@meshxdata/fops 0.1.51 → 0.1.53

package/src/plugins/bundled/fops-plugin-azure/lib/azure-sync.js

@@ -1,4 +1,7 @@
 import chalk from "chalk";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
 import {
   DEFAULTS, DIM, OK, WARN, ERR, LABEL,
   banner, hint, kvLine,
@@ -24,7 +27,7 @@ const SVC_MAP = {
   "foundation-storage-engine": "se",
 };
 
-// Parse "foundation-backend=compose|||a1b2c3d4e5f6" → { be: { tag: "compose", id: "a1b2c3d" } }
+// Parse "foundation-backend=ghcr.io/…:tag|||sha256:abc…" → { be: { tag: "latest", sha: "a1b2c3d" } }
 export function parseServiceVersions(raw) {
   if (!raw?.trim()) return {};
   const versions = {};
@@ -39,8 +42,8 @@ export function parseServiceVersions(raw) {
     const [imagePart = "", idPart = ""] = rest.split("|||");
     const colon = imagePart.lastIndexOf(":");
     const tag = colon >= 0 ? imagePart.slice(colon + 1) : imagePart;
-    const id = idPart.trim().slice(0, 7);
-    versions[short] = id || tag;
+    const sha = idPart.trim().slice(0, 7);
+    versions[short] = { tag: tag || null, sha: sha || null };
   }
   return versions;
 }
@@ -196,9 +199,13 @@ async function syncVms(execa) {
           "echo '___SHA___'",
           "git rev-parse --short HEAD 2>/dev/null || echo unknown",
           "echo '___VER___'",
-          "docker inspect --format '{{.Name}}={{.Config.Image}}|||{{slice .Image 7 19}}'" +
-            " foundation-backend foundation-frontend foundation-processor" +
-            " foundation-watcher foundation-scheduler foundation-storage-engine 2>/dev/null || true",
+          // Use docker compose ps to resolve actual container names (handles project-name prefixes)
+          "for svc in foundation-backend foundation-frontend foundation-processor foundation-watcher foundation-scheduler foundation-storage-engine; do" +
+            " cid=$(docker compose ps -q $svc 2>/dev/null | head -1);" +
+            " if [ -n \"$cid\" ]; then docker inspect --format \"$svc={{.Config.Image}}|||{{slice .Image 7 19}}\" $cid 2>/dev/null; fi;" +
+            " done",
+          "echo '___FLAGS___'",
+          "grep -h 'MX_FF_' /opt/foundation-compose/docker-compose.yaml 2>/dev/null | sed 's/.*- //' | sort -u || true",
         ].join(" && "),
         20000,
       );
@@ -211,7 +218,8 @@ async function syncVms(execa) {
 
       const [containerPart = "", rest = ""] = stdout.split("___BR___");
       const [branchRaw = "", afterBranch = ""] = rest.split("___SHA___");
-      const [shaRaw = "", verRaw = ""] = afterBranch.split("___VER___");
+      const [shaRaw = "", afterSha = ""] = afterBranch.split("___VER___");
+      const [verRaw = "", flagsRaw = ""] = afterSha.split("___FLAGS___");
       entry.branch = branchRaw.trim() || "unknown";
       entry.sha = shaRaw.trim() || "unknown";
 
@@ -226,6 +234,16 @@ async function syncVms(execa) {
 
       // Parse service image tags: "foundation-backend=ghcr.io/…:tag" → { be: "tag", … }
       entry.services = parseServiceVersions(verRaw);
+
+      // Parse feature flags: "MX_FF_NAME=true" lines
+      if (flagsRaw.trim()) {
+        const flags = {};
+        for (const line of flagsRaw.trim().split("\n")) {
+          const match = line.match(/^(MX_FF_\w+)=(.+)/);
+          if (match) flags[match[1]] = match[2].trim().replace(/['"]/g, "") === "true";
+        }
+        if (Object.keys(flags).length > 0) entry.flags = flags;
+      }
     } catch {
       entry.status = "error";
     }
@@ -236,6 +254,73 @@ async function syncVms(execa) {
   return results;
 }
 
