@jr2/cli 0.2.1 → 0.4.1

package/src/nodes.ts

@@ -7,13 +7,13 @@
 // at the moment of the read. The set moves (a pool autoscales, a node is cordoned), which is why an
 // empty set is reported and never refused.
 
-import type { SandboxPlacement, Toleration } from "@jr2/orchestrator";
+import { cpuMillis, memoryBytes, type ResolvedSize, type SandboxPlacement, type Toleration } from "@jr2/orchestrator";
 
 /** A cluster node, read for the facts that decide placement and platform (ADR-0045/0052). */
 export type NodeObject = {
   metadata: { name: string; labels?: Record<string, string> };
   spec?: { unschedulable?: boolean; taints?: readonly Taint[] };
-  status?: { nodeInfo?: { architecture?: string } };
+  status?: { nodeInfo?: { architecture?: string }; allocatable?: Record<string, string> };
 };
 
 export type Taint = { key: string; value?: string; effect: string };
@@ -72,3 +72,28 @@ export function tolerates(t: Toleration, taint: Taint): boolean {
   if (t.operator === "Exists") return true;
   return (t.value ?? "") === (taint.value ?? "");
 }
+
+/**
+ * Whether any of `nodes` could hold `size` (ADR-0060): its allocatable memory and cpu both at least
+ * the whole Size — what the scheduler compares a Guaranteed pod against on an empty node. `undefined`
+ * when no node reports allocatable, which is an unknown, never a no. A WARNING at `jr2 up`, never a
+ * refusal: the node set moves (ADR-0052), and a pool may scale up a bigger node tomorrow.
+ */
+export function anyNodeHolds(nodes: readonly NodeObject[], size: ResolvedSize): boolean | undefined {
+  let known = false;
+  for (const node of nodes) {
+    const alloc = node.status?.allocatable;
+    if (alloc?.memory === undefined || alloc.cpu === undefined) continue;
+    let memory: number;
+    let cpu: number;
+    try {
+      memory = memoryBytes(alloc.memory);
+      cpu = cpuMillis(alloc.cpu);
+    } catch {
+      continue;
+    }
+    known = true;
+    if (memory >= size.memory.bytes && cpu >= size.cpu.millis) return true;
+  }
+  return known ? false : undefined;
+}

package/src/sweep.ts

@@ -7,11 +7,12 @@
 // is not this instance's garbage):
 //   1. the `jr2-images` ConfigMap of every jr2 instance (namespaces labeled `jr2.dev/instance`) — what
 //      FUTURE Sandboxes will be provisioned with;
-//   2. every Sandbox CR's `spec.image` in those namespaces — a parked Workspace must survive a pod
-//      restart, and `imagePullPolicy: IfNotPresent` cannot re-pull a local tag;
-//   3. every pod's container images in those namespaces plus `jr2-system` — what is actually running
-//      (orchestrator, Instance Harness, Adapter, Sandboxes, operator), mid-roll pods INCLUDED,
-//      without naming Deployments one by one.
+//   2. every Sandbox CR's `spec.image`, sidecar, init container and `image` volume in those
+//      namespaces — a parked Workspace must survive a pod restart, and `imagePullPolicy:
+//      IfNotPresent` cannot re-pull a local tag;
+//   3. every pod's container and `image` volume refs in those namespaces plus `jr2-system` — what is
+//      actually running (orchestrator, Instance Harness, Custodians, Sandboxes, operator), mid-roll
+//      pods INCLUDED, without naming Deployments one by one.
 // The keep set is their union. "Kit images are never pruned" is not a rule here: a kit ref is kept
 // because some instance's map or pod names it, and collects like anything else when the last
 // instance leaves the cluster.
@@ -53,13 +54,18 @@ export type Roots = { keep: Set<string>; namespaces: string[] };
 
 type NamespacedObject = { metadata: { name: string; namespace?: string } };
 type ConfigMapObject = NamespacedObject & { data?: Record<string, string> };
-type SandboxObject = NamespacedObject & { spec?: { image?: string; sidecars?: ContainerSpec[] } };
+type SandboxObject = NamespacedObject & {
+  spec?: { image?: string; sidecars?: ContainerSpec[]; initContainers?: ContainerSpec[]; volumes?: VolumeSpec[] };
+};
 type ContainerSpec = { image?: string };
+/** Only an `image` volume names a ref: every Sandbox's `/opt/jr2` is one, of the harness image (ADR-0037). */
+type VolumeSpec = { image?: { reference?: string } };
 type PodObject = NamespacedObject & {
   spec?: {
     containers?: ContainerSpec[];
     initContainers?: ContainerSpec[];
     ephemeralContainers?: ContainerSpec[];
+    volumes?: VolumeSpec[];
   };
 };
 
