@alchemy.run/kubernetes 2.0.0-beta.84 → 2.0.0-beta.86

package/src/LocalCluster.ts

@@ -1,4 +1,4 @@
-import { Unowned } from "alchemy/AdoptPolicy";
+import { unownedUnlessPrevious } from "alchemy/AdoptPolicy";
 import { deepEqual, isResolved } from "alchemy/Diff";
 import { createPhysicalName } from "alchemy/PhysicalName";
 import * as Provider from "alchemy/Provider";
@@ -178,9 +178,21 @@ export interface LocalCluster extends Resource<
     connection: Connection;
   },
   {},
-  Providers
+  Providers,
+  LocalClusterLookup
 > {}
 
+/**
+ * Props for {@link LocalCluster.lookup}: find a kind cluster this
+ * stack doesn't manage by its name.
+ */
+export interface LocalClusterLookup {
+  /** kind cluster name. */
+  name: string;
+  /** Kubeconfig file the cluster's context is in. */
+  kubeconfig?: string;
+}
+
 /**
  * A Kubernetes cluster on your machine, for trying Alchemy's Kubernetes
  * resources and developing against them without a hosted cluster.
@@ -252,6 +264,17 @@ export interface LocalCluster extends Resource<
  * });
  * ```
  *
+ * ### Looking up an existing cluster
+ * `LocalCluster.lookup` references a kind cluster Alchemy doesn't manage (applied with
+ * `kubectl`, Helm or another stack). It is read during plan/deploy, never
+ * applied, updated or deleted.
+ *
+ * **Example:** Apply to an existing kind cluster
+ * ```typescript
+ * const cluster = Kubernetes.LocalCluster.lookup({ name: "dev" });
+ * yield* Kubernetes.Manifest("Settings", { cluster, manifest });
+ * ```
+ *
  * @resource
  * @product LocalCluster
  */
@@ -308,7 +331,7 @@ export const LocalClusterProvider = () =>
           detached: false,
           extendEnv: true,
         }).pipe(
-          spawner.spawn,
+          (command) => spawner.spawn(command),
           Effect.flatMap((child) =>
             Effect.all(
               {
@@ -559,7 +582,18 @@ export const LocalClusterProvider = () =>
             return { action: "replace", deleteFirst: true } as const;
           }
         }),
-        read: Effect.fn(function* ({ id, olds, output }) {
+        lookup: Effect.fn(function* ({ name, kubeconfig }) {
+          if (!(yield* clusterExists(name))) return undefined;
+          const registryInfo = yield* inspectRegistry(`${name}-registry`);
+          return toAttributes({
+            name,
+            kubeconfig,
+            registryPort: registryHostPort(registryInfo) ?? DEFAULT_REGISTRY_PORT,
+            architecture: yield* hostArchitecture,
+          });
+        }),
+
+        read: Effect.fn(function* ({ id, olds, output, previous }) {
           const name = yield* clusterName(id, olds, output);
           if (!(yield* clusterExists(name))) return undefined;
           const registryInfo = yield* inspectRegistry(`${name}-registry`);
@@ -574,7 +608,7 @@ export const LocalClusterProvider = () =>
           // kind clusters carry no ownership marker; the registry container
           // we start next to them does. Anything else is foreign.
           const owned = yield* hasAlchemyTags(id, registryInfo?.Config?.Labels ?? undefined);
-          return owned ? attrs : Unowned(attrs);
+          return owned ? attrs : unownedUnlessPrevious(attrs, previous, "name");
         }),
         reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const name = yield* clusterName(id, news, output);

package/src/Manifest.ts

@@ -2,6 +2,7 @@ import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
 import { Resource } from "alchemy/Resource";
 import { isPlainObject } from "alchemy/Util/data";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import {
   applyObject,
@@ -16,6 +17,11 @@ import { connectionIdentity, connectionOfOutput, tryConnectionOf } from "./inter
 import type { KubernetesObjectDefinition, KubernetesObjectRef } from "./Objects.ts";
 import type { Providers } from "./Providers.ts";
 
+export class ManifestInvalidProps extends Data.TaggedError("ManifestInvalidProps")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
 /**
  * A literal Kubernetes object: `apiVersion` + `kind` + `metadata`, with the
  * rest of the object's fields (`spec`, `data`, …) carried as-is. Any kind is
@@ -85,9 +91,27 @@ export interface Manifest extends Resource<
     observedHash?: string;
   },
   {},
-  Providers
+  Providers,
+  ManifestLookup
 > {}
 
+/**
+ * Props for {@link Manifest.lookup}: find an object this stack
+ * doesn't manage by its cluster, kind and name.
+ */
+export interface ManifestLookup {
+  /** The cluster the object lives in. */
+  cluster: ClusterLike;
+  /** API version, e.g. `apps/v1`. */
+  apiVersion: string;
+  /** Object kind, e.g. `Deployment`. */
+  kind: string;
+  /** Object name. */
+  name: string;
+  /** Namespace, for namespaced kinds. */
+  namespace?: string;
+}
+
 /**
  * Applies a raw Kubernetes manifest onto any cluster via server-side
  * apply.
@@ -161,6 +185,22 @@ export interface Manifest extends Resource<
  * });
  * ```
  *
+ * ### Looking up an existing object
+ * `Manifest.lookup` references an object Alchemy doesn't manage (applied with
+ * `kubectl`, Helm or another stack). It is read during plan/deploy, never
+ * applied, updated or deleted.
+ *
+ * **Example:** Reference an existing ConfigMap
+ * ```typescript
+ * const settings = Kubernetes.Manifest.lookup({
+ *   cluster,
+ *   apiVersion: "v1",
+ *   kind: "ConfigMap",
+ *   name: "app-settings",
+ *   namespace: "default",
+ * });
+ * ```
+ *
  * @resource
  * @product Manifest
  */
@@ -170,13 +210,13 @@ export const Manifest = Resource<Manifest>("Kubernetes.Manifest", {
 