+// ── Flux overlay version resolver ────────────────────────────────────────────
+
+const AKS_SVC_DIRS = {
+  backend: "be",
+  frontend: "fe",
+  processor: "pr",
+  watcher: "wa",
+  scheduler: "sc",
+  "storage-engine": "se",
+};
+
+/**
+ * Resolve the flux repo directory from projectRoot or known locations.
+ */
+function findFluxRepo() {
+  // Check projectRoot sibling (../flux relative to foundation-compose)
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".fops.json"), "utf8"));
+    if (config.projectRoot) {
+      const sibling = path.join(path.dirname(config.projectRoot), "flux");
+      if (fs.existsSync(path.join(sibling, "apps"))) return sibling;
+    }
+  } catch {}
+  return null;
+}
+
+/**
+ * Extract image tags from flux overlay kustomization files for a cluster.
+ * Looks for overlays matching <clusterName>-azure under each service.
+ */
+function getFluxServiceVersions(clusterName) {
+  const fluxDir = findFluxRepo();
+  if (!fluxDir) return null;
+
+  const appsDir = path.join(fluxDir, "apps", "foundation");
+  if (!fs.existsSync(appsDir)) return null;
+
+  const versions = {};
+  const overlayName = `${clusterName}-azure`;
+
+  for (const [svcDir, shortKey] of Object.entries(AKS_SVC_DIRS)) {
+    // Search all overlay groups (meshx, customers, etc.)
+    const overlaysRoot = path.join(appsDir, svcDir, "overlays");
+    if (!fs.existsSync(overlaysRoot)) continue;
+
+    let found = false;
+    try {
+      for (const group of fs.readdirSync(overlaysRoot)) {
+        const kustomPath = path.join(overlaysRoot, group, overlayName, "kustomization.yaml");
+        if (!fs.existsSync(kustomPath)) continue;
+
+        const content = fs.readFileSync(kustomPath, "utf8");
+        // Extract image tag from "tag: v0.3.28" in the kustomization patch
+        const tagMatch = content.match(/\btag:\s*(\S+)/);
+        if (tagMatch) {
+          versions[shortKey] = { tag: tagMatch[1], sha: null };
+          found = true;
+          break;
+        }
+      }
+    } catch {}
+    if (!found) versions[shortKey] = null;
+  }
+
+  return Object.values(versions).some(v => v) ? versions : null;
+}
+
 // ── Sync: probe AKS clusters ─────────────────────────────────────────────────
 
 async function syncClusters(execa) {
@@ -277,6 +362,60 @@ async function syncClusters(execa) {
       entry.status = "probe-failed";
     }
 
+    // HA pairing: infer from naming convention
+    const isStandby = name.endsWith("-standby");
+    if (isStandby) {
+      const primaryName = name.replace(/-standby$/, "");
+      if (names.includes(primaryName)) {
+        entry.isStandby = true;
+        entry.primaryCluster = primaryName;
+      }
+    } else {
+      const standbyName = `${name}-standby`;
+      if (names.includes(standbyName)) {
+        entry.ha = { standbyCluster: standbyName, standbyRegion: clusters[standbyName]?.location || null };
+      }
+    }
+
+    // Discover Key Vault and Storage Account in the resource group
+    try {
+      const rg = cl.resourceGroup;
+      const subArgs = cl.subscriptionId ? ["--subscription", cl.subscriptionId] : [];
+
+      const [kvResult, saResult, pgResult] = await Promise.all([
+        execa("az", ["keyvault", "list", "-g", rg, "--query", "[].{name:name}", "-o", "json", ...subArgs], { timeout: 15000, reject: false }),
+        execa("az", ["storage", "account", "list", "-g", rg, "--query", "[].{name:name,location:location}", "-o", "json", ...subArgs], { timeout: 15000, reject: false }),
+        execa("az", ["postgres", "flexible-server", "list", "-g", rg, "--query", "[].{name:name,fqdn:fullyQualifiedDomainName}", "-o", "json", ...subArgs], { timeout: 15000, reject: false }),
+      ]);
+
+      if (kvResult.exitCode === 0 && kvResult.stdout?.trim()) {
+        const vaults = JSON.parse(kvResult.stdout);
+        if (vaults.length > 0) entry.vault = { keyVaultName: vaults[0].name };
+      }
+      if (saResult.exitCode === 0 && saResult.stdout?.trim()) {
+        const accounts = JSON.parse(saResult.stdout);
+        if (accounts.length > 0) {
+          entry.storageAccount = accounts[0].name;
+          if (accounts.length > 1) {
+            entry.storageHA = { sourceAccount: accounts[0].name, destAccount: accounts[1].name, destRegion: accounts[1].location };
+          }
+        }
+      }
+      if (pgResult.exitCode === 0 && pgResult.stdout?.trim()) {
+        const servers = JSON.parse(pgResult.stdout);
+        if (servers.length > 0) entry.postgres = { serverName: servers[0].name, fqdn: servers[0].fqdn };
+      }
+    } catch { /* resource discovery is best-effort */ }
+
+    // Extract service image tags from flux overlays.
+    // Standbys share the primary's overlay.
+    let fluxVersions = getFluxServiceVersions(name);
+    if (!fluxVersions && isStandby) {
+      const primaryName = name.replace(/-standby$/, "");
+      fluxVersions = getFluxServiceVersions(primaryName);
+    }
+    if (fluxVersions) entry.services = fluxVersions;
+
     results[name] = entry;
   }));
 

