Codex
316 lines
16 KiB
TypeScript
316 lines
16 KiB
TypeScript
// SPEC: PJ2026-01060703 CI/CD branch follower controller render helpers.
|
|
// Responsibility: Kubernetes controller/reconcile Job manifests and controller bootstrap scripts.
|
|
import { createHash } from "node:crypto";
|
|
import { readFileSync } from "node:fs";
|
|
import { rootPath } from "./config";
|
|
import { shQuote } from "./platform-infra-ops-library";
|
|
import type { BranchFollowerDebugStep, BranchFollowerRegistry, ParsedOptions } from "./cicd-types";
|
|
|
|
const SPEC_REF = "PJ2026-01060703";
|
|
|
|
export function renderControllerReconcileJob(registry: BranchFollowerRegistry, options: ParsedOptions, jobName: string, mode: { dryRun: boolean; wait?: boolean; recordState: boolean }, timeoutSeconds: number): Record<string, unknown> {
|
|
const labels = { ...registry.controller.labels, "app.kubernetes.io/component": "cicd-reconcile-job" };
|
|
const commandArgs = [
|
|
"bun",
|
|
"scripts/cli.ts",
|
|
"cicd",
|
|
"branch-follower",
|
|
"run-once",
|
|
...(options.followerId === null ? ["--all"] : ["--follower", options.followerId]),
|
|
mode.dryRun ? "--dry-run" : "--confirm",
|
|
"--wait",
|
|
"--in-cluster",
|
|
"--config",
|
|
"config/cicd-branch-followers.yaml",
|
|
"--timeout-seconds",
|
|
String(timeoutSeconds),
|
|
...(mode.recordState ? ["--record-state"] : []),
|
|
];
|
|
return {
|
|
apiVersion: "batch/v1",
|
|
kind: "Job",
|
|
metadata: { name: jobName, namespace: registry.controller.namespace, labels },
|
|
spec: {
|
|
backoffLimit: registry.controller.budgets.reconcileJobBackoffLimit,
|
|
ttlSecondsAfterFinished: registry.controller.budgets.reconcileJobTtlSeconds,
|
|
activeDeadlineSeconds: timeoutSeconds + registry.controller.budgets.reconcileJobDeadlineGraceSeconds,
|
|
template: {
|
|
metadata: { labels },
|
|
spec: {
|
|
restartPolicy: "Never",
|
|
serviceAccountName: registry.controller.serviceAccountName,
|
|
volumes: [
|
|
{ name: "registry", configMap: { name: registry.controller.configMapName, defaultMode: 0o755 } },
|
|
{ name: "git-mirror-cache", persistentVolumeClaim: { claimName: registry.controller.source.gitMirrorCachePvcName } },
|
|
{ name: "git-ssh", secret: { secretName: registry.controller.source.githubSsh.secretName, defaultMode: 0o400 } },
|
|
{ name: "work", emptyDir: {} },
|
|
],
|
|
containers: [
|
|
{
|
|
name: "reconcile",
|
|
image: registry.controller.image,
|
|
imagePullPolicy: "IfNotPresent",
|
|
command: ["/bin/sh", "/etc/unidesk-cicd-branch-follower/controller-one-shot.sh"],
|
|
args: commandArgs,
|
|
env: [
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_BRANCH", value: registry.controller.source.branch },
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_REPOSITORY", value: registry.controller.source.repository },
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_SNAPSHOT_PREFIX", value: registry.controller.source.sourceSnapshot.stageRefPrefix.replaceAll("{branch}", registry.controller.source.branch) },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_SSH_PRIVATE_KEY", value: `/git-ssh/${registry.controller.source.githubSsh.privateKeySecretKey}` },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_PROXY_HOST", value: registry.controller.source.githubSsh.proxyHost },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_PROXY_PORT", value: String(registry.controller.source.githubSsh.proxyPort) },
|
|
],
|
|
volumeMounts: [
|
|
{ name: "registry", mountPath: "/etc/unidesk-cicd-branch-follower", readOnly: true },
|
|
{ name: "git-mirror-cache", mountPath: "/cache" },
|
|
{ name: "git-ssh", mountPath: "/git-ssh", readOnly: true },
|
|
{ name: "work", mountPath: "/work" },
|
|
],
|
|
},
|
|
],
|
|
},
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
