@leverege/build-tools 2.113.5 → 2.114.0-DEVOP-578.1

package/README.md

@@ -199,21 +199,6 @@ klog <app-name> <ns>     # specify namespace
 
 ---
 
-### Artifact Management
-
-**`pull-artifact`** — Pulls generic artifacts from GCP Artifact Registry based on an
-`artifacts.yaml` spec file.
-```bash
-pull-artifact [-f <spec-file>] [-n <name>] [-v <version>]
-```
-
-**`push-artifact`** — Pushes generic artifacts to GCP Artifact Registry.
-```bash
-push-artifact [-f <spec-file>] [-n <name>] [-v <version>]
-```
-
----
-
 ### Package & Release Management
 
 **`hook-and-release`** — Manages git pre-commit hooks and version consistency for npm

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.113.5",
+  "version": "2.114.0-DEVOP-578.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -12,7 +12,7 @@
   ],
   "scripts": {
     "lint": "eslint",
-    "lint-fix": "eslint --fix",
+    "lint:fix": "eslint --fix",
     "prepack": "npm exec prepack",
     "prepare": "[ $SKIP_PREPARE ] && exit 0 || ./src/hook-and-release.mjs",
     "test": "mocha -t 60000 --exit 'test/**/!(*e2e*).mjs'",
@@ -21,7 +21,6 @@
   "bin": {
     "build-cnpg-image": "src/build-cnpg-image.mjs",
     "build-tools": "src/build-tools.mjs",
-    "change-up": "src/change-up.sh",
     "chart-compass": "src/chart-compass.mjs",
     "chart-to-registry": "src/chart-to-registry.mjs",
     "circle-orb-it": "src/circle-orb-it/circle-orb-it.mjs",
@@ -53,15 +52,14 @@
     "k8scale": "src/k8scale.sh",
     "k8x": "src/k8x.sh",
     "klog": "src/klog.sh",
+    "k8s": "src/k8s/k8s.mjs",
     "npm-link": "src/npm-link.sh",
     "npm-unlink": "src/npm-unlink.sh",
     "overwhelm": "src/overwhelm.mjs",
     "pkglint": "src/pkglint.sh",
     "prepack": "src/prepack.mjs",
     "prune-git": "src/prune-git.sh",
-    "pull-artifact": "src/artifacts/pull-artifact.mjs",
     "pull-git": "src/pull-git.sh",
-    "push-artifact": "src/artifacts/push-artifact.mjs",
     "push-my-chart": "src/push-my-chart.mjs",
     "refresh-npm-token": "src/refresh-npm-token.mjs",
     "refresh-py-idx": "src/refresh-py-idx.sh",
@@ -83,16 +81,22 @@
     "npm": "11.12.0"
   },
   "license": "SEE LICENSE IN LICENSE.md",
+  "overrides": {
+    "diff": "^8.0.3",
+    "mocha": {
+      "serialize-javascript": "^7.0.3"
+    }
+  },
   "dependencies": {
     "@kubernetes/client-node": "^1.4.0",
     "@leverege/jsdoc-template": "^1.0.1",
-    "chalk": "^5.6.2",
+    "chalk": "^6.0.0",
     "command-line-args": "^6.0.2",
     "command-line-usage": "^7.0.4",
     "commander": "^15.0.0",
     "deepmerge": "^4.3.1",
     "enquirer": "^2.4.1",
-    "execa": "^9.6.1",
+    "execa": "^10.0.0",
     "find-yarn-workspace-root": "^2.0.0",
     "glob": "^13.0.6",
     "googleapis": "^173.0.0",
@@ -113,7 +117,7 @@
     "sloc": "^0.3.2",
     "superstruct": "^2.0.2",
     "tmp": "^0.2.7",
-    "toml": "^4.1.1",
+    "toml": "^5.0.0",
     "yaml": "^2.9.0",
     "zx": "^8.8.5"
   },
@@ -122,7 +126,7 @@
     "chai": "^6.2.2",
     "eslint": "^9",
     "mocha": "^11.7.6",
-    "npm": "^11.17.0"
+    "npm": "^12.0.1"
   },
   "allowScripts": {
     "unrs-resolver@1.12.2": true

package/src/build-tools.mjs

@@ -9,7 +9,7 @@ import chalk from 'chalk'
 import cliArgs from 'command-line-args'
 import cliHelp from 'command-line-usage'
 import npmRegistryFetch from 'npm-registry-fetch'
-import { lt as semverLt } from 'semver'
+import { lt as semverLt, prerelease } from 'semver'
 
