh
-# lb-setup.sh — LB-specific chroot setup
-#
-# Runs inside the Alpine image chroot after packages are installed.
-# Sets up HAProxy placeholder config and lb-agent OpenRC init script.
-# The lb-agent polls the AWS gateway for config updates and reports health
-# via SigV4-signed HTTP requests. Credentials come from cloud-init env vars.
-
-set -e
-
-# Create haproxy config directory and placeholder config.
-mkdir -p /etc/haproxy
-cat > /etc/haproxy/haproxy.cfg <<'EOF'
-# Placeholder config — replaced by lb-agent on first config fetch
-global
-    daemon
-    maxconn 256
-
-defaults
-    mode http
-    timeout connect 5s
-    timeout client 30s
-    timeout server 30s
-EOF
-
-# Create lb-agent OpenRC init script
-mkdir -p /etc/init.d
-cat > /etc/init.d/lb-agent <<'INITSCRIPT'
-#!/sbin/openrc-run
-
-description="LB Gateway Config Agent"
-command="/usr/local/bin/lb-agent"
-command_args="--lb-id=${LB_LB_ID:-unknown} --gateway=${LB_GATEWAY_URL} --access-key=${LB_ACCESS_KEY} --secret-key=${LB_SECRET_KEY}"
-command_background=true
-pidfile="/run/lb-agent.pid"
-output_log="/var/log/lb-agent.log"
-error_log="/var/log/lb-agent.log"
-
-depend() {
-    need net
-    after firewall
-}
-INITSCRIPT
-chmod 755 /etc/init.d/lb-agent
-
-# Move networking from boot to default runlevel so cloud-init can write
-# the network config before the networking service starts. Without this,
-# Alpine's networking service races cloud-init and starts with no config.
-rc-update del networking boot 2>/dev/null || true
-rc-update add networking default
-
-# Do NOT enable lb-agent at boot — cloud-init must write
-# /etc/conf.d/lb-agent (with LB_LB_ID, LB_GATEWAY_URL, LB_ACCESS_KEY,
-# LB_SECRET_KEY) before the service starts.
-# Cloud-init runcmd starts the service after write_files.

scripts/images/lb.conf

@@ -1,26 +0,0 @@
-# LB system image manifest
-# Used by build-system-image.sh to create an Alpine AMI with HAProxy + lb-agent
-
-IMAGE_NAME="lb"
-IMAGE_DESCRIPTION="LB VM with HAProxy and lb-agent"
-ALPINE_VERSION="3.21.6"
-IMAGE_SIZE="256M"
-
-# Tag applied to the imported AMI so the daemon can discover this as the
-# system image for ELBv2 load balancers. Must match tags.ManagedByELBv2.
-SYSTEM_TAG="spinifex:managed-by=elbv2"
-
-# Packages to install via apk
-APK_PACKAGES="haproxy curl ca-certificates"
-
-# Binaries to copy into the image (source:destination)
-INSTALL_BINARIES="bin/lb-agent:/usr/local/bin/lb-agent"
-
-# Build command for binaries (run before image build)
-BUILD_COMMANDS="make build-lb-agent"
-
-# OpenRC services to enable at boot
-ENABLE_SERVICES="haproxy"
-
-# Custom setup script (runs inside chroot after packages are installed)
-SETUP_SCRIPT="scripts/images/lb-setup.sh"

scripts/reset-dev-env.sh

@@ -268,14 +268,9 @@ sudo systemctl start spinifex.target
 # Wait for services to start
 sleep 5
 
-# --- Build + import LB image (needs services running) ---
-echo "==> Building and importing LB image"
-cd "$PROJECT_ROOT" && make build-lb-agent
-"$PROJECT_ROOT/scripts/build-system-image.sh" "$PROJECT_ROOT/scripts/images/lb.conf" --import --quiet
-
 # --- Build + install microVM artifacts (kernel + initramfs for direct-boot LBs) ---
 echo "==> Building and installing microVM artifacts"
-cd "$PROJECT_ROOT" && make install-microvm
+cd "$PROJECT_ROOT" && make build-lb-agent install-microvm
 
 # --- Smoke test ---
 sudo -u "$INVOKING_USER" "$SCRIPT_DIR/smoke-test.sh"