@opensoha/contracts 0.1.16 → 0.1.18

package/resource/runtime/rollout_integration_test.go

@@ -0,0 +1,287 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/opensoha/soha-contracts/gen/go/sohaapi"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func TestRolloutWithKubernetes(t *testing.T) {
+	kubeconfig := os.Getenv("SOHA_ROLLOUT_TEST_KUBECONFIG")
+	if kubeconfig == "" {
+		t.Skip("set the explicit loopback Rollouts/Traefik fixture kubeconfig and SOHA_ROLLOUT_TEST_IMAGE")
+	}
+	config, err := clientcmd.BuildConfigFromFlags("", kubeconfig)
+	operatorRequire(t, err)
+	endpoint, err := url.Parse(config.Host)
+	if err != nil || endpoint.Hostname() != "127.0.0.1" {
+		t.Fatal("only the isolated loopback fixture cluster is supported")
+	}
+	config.Timeout = 10 * time.Second
+	client, err := dynamic.NewForConfig(config)
+	operatorRequire(t, err)
+	kube, err := kubernetes.NewForConfig(config)
+	operatorRequire(t, err)
+	namespace := "soha-workflow-r6-progressive"
+	for _, strategy := range []string{"blueGreen", "canary"} {
+		t.Run(strategy, func(t *testing.T) {
+			name := "r6-runtime-" + strings.ToLower(strategy)
+			base := rolloutFixture(t, strategy)
+			encoded, _ := json.Marshal(base)
+			encoded = []byte(strings.ReplaceAll(strings.ReplaceAll(string(encoded), "web", name), "demo", namespace))
+			// The web provider key is a protocol field, not a resource name.
+			encoded = []byte(strings.ReplaceAll(string(encoded), `"`+name+`":{`, `"web":{`))
+			operatorRequire(t, json.Unmarshal(encoded, &base))
+			for _, document := range base {
+				if document.GetKind() == "IngressRoute" {
+					operatorRequire(t, unstructured.SetNestedStringSlice(document.Object, []string{"web"}, "spec", "entryPoints"))
+				}
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+			defer cancel()
+			owner := "opensoha-manifest/" + name
+			operation := name + "-" + time.Now().UTC().Format("150405.000000")
+			options := metav1.PatchOptions{FieldManager: owner}
+			documents := func(version string) []*unstructured.Unstructured {
+				items := make([]*unstructured.Unstructured, len(base))
+				for i, item := range base {
+					items[i] = item.DeepCopy()
+				}
+				rate := 1
+				if version == "bad" {
+					rate = 0
+				}
+				response := fmt.Sprintf(`{"version":%q,"successRate":%d}`, version, rate)
+				command := fmt.Sprintf("cat > /tmp/serve-http <<'SERVER'\n#!/bin/sh\nwhile IFS= read -r line; do [ \"$line\" = \"$(printf '\\r')\" ] && break; done\nprintf 'HTTP/1.1 200 OK\\r\\nContent-Type: application/json\\r\\nContent-Length: %d\\r\\nConnection: close\\r\\n\\r\\n%s'\nSERVER\nchmod 700 /tmp/serve-http\nexec nc -lk -p 8080 -e /tmp/serve-http", len(response), response)
+				containers := []any{map[string]any{"name": "app", "image": os.Getenv("SOHA_ROLLOUT_TEST_IMAGE"), "imagePullPolicy": "IfNotPresent", "env": []any{}, "command": []any{"/bin/sh", "-c"}, "args": []any{command}, "ports": []any{map[string]any{"containerPort": int64(8080)}}, "readinessProbe": map[string]any{"httpGet": map[string]any{"path": "/", "port": int64(8080)}, "periodSeconds": int64(2)}}}
+				operatorRequire(t, unstructured.SetNestedSlice(items[0].Object, containers, "spec", "template", "spec", "containers"))
+				return items
+			}
+			t.Cleanup(func() {
+				if t.Failed() {
+					t.Log("failed fixture retained:", name)
+					return
+				}
+				cleanup, stop := context.WithTimeout(context.Background(), 20*time.Second)
+				defer stop()
+				for _, document := range base {
+					gvk := document.GroupVersionKind()
+					_ = client.Resource(rolloutResourceTypes[gvk.Group+"/"+gvk.Kind]).Namespace(namespace).Delete(cleanup, document.GetName(), metav1.DeleteOptions{})
+				}
+			})
+			readHTTP := func(service string) (string, error) {
+				body, err := kube.CoreV1().RESTClient().Get().Namespace(namespace).Resource("services").Name(service + ":8080").SubResource("proxy").DoRaw(ctx)
+				if err != nil {
+					return "", err
+				}
+				var response struct {
+					Version string `json:"version"`
+				}
+				err = json.Unmarshal(body, &response)
+				return response.Version, err