 const toObjectDefinition = (
   manifest: KubernetesManifest,
-): Effect.Effect<KubernetesObjectDefinition, Error> => {
+): Effect.Effect<KubernetesObjectDefinition, ManifestInvalidProps> => {
   const name = manifest.metadata?.name;
   if (!name) {
     return Effect.fail(
-      new Error(
-        `Kubernetes.Manifest requires manifest.metadata.name (got ${manifest.apiVersion}/${manifest.kind})`,
-      ),
+      new ManifestInvalidProps({
+        message: `Kubernetes.Manifest requires manifest.metadata.name (got ${manifest.apiVersion}/${manifest.kind})`,
+      }),
     );
   }
   return Effect.succeed(manifest as KubernetesObjectDefinition);
@@ -210,6 +250,18 @@ export const ManifestProvider = () =>
             return { action: "replace" } as const;
           }
         }),
+        lookup: Effect.fn(function* ({ cluster, apiVersion, kind, name, namespace }) {
+          const connection = toConnection(cluster);
+          const ref: KubernetesObjectRef = { apiVersion, kind, name, namespace };
+          const transport = yield* connectCluster(connection);
+          const observed = yield* readObject({ transport, object: ref }).pipe(
+            Effect.catchTag("KubernetesNotFound", () => Effect.undefined),
+          );
+          if (!observed) return undefined;
+          const uid = (observed as { metadata?: { uid?: string } }).metadata?.uid;
+          return { connection, apiVersion, kind, name, namespace, ref, uid };
+        }),
+
         read: Effect.fn(function* ({ output, olds }) {
           if (!output) return undefined;
           const connection = connectionOfOutput(output);
@@ -219,7 +271,7 @@ export const ManifestProvider = () =>
           const observed = yield* readObject({
             transport,
             object: output.ref,
-          }).pipe(Effect.catchTag("KubernetesNotFound", () => Effect.succeed(undefined)));
+          }).pipe(Effect.catchTag("KubernetesNotFound", () => Effect.undefined));
           if (!observed) return undefined;
           const uid = (observed as { metadata?: { uid?: string } }).metadata?.uid;
           const attrs = { ...output, uid };

package/src/internal/helm.ts

@@ -116,7 +116,7 @@ export const renderHelmChart = Effect.fn(function* (options: RenderHelmChartOpti
         detached: false,
         extendEnv: true,
       }).pipe(
-        spawner.spawn,
+        (command) => spawner.spawn(command),
         Effect.flatMap((child) =>
           Effect.all(
             {