 // because __dirname goes away with ESM
 const getFilename = () => {
@@ -124,7 +124,8 @@ const checkForLatest = async ( pkg = '@leverege/build-tools' ) => {
     const list = await npmRegistryFetch.json(
       pkg, { '//registry.npmjs.org/:_authToken' : getToken() }
     )
-    return list['dist-tags'].latest
+    const latest = list['dist-tags'].latest
+    return prerelease( latest ) ? undefined : latest
   } catch ( err ) {
     console.log( err )
   }

package/src/chart-compass.yaml

@@ -22,6 +22,11 @@
           - transponder-tsdb
 
     leverege:
+      llm-prompt-server: {}
+      overdose: {}
       pubsub-pulse: {}
       pusher: {}
-      overdose: {}
+      vms-server: {}
+
+    system:
+      triton-inference-server: {}

package/src/circle-orb-it/circle-npm.yml

@@ -6,8 +6,12 @@ orbs:
 workflows:
   build-and-verify:
     jobs:
+      - leverege/install-dependencies:
+          context: npm
       - leverege/code-analysis:
           context: npm
+          requires:
+            - leverege/install-dependencies
       - leverege/code-coverage:
           context:
             - npm
@@ -15,8 +19,12 @@ workflows:
           coverage-threshold: 70          # percentage threshold for functions, lines, and statements
           enable-redis: false             # set to true if tests require a live Redis connection
           cache-config: '{"type":"inMemory"}' # sets CACHE_CONFIG env var - options: inMemory, redis
+          requires:
+            - leverege/install-dependencies
       - leverege/generate-docs:
           context: npm
+          requires:
+            - leverege/install-dependencies
       - leverege/mirror-to-github:
           context: github-mirror
           # github-team: platform   # available teams: platform, utilities, pitcrew, recovr

package/src/helm-charts/api-server/values-local.yaml

@@ -15,7 +15,7 @@ config:
   MODEL_SQL_HOST: "cnpg-db-psql-stack-pool-rw.cnpg-operands"
   PG_MODELS_HOST: "cnpg-db-psql-stack-pool-rw.cnpg-operands"
   # timescale
-  PG_HOST: "cnpg-db-tsdb-basic-pool-r.cnpg-operands"
+  PG_HOST: "cnpg-db-tsdb-basic-r.cnpg-operands"
   # imagine db is legacy - newer setups use timescale as the db name
   PG_DATABASE: "timescale"
   PG_DENSE_HISTORY_DATABASE: "timescale"

package/src/helm-charts/cnpg-db-psql-stack/cluster.yaml.ovh

@@ -55,7 +55,7 @@ spec:
     size: 16Gi
 
   resources:
-#   limit:
+#   limits:
 #     cpu: 1000m
 #     memory: 8Gi
     requests:

package/src/helm-charts/cnpg-db-tsdb-basic/cluster.yaml.ovh

@@ -55,7 +55,7 @@ spec:
     size: 16Gi
 
   resources:
-#   limit:
+#   limits:
 #     cpu: 1000m
 #     memory: 8Gi
     requests:

package/src/helm-charts/cnpg-db-tsdb-dense/cluster.yaml.ovh

@@ -54,7 +54,7 @@ spec:
     size: 16Gi
 
   resources:
-#   limit:
+#   limits:
 #     cpu: 1000m
 #     memory: 8Gi
     requests:

package/src/helm-charts/llm-prompt-server/values-local.yaml

@@ -0,0 +1,5 @@
+image:
+  tag:
+
+config:
+  LOG_CONFIG: '{"type":"pino","level":"warn"}'

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,14 +8,14 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="86.2.3"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="87.21.0"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT
 