+			}
+			checkHTTP := func(service, version string) {
+				err := wait.PollUntilContextTimeout(ctx, 200*time.Millisecond, 15*time.Second, true, func(context.Context) (bool, error) {
+					actual, err := readHTTP(service)
+					return err == nil && actual == version, nil
+				})
+				operatorRequire(t, err)
+			}
+			control := func(items []*unstructured.Unstructured, op, action string) {
+				err := wait.PollUntilContextTimeout(ctx, 200*time.Millisecond, 10*time.Second, true, func(context.Context) (bool, error) {
+					observed, err := ObserveRollout(ctx, client, items, owner, op)
+					if err != nil {
+						return false, err
+					}
+					_, err = ControlRollout(ctx, client, items, owner, op, sohaapi.ProgressiveRolloutControlInput{Action: sohaapi.ProgressiveRolloutControlInputAction(action), UID: observed.State.UID, ResourceVersion: observed.State.ResourceVersion})
+					if apierrors.IsConflict(err) {
+						return false, nil
+					}
+					return err == nil, err
+				})
+				operatorRequire(t, err)
+			}
+			preflight := options
+			preflight.DryRun = []string{metav1.DryRunAll}
+			_, err := ApplyRollout(ctx, client, documents("v1"), preflight, operation+"-preflight")
+			operatorRequire(t, err)
+			live, err := ApplyRollout(ctx, client, documents("v1"), options, operation+"-v1")
+			if err != nil {
+				t.Fatalf("initial rollout: %v; live=%v", err, live)
+			}
+			uid := live.GetUID()
+			checkHTTP(name+"-stable", "v1")
+			if strategy == "canary" {
+				checkHTTP("r6-traefik", "v1")
+			}
+			for _, version := range []string{"v2", "v1"} {
+				items := documents(version)
+				op := operation + "-" + version + "-update"
+				finished := make(chan error, 1)
+				go func() { _, err := ApplyRollout(ctx, client, items, options, op); finished <- err }()
+				var paused RolloutObservation
+				completed := false
+				err := wait.PollUntilContextTimeout(ctx, 250*time.Millisecond, 70*time.Second, true, func(context.Context) (bool, error) {
+					select {
+					case err := <-finished:
+						if err == nil && version == "v1" {
+							completed = true
+							return true, nil
+						}
+						if err == nil {
+							return false, fmt.Errorf("update completed without a manual pause")
+						}
+						return false, err
+					default:
+					}
+					observed, err := ObserveRollout(ctx, client, items, owner, op)
+					if err != nil {
+						return false, nil
+					}
+					paused = observed
+					if !paused.State.Paused || paused.State.ObservedGeneration == nil || *paused.State.ObservedGeneration != paused.State.Generation {
+						return false, nil
+					}
+					if strategy == "blueGreen" {
+						if len(paused.State.Metrics) == 0 {
+							return false, nil
+						}
+						for _, metric := range paused.State.Metrics {
+							if metric.Phase != "Successful" {
+								return false, nil
+							}
+						}
+					}
+					return true, nil
+				})
+				operatorRequire(t, err)
+				if completed {
+					observed, err := ObserveRollout(ctx, client, items, owner, op)
+					operatorRequire(t, err)
+					if observed.Health != "healthy" || observed.State.UID != string(uid) {
+						t.Fatal("native fast rollback lost health or identity")
+					}
+					checkHTTP(name+"-stable", version)
+					if strategy == "canary" {
+						checkHTTP("r6-traefik", version)
+					}
+					t.Logf("%s native fast rollback restored known healthy v1 and actual HTTP", strategy)
+					continue
+				}
+				previous := "v1"
+				if version == "v1" {
+					previous = "v2"
+				}
+				checkHTTP(name+"-stable", previous)
+				checkHTTP(name+"-preview", version)
+				if strategy == "canary" {
+					if paused.State.CanaryWeight == nil || *paused.State.CanaryWeight != 20 || paused.State.StableWeight == nil || *paused.State.StableWeight != 80 {
+						t.Fatalf("wrong native traffic weights: %+v", paused.State)
+					}
+					counts := map[string]int{}
+					for i := 0; i < 80; i++ {
+						version, err := readHTTP("r6-traefik")
+						operatorRequire(t, err)
+						counts[version]++
+					}
+					if counts[previous] == 0 || counts[version] == 0 || len(counts) != 2 {
