test: add deploy json executor drift preflight
This commit is contained in:
Codex
@@ -0,0 +1,407 @@
|
||||
import { readFileSync } from "node:fs";
|
||||
import { rootPath } from "./config";
|
||||
|
||||
export type DeployJsonEnvironment = "dev" | "prod";
|
||||
|
||||
export interface DeployJsonArtifactContract {
|
||||
kind: "source-build";
|
||||
repository: string;
|
||||
tag: "commitId";
|
||||
}
|
||||
|
||||
export interface DeployJsonConsumerTargetContract {
|
||||
namespace: string;
|
||||
deployment: string;
|
||||
service: string;
|
||||
containerName: string;
|
||||
stableImage: string;
|
||||
manifestRepoPath: string;
|
||||
}
|
||||
|
||||
export interface DeployJsonConsumerContract {
|
||||
kind: "d601-k3s-managed";
|
||||
dev?: { enabled: boolean };
|
||||
prod?: { enabled: boolean };
|
||||
supportLevel: "reviewed";
|
||||
targetRef: string;
|
||||
noRuntimeSourceBuild: boolean;
|
||||
target: DeployJsonConsumerTargetContract;
|
||||
}
|
||||
|
||||
export interface DeployJsonRuntimeContract {
|
||||
containerPort: number;
|
||||
healthPath: string;
|
||||
memory: {
|
||||
request: string;
|
||||
limit: string;
|
||||
};
|
||||
health?: {
|
||||
deployMetadataRequired: boolean;
|
||||
};
|
||||
}
|
||||
|
||||
export interface DeployJsonServiceContract {
|
||||
id: string;
|
||||
repo: string;
|
||||
commitId: string;
|
||||
artifact?: DeployJsonArtifactContract;
|
||||
consumer?: DeployJsonConsumerContract;
|
||||
runtime?: DeployJsonRuntimeContract;
|
||||
}
|
||||
|
||||
export interface DeployJsonDriftItem {
|
||||
surface: string;
|
||||
path?: string;
|
||||
field: string;
|
||||
expected: unknown;
|
||||
actual: unknown;
|
||||
}
|
||||
|
||||
export interface DeployJsonExecutorMirror {
|
||||
surface: string;
|
||||
path?: string;
|
||||
artifact?: {
|
||||
kind?: string;
|
||||
repository?: string;
|
||||
tag?: string;
|
||||
};
|
||||
consumer?: {
|
||||
kind?: string;
|
||||
noRuntimeSourceBuild?: boolean;
|
||||
target?: Partial<DeployJsonConsumerTargetContract>;
|
||||
};
|
||||
runtime?: {
|
||||
containerPort?: number;
|
||||
servicePort?: number;
|
||||
healthPath?: string;
|
||||
memory?: {
|
||||
request?: string;
|
||||
limit?: string;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
function asRecord(value: unknown, path: string): Record<string, unknown> {
|
||||
if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${path} must be an object`);
|
||||
return value as Record<string, unknown>;
|
||||
}
|
||||
|
||||
function optionalRecord(value: unknown, path: string): Record<string, unknown> | undefined {
|
||||
if (value === undefined) return undefined;
|
||||
return asRecord(value, path);
|
||||
}
|
||||
|
||||
function stringField(record: Record<string, unknown>, key: string, path: string): string {
|
||||
const value = record[key];
|
||||
if (typeof value !== "string" || value.length === 0) throw new Error(`${path}.${key} must be a non-empty string`);
|
||||
return value;
|
||||
}
|
||||
|
||||
function numberField(record: Record<string, unknown>, key: string, path: string): number {
|
||||
const value = record[key];
|
||||
if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) throw new Error(`${path}.${key} must be a positive integer`);
|
||||
return value;
|
||||
}
|
||||
|
||||
function booleanField(record: Record<string, unknown>, key: string, path: string): boolean {
|
||||
const value = record[key];
|
||||
if (typeof value !== "boolean") throw new Error(`${path}.${key} must be a boolean`);
|
||||
return value;
|
||||
}
|
||||
|
||||
function assertKnownKeys(record: Record<string, unknown>, allowed: string[], path: string): void {
|
||||
const unknown = Object.keys(record).filter((key) => !allowed.includes(key));
|
||||
if (unknown.length > 0) throw new Error(`${path} contains unsupported deploy.json contract key(s): ${unknown.join(", ")}`);