 # https://artifacthub.io/packages/helm/prometheus-community/prometheus-elasticsearch-exporter
 showInstalling "The Elasticsearch Exporter (prom-operator ES metrics exports)"
-[ -z "$ELASTICSEARCH_EXPORTER_CHART_VERSION" ] && ELASTICSEARCH_EXPORTER_CHART_VERSION="7.2.1"
+[ -z "$ELASTICSEARCH_EXPORTER_CHART_VERSION" ] && ELASTICSEARCH_EXPORTER_CHART_VERSION="7.4.0"
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/prometheus-elasticsearch-exporter"
 helm upgrade $NS --install elasticsearch8-exporter $OCI_CHART \
                  --values prom-operator/elasticsearch-exporter.yaml \
@@ -23,7 +23,7 @@ helm upgrade $NS --install elasticsearch8-exporter $OCI_CHART \
 
 # https://artifacthub.io/packages/helm/prometheus-community/prometheus-stackdriver-exporter
 showInstalling "The Stackdriver Exporter (prom-operator GKE metrics exports)"
-[ -z "$STACKDRIVER_EXPORTER_CHART_VERSION" ] && STACKDRIVER_EXPORTER_CHART_VERSION="4.12.2"
+[ -z "$STACKDRIVER_EXPORTER_CHART_VERSION" ] && STACKDRIVER_EXPORTER_CHART_VERSION="4.13.0"
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/prometheus-stackdriver-exporter"
 helm upgrade $NS --install stackdriver-exporter $OCI_CHART \
                  --values prom-operator/stackdriver-exporter.yaml \

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -7,7 +7,7 @@ crds:
   enabled: true
   upgradeJob:
     enabled: true
-    forceConflicts: false
+    forceConflicts: true
 
 kubeControllerManager:
   enabled: false

package/src/helm-charts/triton-inference-server/values-local.yaml

@@ -0,0 +1,28 @@
+image:
+  tag:
+
+modelInit:
+  sources:
+    triton: "gs://${PROJECT_ID}-triton-model-repository/models"
+  targetDir: "/models"
+
+# container args may be tuned as necessary - see the repo README for more info
+#
+# https://bitbucket.org/leverege/triton-inference-server/src/development/
+
+# example of how to add objects
+#extraObjects:
+#  - apiVersion: traefik.io/v1alpha1
+#    kind: IngressRoute
+#    metadata:
+#      name: ${PROJECT_NAME}-extra-api-${HOST}-com
+#      namespace: default
+#    spec:
+#      entryPoints:
+#        - websecure
+#      routes:
+#        - match: Host(`${PROJECT_NAME}-test-api.${HOST}.com`)
+#          kind: Rule
+#          services:
+#            - name: triton-inference-server
+#              port: 8001

package/src/helmup.sh

@@ -52,9 +52,6 @@ for arg in "$@"; do
     --mutate)
       MUTATE_DEPLOYMENT=1
       ;;
-    --conflicts)
-      export FORCE_CONFLICTS=1
-      ;;
     --help|-h)
       giveHelp && exit 0
       ;;