+						t.Fatalf("actual routed traffic did not reach both revisions: %v", counts)
+					}
+					t.Logf("actual routed traffic at 20 percent: %v", counts)
+				}
+				control(items, op, "promote")
+				select {
+				case err := <-finished:
+					operatorRequire(t, err)
+				case <-ctx.Done():
+					t.Fatal(ctx.Err())
+				}
+				observed, err := ObserveRollout(ctx, client, items, owner, op)
+				operatorRequire(t, err)
+				if observed.Health != "healthy" || observed.State.UID != string(uid) {
+					t.Fatalf("updated rollout is not healthy with the same UID: %+v", observed)
+				}
+				if len(observed.State.Metrics) == 0 {
+					t.Fatal("completed rollout lost its native analysis evidence")
+				}
+				for _, metric := range observed.State.Metrics {
+					if metric.Phase != "Successful" || metric.Count != metric.TargetCount || metric.StartedAt == "" || metric.FinishedAt == "" || metric.StartedAt >= metric.FinishedAt {
+						t.Fatalf("completed rollout lost its full successful analysis window: %+v", metric)
+					}
+				}
+				checkHTTP(name+"-stable", version)
+				if strategy == "canary" {
+					checkHTTP("r6-traefik", version)
+				}
+				t.Logf("%s version %s passed actual HTTP, analysis and same-UID reconciliation", strategy, version)
+			}
+			for _, mode := range []string{"bad", "cancel"} {
+				items, op := documents(mode), operation+"-"+mode
+				runCtx, stop := context.WithCancel(ctx)
+				finished := make(chan error, 1)
+				go func() { _, err := ApplyRollout(runCtx, client, items, options, op); finished <- err }()
+				if mode == "cancel" || strategy == "canary" {
+					err := wait.PollUntilContextTimeout(ctx, 250*time.Millisecond, 70*time.Second, true, func(context.Context) (bool, error) {
+						select {
+						case err := <-finished:
+							return false, fmt.Errorf("rollout finished before control: %v", err)
+						default:
+						}
+						observed, err := ObserveRollout(ctx, client, items, owner, op)
+						return err == nil && observed.State.Paused && observed.State.ObservedGeneration != nil && *observed.State.ObservedGeneration == observed.State.Generation, nil
+					})
+					operatorRequire(t, err)
+					if mode == "bad" {
+						control(items, op, "promote")
+					} else {
+						control(items, op, "pause")
+						operatorRequire(t, wait.PollUntilContextTimeout(ctx, 200*time.Millisecond, 10*time.Second, true, func(context.Context) (bool, error) {
+							observed, err := ObserveRollout(ctx, client, items, owner, op)
+							return err == nil && observed.State.ObservedGeneration != nil && *observed.State.ObservedGeneration == observed.State.Generation, nil
+						}))
+						control(items, op, "promote") // Remove spec.paused; retain the native promotion pause.
+						stop()
+					}
+				}
+				select {
+				case err := <-finished:
+					stop()
+					if err == nil || errors.Is(err, ErrRolloutStopUnconfirmed) {
+						t.Fatalf("%s did not fail with confirmed native stop: %v", mode, err)
+					}
+				case <-ctx.Done():
+					stop()
+					t.Fatal(ctx.Err())
+				}
+				observed, err := ObserveRollout(ctx, client, items, owner, op)
+				operatorRequire(t, err)
+				if !rolloutStopped(observed.State) || observed.State.UID != string(uid) {
+					t.Fatalf("%s left active traffic: %+v", mode, observed.State)
+				}
+				checkHTTP(name+"-stable", "v1")
+				if strategy == "canary" {
+					checkHTTP("r6-traefik", "v1")
+				}
+				_, err = ApplyRollout(ctx, client, documents("v1"), options, op+"-restore")
+				operatorRequire(t, err)
+				checkHTTP(name+"-stable", "v1")
+				t.Logf("%s %s confirmed stable traffic, retained failed desired version, then explicit v1 restore", strategy, mode)
+			}
+		})
+	}
+}

package/resource/runtime/rollout_observation.go

@@ -0,0 +1,252 @@
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/opensoha/soha-contracts/gen/go/sohaapi"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/client-go/dynamic"
+)
+
+type RolloutObservation struct {
+	State     sohaapi.ProgressiveRolloutStatus
+	Health    string
+	Drifted   bool
+	Resources []*unstructured.Unstructured
+}
+