package/src/plugins/bundled/fops-plugin-azure/lib/azure.js

@@ -46,7 +46,7 @@ export {
 
 // ── VM operations ────────────────────────────────────────────────────────────
 export {
-  azureStatus, azureTrinoStatus, azureSsh, azureSshWhitelistMe, azurePortForward, azureSshAdminAdd, azureVmCheck, azureAgent, azureOpenAiDebugVm,
+  azureStatus, azureTrinoStatus, azurePing, azureSsh, azureSshWhitelistMe, azurePortForward, azureSshAdminAdd, azureVmCheck, azureAgent, azureOpenAiDebugVm,
   azureDeploy, azurePull, azureDeployVersion, azureRunUp, azureConfig, azureConfigVersions, azureUpdate,
   azureLogs, azureRestart, azureGrantAdmin, azureContext,
   azureList, azureApply,

package/src/plugins/bundled/fops-plugin-azure/lib/commands/test-cmds.js

@@ -14,6 +14,8 @@ export function registerTestCommands(azure) {
     .command("run [name]", { isDefault: true })
     .description("Run QA automation tests locally against a remote VM")
     .option("--vm-name <name>", "Target VM (default: active)")
+    .option("--landscape <file>", "Apply landscape file (FCL/HCL/YAML) before running tests")
+    .option("--landscape-template <name>", "Use built-in landscape template (demo, pipeline_demo)")
     .action(async (name, opts) => {
       const { resolveCliSrc, lazyExeca, ensureAzCli, ensureAzAuth, resolvePublicIp } = await import("../azure-helpers.js");
       const { requireVmState, knockForVm, sshCmd, MUX_OPTS } = await import("../azure.js");
@@ -46,6 +48,32 @@ export function registerTestCommands(azure) {
         process.exit(1);
       }
 
+      // Apply landscape if specified
+      let landscapeFile = opts.landscape;
+      if (!landscapeFile && opts.landscapeTemplate) {
+        const templateDir = path.join(root, "operator-cli/src/plugins/bundled/fops-plugin-foundation/templates/landscapes");
+        const templateName = opts.landscapeTemplate.endsWith(".fcl") ? opts.landscapeTemplate : `${opts.landscapeTemplate}.fcl`;
+        landscapeFile = path.join(templateDir, templateName);
+        try {
+          await fsp.access(landscapeFile);
+        } catch {
+          console.error(chalk.red(`\n  Landscape template not found: ${templateName}`));
+          console.error(chalk.dim(`  Available: demo.fcl, pipeline_demo.fcl\n`));
+          process.exit(1);
+        }
+      }
+      if (landscapeFile) {
+        console.log(chalk.cyan(`\n  Applying landscape: ${path.basename(landscapeFile)}…\n`));
+        const { azureApply } = await import("../azure.js");
+        try {
+          await azureApply(landscapeFile, { vmName: state.vmName });
+          console.log(chalk.green("  ✓ Landscape applied\n"));
+        } catch (err) {
+          console.error(chalk.red(`\n  Failed to apply landscape: ${err.message}\n`));
+          process.exit(1);
+        }
+      }
+
       const vmUrl = state.publicUrl || `https://${ip}`;
       const apiUrl = `${vmUrl}/api`;
 

package/src/plugins/bundled/fops-plugin-azure/lib/commands/vm-cmds.js

@@ -248,6 +248,55 @@ export function registerVmCommands(azure, api, registry) {
       console.log();
     });
 