package/src/k8s/commands/completion.mjs

@@ -0,0 +1,100 @@
+import { Command } from 'commander'
+
+import { errorExit } from '../../Utils.mjs'
+
+const SHELLS = [ 'bash', 'zsh', 'fish' ]
+
+const BASH = `\
+_k8s_completions() {
+  local cur prev words
+  COMPREPLY=()
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  words=("\${COMP_WORDS[@]}")
+
+  case "\${words[1]}" in
+    fwd)
+      COMPREPLY=($(compgen -W "elastic redis valkey prom alert grafana" -- "$cur"))
+      return ;;
+    exe)
+      COMPREPLY=($(compgen -W "cnpg es8 grafana grafold prom-operator psql redis valkey" -- "$cur"))
+      return ;;
+    scale)
+      [ "\${#words[@]}" -eq 3 ] && COMPREPLY=($(compgen -W "up dn" -- "$cur"))
+      return ;;
+    log)
+      COMPREPLY=($(compgen -W "--namespace --container --tail --tee --no-pretty" -- "$cur"))
+      return ;;
+    completion)
+      COMPREPLY=($(compgen -W "bash zsh fish" -- "$cur"))
+      return ;;
+    *)
+      COMPREPLY=($(compgen -W "fwd exe scale roll log completion" -- "$cur"))
+      ;;
+  esac
+}
+complete -F _k8s_completions k8s
+`
+
+const ZSH = `\
+#compdef k8s
+
+_k8s() {
+  local state
+  _arguments '1: :->cmd' '*: :->args'
+
+  case $state in
+    cmd)
+      local -a commands=(
+        'fwd:Port-forward to a cluster endpoint'
+        'exe:Exec into a pod interactively'
+        'scale:Scale a deployment up or down'
+        'roll:Rolling restart of deployments'
+        'log:Stream logs with pino-pretty'
+        'completion:Emit shell completion script'
+      )
+      _describe 'command' commands ;;
+    args)
+      case $words[2] in
+        fwd)        _values target elastic redis valkey prom alert grafana ;;
+        exe)        _values target cnpg es8 grafana grafold prom-operator psql redis valkey ;;
+        scale)      [ $CURRENT -eq 3 ] && _values direction up dn ;;
+        completion) _values shell bash zsh fish ;;
+      esac ;;
+  esac
+}
+
+_k8s
+`
+
+const FISH = `\
+set -l cmds fwd exe scale roll log completion
+complete -c k8s -f
+complete -c k8s -n "not __fish_seen_subcommand_from $cmds" -a fwd        -d 'Port-forward to a cluster endpoint'
+complete -c k8s -n "not __fish_seen_subcommand_from $cmds" -a exe        -d 'Exec into a pod interactively'
+complete -c k8s -n "not __fish_seen_subcommand_from $cmds" -a scale      -d 'Scale a deployment up or down'
+complete -c k8s -n "not __fish_seen_subcommand_from $cmds" -a roll       -d 'Rolling restart of deployments'
+complete -c k8s -n "not __fish_seen_subcommand_from $cmds" -a log        -d 'Stream logs with pino-pretty'
+complete -c k8s -n "not __fish_seen_subcommand_from $cmds" -a completion -d 'Emit shell completion script'
+
+complete -c k8s -n "__fish_seen_subcommand_from fwd"   -a "elastic redis valkey prom alert grafana"
+complete -c k8s -n "__fish_seen_subcommand_from exe"   -a "cnpg es8 grafana grafold prom-operator psql redis valkey"
+complete -c k8s -n "__fish_seen_subcommand_from scale; and not __fish_seen_subcommand_from up dn" -a "up dn"
+complete -c k8s -n "__fish_seen_subcommand_from completion" -a "bash zsh fish"
+`
+
+export const completionCommand = new Command( 'completion' )
+  .description( 'Emit a shell completion script' )
+  .argument( '<shell>', `shell: ${SHELLS.join( ', ' )}` )
+  .addHelpText( 'after', `
+Examples:
+  eval "$(k8s completion bash)"         # add to ~/.bashrc
+  eval "$(k8s completion zsh)"          # add to ~/.zshrc
+  k8s completion fish | source          # fish interactive session
+` )
+  .action( ( shell ) => {
+    const scripts = { bash: BASH, zsh: ZSH, fish: FISH }
+    if ( !scripts[shell] ) {
+      errorExit( `Unknown shell: ${shell}\nValid: ${SHELLS.join( ', ' )}` )
+    }
+    process.stdout.write( scripts[shell] )
+  } )