export function renderControllerDebugJob(registry: BranchFollowerRegistry, options: ParsedOptions, jobName: string, step: BranchFollowerDebugStep, timeoutSeconds: number): Record<string, unknown> {
|
|
if (options.followerId === null) throw new Error("debug-step target job requires --follower <id>");
|
|
const labels = { ...registry.controller.labels, "app.kubernetes.io/component": "cicd-debug-job" };
|
|
const commandArgs = [
|
|
"bun",
|
|
"scripts/cli.ts",
|
|
"cicd",
|
|
"branch-follower",
|
|
"debug-step",
|
|
"--follower",
|
|
options.followerId,
|
|
"--step",
|
|
step,
|
|
options.confirm ? "--confirm" : "--dry-run",
|
|
"--in-cluster",
|
|
"--config",
|
|
"config/cicd-branch-followers.yaml",
|
|
"--timeout-seconds",
|
|
String(timeoutSeconds),
|
|
"--json",
|
|
];
|
|
return {
|
|
apiVersion: "batch/v1",
|
|
kind: "Job",
|
|
metadata: { name: jobName, namespace: registry.controller.namespace, labels },
|
|
spec: {
|
|
backoffLimit: registry.controller.budgets.reconcileJobBackoffLimit,
|
|
ttlSecondsAfterFinished: registry.controller.budgets.reconcileJobTtlSeconds,
|
|
activeDeadlineSeconds: timeoutSeconds + registry.controller.budgets.reconcileJobDeadlineGraceSeconds,
|
|
template: {
|
|
metadata: { labels },
|
|
spec: {
|
|
restartPolicy: "Never",
|
|
serviceAccountName: registry.controller.serviceAccountName,
|
|
volumes: [
|
|
{ name: "registry", configMap: { name: registry.controller.configMapName, defaultMode: 0o755 } },
|
|
{ name: "git-mirror-cache", persistentVolumeClaim: { claimName: registry.controller.source.gitMirrorCachePvcName } },
|
|
{ name: "git-ssh", secret: { secretName: registry.controller.source.githubSsh.secretName, defaultMode: 0o400 } },
|
|
{ name: "work", emptyDir: {} },
|
|
],
|
|
containers: [
|
|
{
|
|
name: "debug",
|
|
image: registry.controller.image,
|
|
imagePullPolicy: "IfNotPresent",
|
|
command: ["/bin/sh", "/etc/unidesk-cicd-branch-follower/controller-one-shot.sh"],
|
|
args: commandArgs,
|
|
env: [
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_BRANCH", value: registry.controller.source.branch },
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_REPOSITORY", value: registry.controller.source.repository },
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_SNAPSHOT_PREFIX", value: registry.controller.source.sourceSnapshot.stageRefPrefix.replaceAll("{branch}", registry.controller.source.branch) },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_SSH_PRIVATE_KEY", value: `/git-ssh/${registry.controller.source.githubSsh.privateKeySecretKey}` },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_PROXY_HOST", value: registry.controller.source.githubSsh.proxyHost },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_PROXY_PORT", value: String(registry.controller.source.githubSsh.proxyPort) },
|
|
],
|
|
volumeMounts: [
|
|
{ name: "registry", mountPath: "/etc/unidesk-cicd-branch-follower", readOnly: true },
|
|
{ name: "git-mirror-cache", mountPath: "/cache" },
|
|
{ name: "git-ssh", mountPath: "/git-ssh", readOnly: true },
|
|
{ name: "work", mountPath: "/work" },
|
|
],
|
|
},
|
|
],
|
|
},
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
export function waitForJobShell(namespace: string, jobName: string, timeoutSeconds: number): string {
|
|
return [
|
|
`NAMESPACE=${shQuote(namespace)}`,
|
|
`JOB_NAME=${shQuote(jobName)}`,
|
|
`TIMEOUT_SECONDS=${shQuote(String(timeoutSeconds))}`,
|
|
"export NAMESPACE JOB_NAME TIMEOUT_SECONDS",
|
|
nativeCicdScript("wait-job.sh"),
|
|
].join("\n");
|
|
}
|
|
|
|
export function renderControllerManifests(registry: BranchFollowerRegistry): Record<string, unknown>[] {
|
|
const labels = registry.controller.labels;
|
|
const selector = labels;
|
|
const controllerConfigData = {
|
|
"cicd-branch-followers.yaml": registry.rawText,
|
|
"sync-source.sh": nativeCicdScript("sync-source.sh"),
|
|
"controller-one-shot.sh": nativeCicdScript("controller-one-shot.sh"),
|
|