+func ObserveRollout(ctx context.Context, client dynamic.Interface, documents []*unstructured.Unstructured, owner, operation string) (RolloutObservation, error) {
+	result := RolloutObservation{Health: "unknown"}
+	desired, err := ValidateRolloutResources(documents)
+	if err != nil {
+		return result, err
+	}
+	root, err := client.Resource(rollouts).Namespace(desired.GetNamespace()).Get(ctx, desired.GetName(), metav1.GetOptions{})
+	if err != nil {
+		return result, err
+	}
+	if err := validateRolloutOwner(root, owner, desired.GetName()); err != nil {
+		return result, err
+	}
+	if operation != "" && root.GetAnnotations()[RolloutOperationAnnotation] != operation {
+		return result, fmt.Errorf("rollout operation was superseded")
+	}
+	result.State = rolloutState(root)
+	actual := map[string]*unstructured.Unstructured{}
+	for _, document := range documents {
+		live := root
+		if !IsArgoRollout(document) {
+			gvk := document.GroupVersionKind()
+			live, err = client.Resource(rolloutResourceTypes[gvk.Group+"/"+gvk.Kind]).Namespace(document.GetNamespace()).Get(ctx, document.GetName(), metav1.GetOptions{})
+			if err != nil {
+				return result, err
+			}
+			if err := validateRolloutOwner(live, owner, desired.GetName()); err != nil {
+				return result, err
+			}
+		}
+		result.Resources = append(result.Resources, live)
+		actual[document.GetKind()+"/"+document.GetName()] = live
+		result.Drifted = result.Drifted || !RolloutMatchesDesired(document, live)
+	}
+	state := &result.State
+	active, preview := actual["Service/"+state.ActiveService], actual["Service/"+state.PreviewService]
+	if active == nil || preview == nil {
+		return result, fmt.Errorf("rollout traffic Services are missing")
+	}
+	state.ActiveRevision = argoString(active, "spec", "selector", rolloutPodHash)
+	state.PreviewRevision = argoString(preview, "spec", "selector", rolloutPodHash)
+	if state.Strategy == "canary" {
+		name := argoString(root, "spec", "strategy", "canary", "trafficRouting", "traefik", "weightedTraefikServiceName")
+		weighted := actual["TraefikService/"+name]
+		if weighted == nil {
+			return result, fmt.Errorf("weighted traffic resource is missing")
+		}
+		backends, _, _ := unstructured.NestedSlice(weighted.Object, "spec", "weighted", "services")
+		for _, raw := range backends {
+			backend, _ := raw.(map[string]any)
+			weight, ok := backend["weight"].(int64)
+			if !ok || weight < 0 || weight > 100 {
+				return result, fmt.Errorf("invalid observed traffic weight")
+			}
+			value := int(weight)
+			if backend["name"] == state.ActiveService {
+				state.StableWeight = &value
+			}
+			if backend["name"] == state.PreviewService {
+				state.CanaryWeight = &value
+			}
+		}
+		if state.StableWeight == nil || state.CanaryWeight == nil || *state.StableWeight+*state.CanaryWeight != 100 {
+			return result, fmt.Errorf("observed traffic weights are incomplete")
+		}
+	}
+	if err := observeRolloutAnalyses(ctx, client, root, state); err != nil {
+		return result, err
+	}
+	result.Health = "progressing"
+	current := state.ObservedGeneration != nil && *state.ObservedGeneration == state.Generation
+	if result.Drifted || current && (state.Phase == "Degraded" || state.Aborted) {
+		result.Health = "degraded"
+		return result, nil
+	}
+	if current && state.Phase == "Healthy" && !state.Paused && state.CurrentRevision != "" && state.StableRevision == state.CurrentRevision && state.ActiveRevision == state.CurrentRevision {
+		result.Health = "healthy"
+		if state.Strategy == "canary" && (*state.StableWeight != 100 || *state.CanaryWeight != 0) {
+			result.Health = "progressing"
+		}
+	}
+	return result, nil
+}
+
+func rolloutState(root *unstructured.Unstructured) sohaapi.ProgressiveRolloutStatus {
+	state := sohaapi.ProgressiveRolloutStatus{Name: root.GetName(), Namespace: root.GetNamespace(), UID: string(root.GetUID()), ResourceVersion: root.GetResourceVersion(), Generation: root.GetGeneration(), OperationID: root.GetAnnotations()[RolloutOperationAnnotation], Phase: argoString(root, "status", "phase"), StableRevision: argoString(root, "status", "stableRS"), CurrentRevision: argoString(root, "status", "currentPodHash"), Metrics: []sohaapi.ProgressiveRolloutMetric{}, PauseReasons: []string{}}