package/src/k8s/commands/exe.mjs

@@ -0,0 +1,57 @@
+import { Command } from 'commander'
+import chalk from 'chalk'
+import { $ } from 'zx'
+
+import { log, errorExit } from '../../Utils.mjs'
+import { overwhelmGate } from '../lib/gate.mjs'
+import { listPods } from '../lib/kubectl.mjs'
+import { selectPod } from '../lib/select.mjs'
+
+const TARGETS = {
+  cnpg:            { ns: 'cnpg-operands', query: null,         cmd: [ 'bash' ] },
+  es8:             { ns: 'elastic',       query: null,         cmd: [ 'bash' ] },
+  elastic8:        { ns: 'elastic',       query: null,         cmd: [ 'bash' ] },
+  grafana:         { ns: 'prometheus',    query: 'grafana',    cmd: [ 'bash' ] },
+  grafold:         { ns: 'monitoring',    query: 'grafana',    cmd: [ 'bash' ] },
+  'prom-operator': { ns: 'prometheus',    query: null,         cmd: [ 'bash' ] },
+  prometheus:      { ns: 'prometheus',    query: null,         cmd: [ 'bash' ] },
+  psql:            { ns: 'cnpg-operands', query: 'postgresql', cmd: [ 'psql', '-U', 'postgres' ] },
+  pgsql:           { ns: 'cnpg-operands', query: 'postgresql', cmd: [ 'psql', '-U', 'postgres' ] },
+  redis:           { ns: 'default',       query: 'redis',      cmd: [ 'redis-cli' ] },
+  'redis-cli':     { ns: 'default',       query: 'redis',      cmd: [ 'redis-cli' ] },
+  valkey:          { ns: 'default',       query: 'valkey',     cmd: [ 'valkey-cli' ] },
+  'valkey-cli':    { ns: 'default',       query: 'valkey',     cmd: [ 'valkey-cli' ] },
+}
+
+export const exeCommand = new Command( 'exe' )
+  .description( 'Exec into a pod interactively' )
+  .argument( '[target]', `shortcut: ${Object.keys( TARGETS ).join( ', ' )}` )
+  .action( async ( target ) => {
+    await overwhelmGate()
+    const cfg = target ?
+      TARGETS[target] :
+      { ns: 'default', query: null, cmd: [ 'bash' ] }
+
+    if ( target && !cfg ) {
+      errorExit( `Unknown target: ${target}\nValid: ${Object.keys( TARGETS ).join( ', ' )}` )
+    }
+
+    let pods = await listPods( cfg.ns )
+    if ( cfg.query ) {
+      pods = pods.filter( p => p.name.includes( cfg.query ) )
+    }
+    if ( !pods.length ) {
+      errorExit( `No pods found in ${cfg.ns}${cfg.query ? ` matching "${cfg.query}"` : ''}` )
+    }
+
+    const { namespace, name } = pods.length === 1 ?
+      pods[0] :
+      await selectPod( pods, 'Select pod to exec into' )
+
+    log( chalk.cyan( `\nexec  →  ${namespace}/${name}\n` ) )
+    try {
+      await $( { stdio: 'inherit', verbose: false } )`kubectl exec -it -n ${namespace} ${name} -- ${cfg.cmd}`
+    } catch ( e ) {
+      if ( e.exitCode !== 130 ) throw e
+    }
+  } )

package/src/k8s/commands/fwd.mjs

@@ -0,0 +1,35 @@
+import { Command } from 'commander'
+import chalk from 'chalk'
+import { $ } from 'zx'
+
+import { log, errorExit } from '../../Utils.mjs'
+import { overwhelmGate } from '../lib/gate.mjs'
+
+const TARGETS = {
+  elastic: { ns: 'elastic',    svc: 'elasticsearch8',           port: 9200 },
+  redis:   { ns: 'default',    svc: 'redis-master',             port: 6379 },
+  valkey:  { ns: 'default',    svc: 'valkey-master',            port: 6379 },
+  prom:    { ns: 'prometheus', svc: 'prometheus-operated',      port: 9090 },
+  alert:   { ns: 'prometheus', svc: 'alertmanager-operated',    port: 9093 },
+  grafana: { ns: 'prometheus', svc: 'prometheus-stack-grafana', port: 3000 },
+}
+
+export const fwdCommand = new Command( 'fwd' )
+  .description( 'Port-forward to a cluster endpoint' )
+  .argument( '<target>', `target: ${Object.keys( TARGETS ).join( ', ' )}` )
+  .option( '-l, --local <port>', 'override local port' )
+  .action( async ( target, opts ) => {
+    await overwhelmGate()
+    const cfg = TARGETS[target]
+    if ( !cfg ) {
+      errorExit( `Unknown target: ${target}\nValid: ${Object.keys( TARGETS ).join( ', ' )}` )
+    }
+    const localPort = opts.local ?? cfg.port
+    log( chalk.cyan( `\nForwarding  localhost:${localPort}  →  ${cfg.ns}/${cfg.svc}:${cfg.port}` ) )
+    log( chalk.gray( 'Ctrl+C to stop\n' ) )
+    try {
+      await $( { stdio: 'inherit', verbose: false } )`kubectl port-forward -n ${cfg.ns} svc/${cfg.svc} ${localPort}:${cfg.port}`
+    } catch ( e ) {
+      if ( e.exitCode !== 130 ) throw e
+    }
+  } )

