@brutalsystems/dray 0.1.12 → 0.1.13

package/README.md

@@ -37,7 +37,7 @@ dray list                   # registered repos + targets
 dray ship <repo>:<target>   # deps?→build→push(SHA)→render+apply→rollout
 dray ship <repo>            # all enabled workloads in the repo (skips manual ones)
 dray apply  <repo>:<target> # render + apply manifests only
-dray rollout <repo>:<target>
+dray rollout <repo>:<target>  # restart + wait; skips the restart if one is already rolling
 dray status <repo>          # running image SHA vs HEAD
 dray rollback <repo>:<target> <sha>
 dray publish <repo>[:<pilet>]   # publish pilet(s) via sops exec-env

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/dray",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Convention-driven multi-repo deploy orchestrator (forge for shipping)",
   "bin": {
     "dray": "bin/dray.js"

package/src/core/engine.js

@@ -52,25 +52,25 @@ async function execute(steps, { dryRun = false, allowDirty = false, deps } = {})
         const vars = {}; for (const s of u.stamp) vars[s.var] = `${s.repoUri}:${sha}`;
         const files = d.render.renderManifests(u.manifests, vars, u.repoPath, { dryRun });
         if (files[0]) renderDirs.push(path.dirname(files[0]));
-        // Read the running image BEFORE applying. If it differs from what we
-        // are about to stamp, this apply changes the pod template and the
-        // Deployment controller starts a rollout on its own — so the rollout
-        // step that follows must wait rather than restart, or every ship
-        // produces two ReplicaSets and replaces the pod twice.
+        // Applying may or may not change the pod template; the rollout step below decides
+        // whether a restart is needed by asking the CLUSTER, not by us telling it from here.
+        // A flag set in this step cannot reach a separate `dray rollout` invocation.
+        for (const f of files) await d.kubectl.applyFile({ file: f, context: u.defaults.context, namespace: u.defaults.namespace, dryRun });
+      } else if (step.kind === 'rollout') {
+        // If the controller is already rolling this deployment -- because an apply just
+        // changed the pod template, in THIS process or a previous `dray apply` invocation --
+        // then `rollout restart` would start a second one, producing a second ReplicaSet and
+        // replacing every pod twice. Wait for the one in flight instead.
         //
-        // Deliberately conservative: any doubt (dry run, cronjob, unreadable
-        // deployment) leaves the restart in place, which is the previous
-        // behaviour.
-        u._applyStartsRollout = false;
-        if (!dryRun && u.workload && u.kind !== 'cronjob') {
+        // Conservative on doubt (dry run, cronjob, unreadable deployment): keep restarting,
+        // because a skipped restart silently does nothing at all.
+        let inFlight = false;
+        if (!dryRun && u.kind !== 'cronjob') {
           try {
-            const before = await d.kubectl.runningImage({ workload: u.workload, kind: u.kind, context: u.defaults.context, namespace: u.defaults.namespace });
-            u._applyStartsRollout = before !== `${u.repoUri}:${sha}`;
-          } catch { u._applyStartsRollout = false; }
+            inFlight = await d.kubectl.rolloutInProgress({ deployment: u.workload, context: u.defaults.context, namespace: u.defaults.namespace });
+          } catch { inFlight = false; }
         }
-        for (const f of files) await d.kubectl.applyFile({ file: f, context: u.defaults.context, namespace: u.defaults.namespace, dryRun });
-      } else if (step.kind === 'rollout') {
-        try { await d.kubectl.rollout({ deployment: u.workload, context: u.defaults.context, namespace: u.defaults.namespace, dryRun, restart: !u._applyStartsRollout }); }
+        try { await d.kubectl.rollout({ deployment: u.workload, context: u.defaults.context, namespace: u.defaults.namespace, dryRun, restart: !inFlight }); }
         catch (err) { await d.kubectl.rolloutUndo({ deployment: u.workload, context: u.defaults.context, namespace: u.defaults.namespace, dryRun }); throw err; }
       }
     }

package/src/primitives/kubectl.js

@@ -10,6 +10,32 @@ async function rollout({ deployment, context, namespace, dryRun, restart = true
   return _run('kubectl', ['rollout', 'status', `deployment/${deployment}`, '--timeout=180s', ...ns(context, namespace)], { dryRun });
 }
 function rolloutUndo({ deployment, context, namespace, dryRun }) { return _run('kubectl', ['rollout', 'undo', `deployment/${deployment}`, ...ns(context, namespace)], { dryRun }); }
+// Is the Deployment controller ALREADY rolling out a change?
+//
+// Whether a rollout is under way is a property of the cluster, not of this process. An
+// earlier design inferred it in the apply step and passed it to the rollout step through a
+// field on the unit -- which works for `dray ship` but silently fails for `dray apply &&
+// dray rollout`, two separate invocations with no shared memory. That is the shape every CI
+// pipeline uses, so every deploy there rolled twice. Ask the cluster instead.
+//
+// Unreadable or absent deployment -> false, i.e. keep restarting. Conservative in the same
+// direction as before: a missed restart does nothing at all, which is the worse failure.
+async function rolloutInProgress({ deployment, context, namespace }) {
+  const { code, stdout } = await _run('kubectl', ['get', `deployment/${deployment}`, '-o', 'json', ...ns(context, namespace)], { capture: true, allowFail: true });
+  if (code !== 0) return false;
+  let d;
+  try { d = JSON.parse(stdout); } catch { return false; }
+  const gen = d.metadata && d.metadata.generation;
+  const obs = d.status && d.status.observedGeneration;
+  if (typeof gen !== 'number') return false;
+  // The controller has not yet observed the spec we just applied.
+  if (gen !== obs) return true;
+  const want = (d.spec && typeof d.spec.replicas === 'number') ? d.spec.replicas : 1;
+  const updated = (d.status && d.status.updatedReplicas) || 0;
+  const available = (d.status && d.status.availableReplicas) || 0;
+  // Pods are still converging on the desired template.
+  return updated < want || available < want;
+}
 async function runningImage({ workload, kind, context, namespace }) {
   const kindPath = kind === 'cronjob'
     ? ['cronjob/' + workload, '-o', 'jsonpath={.spec.jobTemplate.spec.template.spec.containers[0].image}']
@@ -17,4 +43,4 @@ async function runningImage({ workload, kind, context, namespace }) {
   const { stdout } = await _run('kubectl', ['get', ...kindPath, ...ns(context, namespace)], { capture: true, allowFail: true });
   return stdout.trim();
 }
-module.exports = { applyFile, rollout, rolloutUndo, runningImage, _withRun };
+module.exports = { applyFile, rollout, rolloutUndo, runningImage, rolloutInProgress, _withRun };