"controller-loop.sh": nativeCicdScript("controller-loop.sh"),
|
|
"hwlab-node-control-plane-refresh.mjs": nativeCicdScript("hwlab-node-control-plane-refresh.mjs"),
|
|
"github-proxy-connect.mjs": nativeCicdScript("github-proxy-connect.mjs"),
|
|
"git-ssh-proxy.sh": nativeCicdScript("git-ssh-proxy.sh"),
|
|
"runtime-gitops-observability.mjs": nativeHwlabScript("runtime-gitops-observability.mjs"),
|
|
"runtime-gitops-postprocess.mjs": nativeHwlabScript("runtime-gitops-postprocess.mjs"),
|
|
"runtime-gitops-verify.mjs": nativeHwlabScript("runtime-gitops-verify.mjs"),
|
|
};
|
|
const controllerConfigSha = sha256(JSON.stringify(controllerConfigData));
|
|
return [
|
|
{
|
|
apiVersion: "v1",
|
|
kind: "Namespace",
|
|
metadata: { name: registry.controller.namespace, labels },
|
|
},
|
|
{
|
|
apiVersion: "v1",
|
|
kind: "ServiceAccount",
|
|
metadata: { name: registry.controller.serviceAccountName, namespace: registry.controller.namespace, labels },
|
|
},
|
|
{
|
|
apiVersion: "rbac.authorization.k8s.io/v1",
|
|
kind: "Role",
|
|
metadata: { name: registry.controller.serviceAccountName, namespace: registry.controller.namespace, labels },
|
|
rules: [
|
|
{ apiGroups: [""], resources: ["configmaps", "pods", "events"], verbs: ["get", "list", "watch", "create", "update", "patch"] },
|
|
{ apiGroups: ["apps"], resources: ["deployments"], verbs: ["get", "list", "watch"] },
|
|
{ apiGroups: ["batch"], resources: ["jobs"], verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] },
|
|
{ apiGroups: ["coordination.k8s.io"], resources: ["leases"], verbs: ["get", "list", "watch", "create", "update", "patch"] },
|
|
],
|
|
},
|
|
{
|
|
apiVersion: "rbac.authorization.k8s.io/v1",
|
|
kind: "RoleBinding",
|
|
metadata: { name: registry.controller.serviceAccountName, namespace: registry.controller.namespace, labels },
|
|
subjects: [{ kind: "ServiceAccount", name: registry.controller.serviceAccountName, namespace: registry.controller.namespace }],
|
|
roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: registry.controller.serviceAccountName },
|
|
},
|
|
{
|
|
apiVersion: "rbac.authorization.k8s.io/v1",
|
|
kind: "ClusterRole",
|
|
metadata: { name: registry.controller.serviceAccountName, labels },
|
|
rules: [
|
|
{ apiGroups: [""], resources: ["pods", "pods/log", "events"], verbs: ["get", "list", "watch"] },
|
|
{ apiGroups: [""], resources: ["configmaps"], verbs: ["get", "list", "watch", "create", "update", "patch"] },
|
|
{ apiGroups: [""], resources: ["pods/exec"], verbs: ["create"] },
|
|
{ apiGroups: ["batch"], resources: ["jobs"], verbs: ["get", "list", "watch", "create", "delete"] },
|
|
{ apiGroups: ["apps"], resources: ["deployments", "statefulsets"], verbs: ["get", "list", "watch"] },
|
|
{ apiGroups: ["tekton.dev"], resources: ["pipelineruns"], verbs: ["get", "list", "watch", "create", "patch", "delete"] },
|
|
{ apiGroups: ["tekton.dev"], resources: ["pipelines"], verbs: ["get", "list", "watch", "create", "update", "patch"] },
|
|
{ apiGroups: ["tekton.dev"], resources: ["taskruns"], verbs: ["get", "list", "watch"] },
|
|
{ apiGroups: ["argoproj.io"], resources: ["applications"], verbs: ["get", "list", "watch", "patch"] },
|
|
],
|
|
},
|
|
{
|
|
apiVersion: "rbac.authorization.k8s.io/v1",
|
|
kind: "ClusterRoleBinding",
|
|
metadata: { name: registry.controller.serviceAccountName, labels },
|
|
subjects: [{ kind: "ServiceAccount", name: registry.controller.serviceAccountName, namespace: registry.controller.namespace }],
|
|
roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: registry.controller.serviceAccountName },
|
|
},
|
|
{
|
|
apiVersion: "v1",
|
|
kind: "ConfigMap",
|
|
metadata: { name: registry.controller.configMapName, namespace: registry.controller.namespace, labels },
|
|
data: controllerConfigData,
|
|
},
|
|
{
|
|
apiVersion: "v1",
|
|
kind: "ConfigMap",
|