package/src/k8s/commands/log.mjs

@@ -0,0 +1,76 @@
+import { Command } from 'commander'
+import chalk from 'chalk'
+import { $ } from 'zx'
+
+import { log, getDateTimestamp } from '../../Utils.mjs'
+import { overwhelmGate } from '../lib/gate.mjs'
+import { listPods } from '../lib/kubectl.mjs'
+import { selectPod } from '../lib/select.mjs'
+
+const PINO = [ '-c', '-t', 'HH:MM:ss.l', '-i', 'severity' ]
+
+// Heuristic: strip replicaset+pod hashes for Deployments, ordinal for StatefulSets
+function containerFromPod( podName ) {
+  const parts = podName.split( '-' )
+  const last = parts.at( -1 )
+  const prev = parts.at( -2 )
+  const isHash = s => s && /^[a-z0-9]{5,10}$/.test( s )
+  if ( isHash( last ) && isHash( prev ) ) return parts.slice( 0, -2 ).join( '-' )
+  if ( /^\d+$/.test( last ) ) return parts.slice( 0, -1 ).join( '-' )
+  return parts.slice( 0, -1 ).join( '-' )
+}
+
+function logFile( name, tee ) {
+  return typeof tee === 'string' ? tee : `${name}-${getDateTimestamp()}.log`
+}
+
+async function stream( $i, args, { pretty, tee, name } ) {
+  if ( pretty && tee ) {
+    await $i`kubectl ${args} | tee ${logFile( name, tee )} | pino-pretty ${PINO}`
+  } else if ( pretty ) {
+    await $i`kubectl ${args} | pino-pretty ${PINO}`
+  } else if ( tee ) {
+    await $i`kubectl ${args} | tee ${logFile( name, tee )}`
+  } else {
+    await $i`kubectl ${args}`
+  }
+}
+
+export const logCommand = new Command( 'log' )
+  .description( 'Stream pod logs with pino-pretty formatting' )
+  .argument( '[service]', 'app label selector (app=<service>); interactive pod picker if omitted' )
+  .option( '-n, --namespace <ns>', 'namespace', 'default' )
+  .option( '-c, --container <name>', 'container name (derived from pod name if omitted)' )
+  .option( '--tail <n>', 'initial lines to show', '50' )
+  .option( '--tee [file]', 'also write raw logs to a timestamped file' )
+  .option( '--no-pretty', 'skip pino-pretty, raw output' )
+  .action( async ( service, opts ) => {
+    await overwhelmGate()
+    const $i = $( { stdio: 'inherit', verbose: false } )
+
+    if ( service ) {
+      const { namespace: ns, tail } = opts
+      const args = [ 'logs', '--follow', '-n', ns, '-l', `app=${service}`, '--max-log-requests=16', `--tail=${tail}` ]
+      log( chalk.cyan( `\nStreaming  ${ns}/app=${service}\n` ) )
+      try {
+        await stream( $i, args, { pretty: opts.pretty, tee: opts.tee, name: service } )
+      } catch ( e ) {
+        if ( e.exitCode !== 130 ) throw e
+      }
+      return
+    }
+
+    // Interactive pod picker — all namespaces unless -n was given
+    const ns = opts.namespace !== 'default' ? opts.namespace : undefined
+    const pods = await listPods( ns )
+    const { namespace, name: podName } = await selectPod( pods, 'Select a pod to stream' )
+    const container = opts.container ?? containerFromPod( podName )
+    const args = [ 'logs', '--follow', '-n', namespace, podName, '-c', container, `--tail=${opts.tail}` ]
+
+    log( chalk.cyan( `\nStreaming  ${namespace}/${podName}  (container: ${container})\n` ) )
+    try {
+      await stream( $i, args, { pretty: opts.pretty, tee: opts.tee, name: container } )
+    } catch ( e ) {
+      if ( e.exitCode !== 130 ) throw e
+    }
+  } )