|
||||
}
|
||||
|
||||
function parseArtifactContract(value: unknown, path: string): DeployJsonArtifactContract | undefined {
|
||||
const artifact = optionalRecord(value, path);
|
||||
if (artifact === undefined) return undefined;
|
||||
assertKnownKeys(artifact, ["kind", "repository", "tag"], path);
|
||||
const kind = stringField(artifact, "kind", path);
|
||||
if (kind !== "source-build") throw new Error(`${path}.kind must be source-build`);
|
||||
const tag = stringField(artifact, "tag", path);
|
||||
if (tag !== "commitId") throw new Error(`${path}.tag must be commitId`);
|
||||
return {
|
||||
kind,
|
||||
repository: stringField(artifact, "repository", path),
|
||||
tag,
|
||||
};
|
||||
}
|
||||
|
||||
function parseEnabled(value: unknown, path: string): { enabled: boolean } | undefined {
|
||||
const record = optionalRecord(value, path);
|
||||
if (record === undefined) return undefined;
|
||||
assertKnownKeys(record, ["enabled"], path);
|
||||
return { enabled: booleanField(record, "enabled", path) };
|
||||
}
|
||||
|
||||
function parseConsumerTarget(value: unknown, path: string): DeployJsonConsumerTargetContract {
|
||||
const target = asRecord(value, path);
|
||||
assertKnownKeys(target, ["namespace", "deployment", "service", "containerName", "stableImage", "manifestRepoPath"], path);
|
||||
return {
|
||||
namespace: stringField(target, "namespace", path),
|
||||
deployment: stringField(target, "deployment", path),
|
||||
service: stringField(target, "service", path),
|
||||
containerName: stringField(target, "containerName", path),
|
||||
stableImage: stringField(target, "stableImage", path),
|
||||
manifestRepoPath: stringField(target, "manifestRepoPath", path),
|
||||
};
|
||||
}
|
||||
|
||||
function parseConsumerContract(value: unknown, path: string): DeployJsonConsumerContract | undefined {
|
||||
const consumer = optionalRecord(value, path);
|
||||
if (consumer === undefined) return undefined;
|
||||
assertKnownKeys(consumer, ["kind", "dev", "prod", "supportLevel", "targetRef", "noRuntimeSourceBuild", "target"], path);
|
||||
const kind = stringField(consumer, "kind", path);
|
||||
if (kind !== "d601-k3s-managed") throw new Error(`${path}.kind must be d601-k3s-managed`);
|
||||
const supportLevel = stringField(consumer, "supportLevel", path);
|
||||
if (supportLevel !== "reviewed") throw new Error(`${path}.supportLevel must be reviewed`);
|
||||
return {
|
||||
kind,
|
||||
dev: parseEnabled(consumer.dev, `${path}.dev`),
|
||||
prod: parseEnabled(consumer.prod, `${path}.prod`),
|
||||
supportLevel,
|
||||
targetRef: stringField(consumer, "targetRef", path),
|
||||
noRuntimeSourceBuild: booleanField(consumer, "noRuntimeSourceBuild", path),
|
||||
target: parseConsumerTarget(consumer.target, `${path}.target`),
|
||||
};
|
||||
}
|
||||
|
||||
function parseRuntimeContract(value: unknown, path: string): DeployJsonRuntimeContract | undefined {
|
||||
const runtime = optionalRecord(value, path);
|
||||
if (runtime === undefined) return undefined;
|
||||
assertKnownKeys(runtime, ["containerPort", "healthPath", "memory", "health"], path);
|
||||
const memory = asRecord(runtime.memory, `${path}.memory`);
|
||||
assertKnownKeys(memory, ["request", "limit"], `${path}.memory`);
|
||||
const health = optionalRecord(runtime.health, `${path}.health`);
|
||||
if (health !== undefined) assertKnownKeys(health, ["deployMetadataRequired"], `${path}.health`);
|
||||
return {
|
||||
containerPort: numberField(runtime, "containerPort", path),
|
||||
healthPath: stringField(runtime, "healthPath", path),
|
||||
memory: {
|
||||
request: stringField(memory, "request", `${path}.memory`),
|
||||
limit: stringField(memory, "limit", `${path}.memory`),
|
||||
},
|
||||
health: health === undefined ? undefined : {
|
||||