|
metadata: { name: registry.controller.stateConfigMapName, namespace: registry.controller.namespace, labels },
|
|
data: {
|
|
_createdAt: new Date().toISOString(),
|
|
_specRef: SPEC_REF,
|
|
_registrySha256: registry.rawSha256,
|
|
_controllerConfigSha256: controllerConfigSha,
|
|
},
|
|
},
|
|
{
|
|
apiVersion: "coordination.k8s.io/v1",
|
|
kind: "Lease",
|
|
metadata: { name: registry.controller.leaseName, namespace: registry.controller.namespace, labels },
|
|
spec: { holderIdentity: "unidesk-cicd-branch-follower", leaseDurationSeconds: registry.controller.loop.leaseDurationSeconds },
|
|
},
|
|
{
|
|
apiVersion: "apps/v1",
|
|
kind: "Deployment",
|
|
metadata: { name: registry.controller.deploymentName, namespace: registry.controller.namespace, labels },
|
|
spec: {
|
|
replicas: 1,
|
|
selector: { matchLabels: selector },
|
|
template: {
|
|
metadata: {
|
|
labels: selector,
|
|
annotations: {
|
|
"unidesk.pikapython.com/spec-ref": SPEC_REF,
|
|
"unidesk.pikapython.com/registry-sha256": registry.rawSha256,
|
|
"unidesk.pikapython.com/controller-config-sha256": controllerConfigSha,
|
|
"unidesk.pikapython.com/host-worktree-authority": "false",
|
|
},
|
|
},
|
|
spec: {
|
|
serviceAccountName: registry.controller.serviceAccountName,
|
|
terminationGracePeriodSeconds: registry.controller.loop.terminationGracePeriodSeconds,
|
|
volumes: [
|
|
{ name: "registry", configMap: { name: registry.controller.configMapName, defaultMode: 0o755 } },
|
|
{ name: "git-mirror-cache", persistentVolumeClaim: { claimName: registry.controller.source.gitMirrorCachePvcName } },
|
|
{ name: "git-ssh", secret: { secretName: registry.controller.source.githubSsh.secretName, defaultMode: 0o400 } },
|
|
{ name: "work", emptyDir: {} },
|
|
],
|
|
containers: [
|
|
{
|
|
name: "controller",
|
|
image: registry.controller.image,
|
|
imagePullPolicy: "IfNotPresent",
|
|
command: ["/bin/sh", "/etc/unidesk-cicd-branch-follower/controller-loop.sh"],
|
|
env: [
|
|
{ name: "UNIDESK_CICD_BRANCH_FOLLOWER_INTERVAL_SECONDS", value: String(registry.controller.loop.intervalSeconds) },
|
|
{ name: "UNIDESK_CICD_BRANCH_FOLLOWER_TIMEOUT_SECONDS", value: String(registry.controller.loop.reconcileTimeoutSeconds) },
|
|
{ name: "UNIDESK_CONTROLLER_GIT_MIRROR_READ_URL", value: registry.controller.source.gitMirrorReadUrl },
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_BRANCH", value: registry.controller.source.branch },
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_REPOSITORY", value: registry.controller.source.repository },
|
|
{ name: "UNIDESK_CONTROLLER_SOURCE_SNAPSHOT_PREFIX", value: registry.controller.source.sourceSnapshot.stageRefPrefix.replaceAll("{branch}", registry.controller.source.branch) },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_SSH_PRIVATE_KEY", value: `/git-ssh/${registry.controller.source.githubSsh.privateKeySecretKey}` },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_PROXY_HOST", value: registry.controller.source.githubSsh.proxyHost },
|
|
{ name: "UNIDESK_CONTROLLER_GITHUB_PROXY_PORT", value: String(registry.controller.source.githubSsh.proxyPort) },
|
|
],
|
|
volumeMounts: [
|
|
{ name: "registry", mountPath: "/etc/unidesk-cicd-branch-follower", readOnly: true },
|
|
{ name: "git-mirror-cache", mountPath: "/cache" },
|
|
{ name: "git-ssh", mountPath: "/git-ssh", readOnly: true },
|
|
{ name: "work", mountPath: "/work" },
|
|
],
|
|
},
|
|
],
|
|
},
|
|
},
|
|
},
|
|
},
|
|
];
|
|
}
|
|
|
|
function nativeCicdScript(name: string): string {
|
|
return readFileSync(rootPath("scripts/native/cicd", name), "utf8");
|
|
}
|
|
|
|
function nativeHwlabScript(name: string): string {
|
|
return readFileSync(rootPath("scripts/native/hwlab", name), "utf8");
|
|
}
|
|
|
|
function sha256(value: string): string {
|
|
return createHash("sha256").update(value).digest("hex");
|
|
}
|