package/src/k8s/commands/roll.mjs

@@ -0,0 +1,37 @@
+import { Command } from 'commander'
+import chalk from 'chalk'
+import { $ } from 'zx'
+
+import { log } from '../../Utils.mjs'
+import { overwhelmGate } from '../lib/gate.mjs'
+import { listDeployments } from '../lib/kubectl.mjs'
+import { selectDeployment } from '../lib/select.mjs'
+
+export const rollCommand = new Command( 'roll' )
+  .description( 'Rolling restart of one or more deployments' )
+  .argument( '[deployments...]', 'deployment names (interactive if omitted)' )
+  .option( '-n, --namespace <ns>', 'namespace', 'default' )
+  .action( async ( deployments, opts ) => {
+    await overwhelmGate()
+
+    let targets = deployments
+    if ( !targets.length ) {
+      const all = await listDeployments( opts.namespace )
+      targets = [ await selectDeployment( all, 'Select deployment to restart' ) ]
+    }
+
+    log( chalk.cyan( '\nrolling restart\n' ) )
+    for ( const deploy of targets ) {
+      try {
+        // sequential by design — report status per deployment as each completes
+        // eslint-disable-next-line no-await-in-loop
+        await $`kubectl rollout restart deployment ${deploy} -n ${opts.namespace}`
+        log( `  ${chalk.green( 'SUCCESS' )}  ${deploy}` )
+        // eslint-disable-next-line no-await-in-loop
+        await $`send-to-slack ${'k8scale roll ' + deploy}`.catch( () => {} )
+      } catch {
+        log( `  ${chalk.red( 'FAILURE' )}  ${deploy}` )
+      }
+    }
+    log( '' )
+  } )

package/src/k8s/commands/scale.mjs

@@ -0,0 +1,43 @@
+import { Command } from 'commander'
+import chalk from 'chalk'
+import { $ } from 'zx'
+
+import { log, errorExit } from '../../Utils.mjs'
+import { overwhelmGate } from '../lib/gate.mjs'
+import { listDeployments } from '../lib/kubectl.mjs'
+import { selectDeployment } from '../lib/select.mjs'
+
+export const scaleCommand = new Command( 'scale' )
+  .description( 'Scale a deployment up or down' )
+  .argument( '<direction>', 'up or dn' )
+  .argument( '[deployments...]', 'deployment names (interactive if omitted)' )
+  .option( '-n, --namespace <ns>', 'namespace', 'default' )
+  .action( async ( direction, deployments, opts ) => {
+    if ( direction !== 'up' && direction !== 'dn' ) {
+      errorExit( 'Direction must be up or dn' )
+    }
+    await overwhelmGate()
+
+    const replicas = direction === 'up' ? 1 : 0
+
+    let targets = deployments
+    if ( !targets.length ) {
+      const all = await listDeployments( opts.namespace )
+      targets = [ await selectDeployment( all, 'Select deployment to scale' ) ]
+    }
+
+    log( chalk.cyan( `\nscale ${direction}\n` ) )
+    for ( const deploy of targets ) {
+      try {
+        // sequential by design — report status per deployment as each completes
+        // eslint-disable-next-line no-await-in-loop
+        await $`kubectl scale --replicas=${replicas} deployment ${deploy} -n ${opts.namespace}`
+        log( `  ${chalk.green( 'SUCCESS' )}  ${deploy}` )
+        // eslint-disable-next-line no-await-in-loop
+        await $`send-to-slack ${'k8scale ' + direction + ' ' + deploy}`.catch( () => {} )
+      } catch {
+        log( `  ${chalk.red( 'FAILURE' )}  ${deploy}` )
+      }
+    }
+    log( '' )
+  } )