deployMetadataRequired: booleanField(health, "deployMetadataRequired", `${path}.health`),
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export function parseDeployJsonServiceContract(value: unknown, path: string): DeployJsonServiceContract {
|
||||
const service = asRecord(value, path);
|
||||
assertKnownKeys(service, ["id", "repo", "commitId", "artifact", "consumer", "runtime"], path);
|
||||
const id = stringField(service, "id", path);
|
||||
const repo = stringField(service, "repo", path);
|
||||
const commitId = stringField(service, "commitId", path).toLowerCase();
|
||||
if (!/^[0-9a-f]{7,40}$/iu.test(commitId)) throw new Error(`${path}.commitId must be a 7-40 char git SHA`);
|
||||
return {
|
||||
id,
|
||||
repo,
|
||||
commitId,
|
||||
artifact: parseArtifactContract(service.artifact, `${path}.artifact`),
|
||||
consumer: parseConsumerContract(service.consumer, `${path}.consumer`),
|
||||
runtime: parseRuntimeContract(service.runtime, `${path}.runtime`),
|
||||
};
|
||||
}
|
||||
|
||||
export function parseDeployJsonServiceContractBase64(raw: string): DeployJsonServiceContract {
|
||||
const text = Buffer.from(raw, "base64").toString("utf8");
|
||||
return parseDeployJsonServiceContract(JSON.parse(text) as unknown, "deploy service contract");
|
||||
}
|
||||
|
||||
export function encodeDeployJsonServiceContract(service: DeployJsonServiceContract): string {
|
||||
return Buffer.from(JSON.stringify(service), "utf8").toString("base64");
|
||||
}
|
||||
|
||||
export function hasDeployJsonExecutorContract(service: DeployJsonServiceContract): boolean {
|
||||
return service.artifact !== undefined || service.consumer !== undefined || service.runtime !== undefined;
|
||||
}
|
||||
|
||||
export function deployJsonCommitImage(stableImage: string, commit: string): string {
|
||||
const lastSlash = stableImage.lastIndexOf("/");
|
||||
const tagIndex = stableImage.indexOf(":", lastSlash + 1);
|
||||
if (tagIndex === -1) return `${stableImage}:${commit}`;
|
||||
return `${stableImage.slice(0, tagIndex)}:${commit}`;
|
||||
}
|
||||
|
||||
export function deployJsonSourceOfTruth(service: DeployJsonServiceContract, environment: DeployJsonEnvironment): Record<string, unknown> {
|
||||
return {
|
||||
source: "deploy.json",
|
||||
environment,
|
||||
serviceId: service.id,
|
||||
servicePath: `environments.${environment}.services.${service.id}`,
|
||||
ownedFields: [
|
||||
...(service.artifact === undefined ? [] : ["artifact.kind", "artifact.repository", "artifact.tag"]),
|
||||
...(service.consumer === undefined ? [] : [
|
||||
"consumer.kind",
|
||||
`consumer.${environment}.enabled`,
|
||||
"consumer.supportLevel",
|
||||
"consumer.targetRef",
|
||||
"consumer.noRuntimeSourceBuild",
|
||||
"consumer.target.namespace",
|
||||
"consumer.target.deployment",
|
||||
"consumer.target.service",
|
||||
"consumer.target.containerName",
|
||||
"consumer.target.stableImage",
|
||||
"consumer.target.manifestRepoPath",
|
||||
]),
|
||||
...(service.runtime === undefined ? [] : [
|
||||
"runtime.containerPort",
|
||||
"runtime.healthPath",
|
||||
"runtime.memory.request",
|
||||
"runtime.memory.limit",
|
||||
"runtime.health.deployMetadataRequired",
|
||||
]),
|
||||
],
|
||||
};
|
||||
}
|
||||
|
||||
function pushDrift(items: DeployJsonDriftItem[], mirror: DeployJsonExecutorMirror, field: string, expected: unknown, actual: unknown): void {
|
||||
if (actual === undefined || expected === actual) return;
|
||||
items.push({ surface: mirror.surface, path: mirror.path, field, expected, actual });
|
||||
}
|
||||
|
||||
export function compareDeployJsonExecutorMirrors(
|
||||
service: DeployJsonServiceContract,
|
||||
_environment: DeployJsonEnvironment,
|
||||
mirrors: DeployJsonExecutorMirror[],
|
||||
): DeployJsonDriftItem[] {
|
||||
const items: DeployJsonDriftItem[] = [];
|
||||
for (const mirror of mirrors) {