package/src/internal/kubeconfig.ts

@@ -6,10 +6,13 @@
  * path: AKS/GKE/EKS CLI-managed contexts work through their exec plugins
  * (`kubelogin`, `gke-gcloud-auth-plugin`, `aws eks get-token`).
  */
+import * as Clock from "effect/Clock";
 import * as Config from "effect/Config";
 import * as Data from "effect/Data";
+import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
@@ -76,6 +79,8 @@ const decodeBase64 = (value: string) => Buffer.from(value, "base64").toString("u
 
 const expandHome = Effect.fn(function* (input: string) {
   if (!input.startsWith("~")) return input;
+  // `~` is the user's real home directory, not a configured value.
+  // oxlint-disable-next-line effecttsgo/process-env-in-effect -- home expansion reads the real process env
   const home = yield* Effect.sync(() => process.env.HOME ?? process.env.USERPROFILE);
   if (!home) {
     return yield* new KubeConfigError({
@@ -199,7 +204,7 @@ export const runExecCredential = Effect.fn(function* (options: {
 }) {
   const cacheKey = JSON.stringify([options.command, options.args ?? [], options.env ?? {}]);
   const cached = execCache.get(cacheKey);
-  const now = yield* Effect.sync(() => Date.now());
+  const now = yield* Clock.currentTimeMillis;
   if (cached && cached.expiresAt > now) {
     return cached.credentials;
   }
@@ -215,7 +220,7 @@ export const runExecCredential = Effect.fn(function* (options: {
     extendEnv: true,
     env: options.env,
   }).pipe(
-    spawner.spawn,
+    (command) => spawner.spawn(command),
     Effect.flatMap((child) =>
       Effect.all(
         {
@@ -270,12 +275,16 @@ export const runExecCredential = Effect.fn(function* (options: {
         : undefined,
   };
 
-  const expiresAt = status.expirationTimestamp
-    ? // Re-mint 30s before the declared expiry.
-      new Date(status.expirationTimestamp).getTime() - 30_000
-    : // No declared expiry: cache briefly so bursts of requests share one
-      // plugin invocation without holding a stale credential for long.
-      now + 60_000;
+  const declaredExpiry = status.expirationTimestamp
+    ? DateTime.make(status.expirationTimestamp)
+    : Option.none();
+  const expiresAt = Option.match(declaredExpiry, {
+    // Re-mint 30s before the declared expiry.
+    onSome: (expiry) => DateTime.toEpochMillis(expiry) - 30_000,
+    // No (valid) declared expiry: cache briefly so bursts of requests share
+    // one plugin invocation without holding a stale credential for long.
+    onNone: () => now + 60_000,
+  });
   execCache.set(cacheKey, { credentials, expiresAt });
 
   return credentials;

package/src/internal/workload.ts

@@ -57,7 +57,7 @@ export const deepMerge = <T>(base: T, override: unknown): T => {
  */
 export const imagePlatformOf = (
   architecture: "amd64" | "arm64" | undefined,
-  connection?: Connection | undefined,
+  connection?: Connection,
 ): string =>
   (architecture ?? connection?.architecture) === "arm64" ? "linux/arm64" : "linux/amd64";
 
@@ -320,6 +320,7 @@ export const workloadImageHash = Effect.fn(function* (options: {
 });
 
 /** The identity-adapter state persisted on workload attributes. */
+// oxlint-disable-next-line typescript/no-redundant-type-constituents -- registry type is `never` until cloud packages augment it
 export type PersistedIdentityState = IdentityState | undefined;
 
 /**
@@ -343,6 +344,7 @@ import * as Context from "effect/Context";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
@@ -360,6 +362,7 @@ const layer = makeEntrypointLayer(tag, entrypoint);
 const platform = Layer.mergeAll(
   BunServices.layer,
   FetchHttpClient.layer,
+  SecureRandom.layerWebCrypto,
   Logger.layer([Logger.consolePretty()]),
 );
 
@@ -433,6 +436,7 @@ import * as Context from "effect/Context";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
@@ -446,6 +450,7 @@ const layer = makeEntrypointLayer(tag, entrypoint);
 const platform = Layer.mergeAll(
   BunServices.layer,
   FetchHttpClient.layer,
+  SecureRandom.layerWebCrypto,
   Logger.layer([Logger.consolePretty()]),
 );