@@ -93,18 +99,20 @@ export async function readRoots(kube: KubeAdmin, ctx: { context?: string } = {})
   }
 
   // 2. what a parked Workspace's pod will be recreated with — the Sandbox Image AND every sidecar's
-  // ref. The CR always carries the Adapter as a sidecar (sandbox-kubectl.ts), and its ref is not
+  // ref. The CR always carries the Custodian as a sidecar (sandbox-kube.ts), and its ref is not
   // covered by the other roots: a running Sandbox is deliberately never re-imaged, so an `up` that
-  // rebuilt the Adapter leaves the CR naming the OLD one while the map names the new. If that pod
+  // moved the Custodian's pin leaves the CR naming the OLD one while the map names the new. If that pod
   // is then lost (node restart, eviction, drain), the recreated one pulls the CR's sidecar ref —
-  // and `IfNotPresent` cannot re-pull a local tag a sweep took.
+  // and `IfNotPresent` cannot re-pull a local tag a sweep took. The same holds for the harness ref: it
+  // reaches the pod only as the `runtime` image volume (ADR-0037), never as a container's image.
   const sandboxes = await listSandboxes(kube, ctx);
   for (const sandbox of sandboxes) {
     if (!instanceNs.has(sandbox.metadata.namespace ?? "")) continue;
     if (sandbox.spec?.image) keep.add(sandbox.spec.image);
-    for (const sidecar of sandbox.spec?.sidecars ?? []) {
-      if (sidecar.image) keep.add(sidecar.image);
+    for (const c of [...(sandbox.spec?.sidecars ?? []), ...(sandbox.spec?.initContainers ?? [])]) {
+      if (c.image) keep.add(c.image);
     }
+    for (const ref of volumeRefs(sandbox.spec?.volumes)) keep.add(ref);
   }
 
   // 3. what is running right now — plus the operator, which lives in the shared `jr2-system`.
@@ -116,11 +124,17 @@ export async function readRoots(kube: KubeAdmin, ctx: { context?: string } = {})
     for (const c of [...(spec.containers ?? []), ...(spec.initContainers ?? []), ...(spec.ephemeralContainers ?? [])]) {
       if (c.image) keep.add(c.image);
     }
+    for (const ref of volumeRefs(spec.volumes)) keep.add(ref);
   }
 
   return { keep, namespaces };
 }
 
+/** The refs a volume list mounts as `image` volumes — invisible to a read of containers alone. */
+function volumeRefs(volumes: VolumeSpec[] | undefined): string[] {
+  return (volumes ?? []).flatMap((v) => (v.image?.reference ? [v.image.reference] : []));
+}
+
 /**
  * Root #2's read, with the ONE degradation the fail-closed rule allows: a cluster that has no
  * `sandboxes.core.jr2.dev` resource type can hold no Sandbox CRs, so "no Sandboxes" is the complete
@@ -141,8 +155,8 @@ async function listSandboxes(kube: KubeAdmin, ctx: { context?: string }): Promis
   }
 }
 
-/** Every ref one instance's image map names: the kit's own at the top level (`harness`, `adapter`,
- * and the `operator` that rides the same JSON), and each Sandbox Image under `sandbox`. An
+/** Every ref one instance's image map names: the kit's own at the top level (`harness`,
+ * `custodian`, and the `operator` that rides the same JSON), and each Sandbox Image under `sandbox`. An
  * unreadable map is a FAILED root, not an empty one — a hand-edited ConfigMap must not be read as
  * "that instance needs nothing". */
 function imageMapRefs(cm: ConfigMapObject): string[] {