|
||||
if (service.artifact !== undefined && mirror.artifact !== undefined) {
|
||||
pushDrift(items, mirror, "artifact.kind", service.artifact.kind, mirror.artifact.kind);
|
||||
pushDrift(items, mirror, "artifact.repository", service.artifact.repository, mirror.artifact.repository);
|
||||
pushDrift(items, mirror, "artifact.tag", service.artifact.tag, mirror.artifact.tag);
|
||||
}
|
||||
if (service.consumer !== undefined && mirror.consumer !== undefined) {
|
||||
pushDrift(items, mirror, "consumer.kind", service.consumer.kind, mirror.consumer.kind);
|
||||
pushDrift(items, mirror, "consumer.noRuntimeSourceBuild", service.consumer.noRuntimeSourceBuild, mirror.consumer.noRuntimeSourceBuild);
|
||||
const expectedTarget = service.consumer.target;
|
||||
const actualTarget = mirror.consumer.target;
|
||||
if (actualTarget !== undefined) {
|
||||
pushDrift(items, mirror, "consumer.target.namespace", expectedTarget.namespace, actualTarget.namespace);
|
||||
pushDrift(items, mirror, "consumer.target.deployment", expectedTarget.deployment, actualTarget.deployment);
|
||||
pushDrift(items, mirror, "consumer.target.service", expectedTarget.service, actualTarget.service);
|
||||
pushDrift(items, mirror, "consumer.target.containerName", expectedTarget.containerName, actualTarget.containerName);
|
||||
pushDrift(items, mirror, "consumer.target.stableImage", expectedTarget.stableImage, actualTarget.stableImage);
|
||||
pushDrift(items, mirror, "consumer.target.manifestRepoPath", expectedTarget.manifestRepoPath, actualTarget.manifestRepoPath);
|
||||
}
|
||||
}
|
||||
if (service.runtime !== undefined && mirror.runtime !== undefined) {
|
||||
pushDrift(items, mirror, "runtime.containerPort", service.runtime.containerPort, mirror.runtime.containerPort);
|
||||
pushDrift(items, mirror, "runtime.servicePort", service.runtime.containerPort, mirror.runtime.servicePort);
|
||||
pushDrift(items, mirror, "runtime.healthPath", service.runtime.healthPath, mirror.runtime.healthPath);
|
||||
pushDrift(items, mirror, "runtime.memory.request", service.runtime.memory.request, mirror.runtime.memory?.request);
|
||||
pushDrift(items, mirror, "runtime.memory.limit", service.runtime.memory.limit, mirror.runtime.memory?.limit);
|
||||
}
|
||||
}
|
||||
return items;
|
||||
}
|
||||
|
||||
function yamlDocuments(text: string): string[] {
|
||||
return text.split(/^---\s*$/mu).map((part) => part.trim()).filter((part) => part.length > 0);
|
||||
}
|
||||
|
||||
function yamlKind(documentText: string): string {
|
||||
return documentText.match(/^kind:\s*("?)([^"\s#]+)\1\s*$/mu)?.[2] ?? "";
|
||||
}
|
||||
|
||||
function yamlMetadataField(documentText: string, field: "name" | "namespace"): string {
|
||||
const metadataIndex = documentText.search(/^metadata:\s*$/mu);
|
||||
if (metadataIndex === -1) return "";
|
||||
const metadata = documentText.slice(metadataIndex);
|
||||
return metadata.match(new RegExp(`^ ${field}:\\s*("?)([^"\\n#]+)\\1\\s*$`, "mu"))?.[2]?.trim() ?? "";
|
||||
}
|
||||
|
||||
function yamlDocumentByKindName(documents: string[], kind: string, name: string): string {
|
||||
return documents.find((documentText) => yamlKind(documentText) === kind && yamlMetadataField(documentText, "name") === name) ?? "";
|
||||
}
|
||||
|
||||
function firstRegex(text: string, pattern: RegExp): string | undefined {
|
||||
return text.match(pattern)?.[1];
|
||||
}
|
||||
|
||||
function containerSegment(deploymentText: string, containerName: string): string {
|
||||
const escaped = containerName.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
|
||||
const match = new RegExp(`^ - name:\\s*${escaped}\\s*$`, "mu").exec(deploymentText);
|
||||
if (match === null) return "";
|
||||
const start = match.index;
|
||||
const rest = deploymentText.slice(start + match[0].length);
|
||||