+  // ── reconcile ───────────────────────────────────────────────────────────
+  azure
+    .command("reconcile [name]")
+    .description("Reconcile an existing VM — fix drift without full provisioning (DNS, env, repo, services)")
+    .option("--profile <subscription>", "Azure subscription name or ID")
+    .option("--url <url>", "Public URL override (default: from tracked state)")
+    .option("--cf-token <token>", "Cloudflare API token for DNS (default: $CLOUDFLARE_API_TOKEN)")
+    .option("--k3s", "Include k3s Kubernetes services")
+    .option("--traefik", "Include traefik reverse proxy")
+    .option("--dai", "Also start DAI services (implies --k3s)")
+    .option("--no-knock", "Skip port-knock setup")
+    .action(async (name, opts) => {
+      if (opts.dai) opts.k3s = true;
+      const {
+        lazyExeca, ensureAzCli, ensureAzAuth, resolveGithubToken, verifyGithubToken,
+        reconcileVm, DEFAULTS,
+      } = await import("../azure.js");
+      const { resolveCfToken } = await import("../cloudflare.js");
+      const { readVmState, writeVmState } = await import("../azure-state.js");
+      const execa = await lazyExeca();
+      await ensureAzCli(execa);
+      const account = await ensureAzAuth(execa, { subscription: opts.profile });
+      const { token: githubToken, login: githubLogin } = await verifyGithubToken(resolveGithubToken(opts));
+      const sub = opts.profile;
+      const subId = account.id || DEFAULTS.subscriptionId;
+      const tracked = readVmState(name);
+      if (!tracked) {
+        console.error(chalk.red(`\n  VM "${name}" not tracked. Use 'fops azure up ${name}' first.\n`));
+        process.exit(1);
+      }
+      const rg = tracked.resourceGroup;
+      const desiredUrl = opts.url || tracked.publicUrl;
+      const cfToken = resolveCfToken(opts.cfToken);
+      const { publicIp, publicUrl, rg: actualRg } = await reconcileVm(execa, {
+        vmName: name, rg, sub, subId, location: tracked.location || DEFAULTS.location,
+        port: DEFAULTS.port, adminUser: DEFAULTS.adminUser,
+        githubToken, githubLogin, desiredUrl,
+        knockSequence: tracked.knockSequence,
+        k3s: opts.k3s, traefik: opts.traefik, dai: opts.dai,
+        knock: opts.knock, cfToken, waitMode: "http-any",
+      });
+      const resolvedRg = actualRg || rg;
+      writeVmState(name, { resourceGroup: resolvedRg, location: tracked.location, publicIp, publicUrl, subscriptionId: subId });
+      console.log(chalk.green(`\n  ✓ Reconciled ${chalk.bold(name)}`));
+      if (publicUrl) console.log(chalk.dim(`    ${publicUrl}`));
+      if (publicIp) console.log(chalk.dim(`    IP: ${publicIp}`));
+      console.log();
+    });
+
   // ── down ─────────────────────────────────────────────────────────────────
   azure
     .command("down [name]")
@@ -329,6 +378,18 @@ export function registerVmCommands(azure, api, registry) {
       await azureTrinoStatus({ vmName: opts.vmName || name, profile: opts.profile });
     });
 
+  // ── ping ────────────────────────────────────────────────────────────────
+  azure
+    .command("ping [name]")
+    .description("Check Foundation backend health via /api/ping/json")
+    .option("--profile <subscription>", "Azure subscription name or ID")
+    .option("--vm-name <name>", "Target VM (default: active VM)")
+    .option("--token <token>", "Ping auth token (or set FOPS_PING_TOKEN)")
+    .action(async (name, opts) => {
+      const { azurePing } = await import("../azure.js");
+      await azurePing({ vmName: opts.vmName || name, profile: opts.profile, token: opts.token });
+    });
+
   // ── terraform ────────────────────────────────────────────────────────────
   azure
     .command("terraform [name]")