const next = /^ - name:\s*\S+\s*$/mu.exec(rest);
|
||||
return deploymentText.slice(start, next === null ? undefined : start + match[0].length + next.index);
|
||||
}
|
||||
|
||||
export function k3sManifestExecutorMirror(service: DeployJsonServiceContract): DeployJsonExecutorMirror | null {
|
||||
const target = service.consumer?.target;
|
||||
if (service.consumer?.kind !== "d601-k3s-managed" || target === undefined) return null;
|
||||
const path = target.manifestRepoPath;
|
||||
const manifest = readFileSync(rootPath(path), "utf8");
|
||||
const documents = yamlDocuments(manifest);
|
||||
const deployment = yamlDocumentByKindName(documents, "Deployment", target.deployment);
|
||||
const serviceDoc = yamlDocumentByKindName(documents, "Service", target.service);
|
||||
const container = containerSegment(deployment, target.containerName);
|
||||
const containerPortRaw = firstRegex(container, /^\s+containerPort:\s*(\d+)\s*$/mu);
|
||||
const servicePortRaw = firstRegex(serviceDoc, /^\s+port:\s*(\d+)\s*$/mu);
|
||||
return {
|
||||
surface: "k8s-manifest",
|
||||
path,
|
||||
consumer: {
|
||||
kind: "d601-k3s-managed",
|
||||
noRuntimeSourceBuild: true,
|
||||
target: {
|
||||
namespace: yamlMetadataField(deployment, "namespace") || yamlMetadataField(serviceDoc, "namespace"),
|
||||
deployment: yamlMetadataField(deployment, "name"),
|
||||
service: yamlMetadataField(serviceDoc, "name"),
|
||||
containerName: firstRegex(container, /^ - name:\s*([^\s#]+)\s*$/mu),
|
||||
manifestRepoPath: path,
|
||||
},
|
||||
},
|
||||
runtime: {
|
||||
containerPort: containerPortRaw === undefined ? undefined : Number(containerPortRaw),
|
||||
servicePort: servicePortRaw === undefined ? undefined : Number(servicePortRaw),
|
||||
healthPath: firstRegex(container, /^\s+path:\s*([^\s#"]+)\s*$/mu),
|
||||
memory: {
|
||||
request: firstRegex(container, /^\s+requests:\s*$[\s\S]*?^\s+memory:\s*([^\s#"]+)\s*$/mu),
|
||||
limit: firstRegex(container, /^\s+limits:\s*$[\s\S]*?^\s+memory:\s*([^\s#"]+)\s*$/mu),
|
||||
},
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export function deployJsonDriftResult(
|
||||
service: DeployJsonServiceContract,
|
||||
environment: DeployJsonEnvironment,
|
||||
drifts: DeployJsonDriftItem[],
|
||||
): Record<string, unknown> {
|
||||
return {
|
||||
ok: false,
|
||||
supported: false,
|
||||
error: "deploy-json-drift",
|
||||
serviceId: service.id,
|
||||
environment,
|
||||
sourceOfTruth: deployJsonSourceOfTruth(service, environment),
|
||||
drift: {
|
||||
ok: false,
|
||||
count: drifts.length,
|
||||
items: drifts,
|
||||
},
|
||||
policy: "deploy.json is the only source for this executor contract; mirrored manifest, artifact-registry, CI catalog or config values must be regenerated or corrected before dry-run can proceed.",
|
||||
};
|
||||
}
|
||||
|
||||
export function readDeployJsonServiceContractFromFile(
|
||||
environment: DeployJsonEnvironment,
|
||||
serviceId: string,
|
||||
filePath = rootPath("deploy.json"),
|
||||
): DeployJsonServiceContract | null {
|
||||
const root = asRecord(JSON.parse(readFileSync(filePath, "utf8")) as unknown, "deploy.json");
|
||||
const environments = asRecord(root.environments, "deploy.json.environments");
|
||||
const environmentRecord = asRecord(environments[environment], `deploy.json.environments.${environment}`);
|
||||
const services = environmentRecord.services;
|
||||
if (!Array.isArray(services)) throw new Error(`deploy.json.environments.${environment}.services must be an array`);
|
||||
const index = services.findIndex((item) => asRecord(item, `deploy.json.environments.${environment}.services[]`).id === serviceId);
|
||||
if (index === -1) return null;
|
||||
return parseDeployJsonServiceContract(services[index], `deploy.json.environments.${environment}.services[${index}]`);
|
||||
}
|
||||
Reference in New Issue
Block a user