+	if generation, err := strconv.ParseInt(argoString(root, "status", "observedGeneration"), 10, 64); err == nil && generation >= 0 {
+		state.ObservedGeneration = &generation
+	}
+	state.Paused, _, _ = unstructured.NestedBool(root.Object, "spec", "paused")
+	state.Aborted, _, _ = unstructured.NestedBool(root.Object, "status", "abort")
+	pauses, _, _ := unstructured.NestedSlice(root.Object, "status", "pauseConditions")
+	for _, raw := range pauses {
+		pause, _ := raw.(map[string]any)
+		reason, _ := pause["reason"].(string)
+		state.PauseReasons = append(state.PauseReasons, reason)
+	}
+	state.Paused = state.Paused || len(pauses) > 0
+	if argoString(root, "spec", "strategy", "blueGreen", "activeService") != "" {
+		state.Strategy = "blueGreen"
+		state.ActiveService = argoString(root, "spec", "strategy", "blueGreen", "activeService")
+		state.PreviewService = argoString(root, "spec", "strategy", "blueGreen", "previewService")
+	} else {
+		state.Strategy = "canary"
+		state.ActiveService = argoString(root, "spec", "strategy", "canary", "stableService")
+		state.PreviewService = argoString(root, "spec", "strategy", "canary", "canaryService")
+		steps, _, _ := unstructured.NestedSlice(root.Object, "spec", "strategy", "canary", "steps")
+		count := len(steps)
+		state.TotalSteps = &count
+		if step, found, _ := unstructured.NestedInt64(root.Object, "status", "currentStepIndex"); found && step >= 0 {
+			index := int(step)
+			state.CurrentStep = &index
+		}
+	}
+	return state
+}
+
+// RolloutMatchesDesired ignores only the native traffic controller's weights.
+// Service hash selectors and spec.paused are absent from the approved template.
+func RolloutMatchesDesired(desired, live *unstructured.Unstructured) bool {
+	wanted := desired.DeepCopy()
+	if wanted.GetKind() == "TraefikService" {
+		backends, _, _ := unstructured.NestedSlice(wanted.Object, "spec", "weighted", "services")
+		for _, raw := range backends {
+			backend, _ := raw.(map[string]any)
+			delete(backend, "weight")
+		}
+		_ = unstructured.SetNestedSlice(wanted.Object, backends, "spec", "weighted", "services")
+	}
+	return argoMatchesDesired(wanted.Object, live.Object)
+}
+
+func observeRolloutAnalyses(ctx context.Context, client dynamic.Interface, root *unstructured.Unstructured, state *sohaapi.ProgressiveRolloutStatus) error {
+	runs := []*unstructured.Unstructured{}
+	seen := map[string]bool{}
+	for _, path := range [][]string{{"canary", "currentStepAnalysisRunStatus"}, {"canary", "currentBackgroundAnalysisRunStatus"}, {"blueGreen", "prePromotionAnalysisRunStatus"}, {"blueGreen", "postPromotionAnalysisRunStatus"}} {
+		name := argoString(root, "status", path[0], path[1], "name")
+		if name == "" {
+			continue
+		}
+		run, err := client.Resource(analysisRuns).Namespace(root.GetNamespace()).Get(ctx, name, metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+		owner := metav1.GetControllerOf(run)
+		if owner == nil || owner.Kind != "Rollout" || owner.APIVersion != root.GetAPIVersion() || owner.Name != root.GetName() || owner.UID != root.GetUID() || run.GetUID() == "" || run.GetLabels()[rolloutPodHash] != state.CurrentRevision {
+			return fmt.Errorf("analysis observation does not belong to this Rollout revision")
+		}
+		runs = append(runs, run)
+		seen[run.GetName()] = true
+	}
+	// Rollouts clears currentStepAnalysisRunStatus when a canary completes.
+	// Retained runs keep the controller owner, Pod hash and native revision, so
+	// the completed task can preserve this revision's full observation evidence.
+	revision := root.GetAnnotations()["rollout.argoproj.io/revision"]
+	if revision != "" && state.CurrentRevision != "" {
+		options := metav1.ListOptions{LabelSelector: rolloutPodHash + "=" + state.CurrentRevision, Limit: 100}
+		for {
+			page, err := client.Resource(analysisRuns).Namespace(root.GetNamespace()).List(ctx, options)
+			if err != nil {
+				return err
+			}
+			for _, candidate := range page.Items {
+				owner := metav1.GetControllerOf(&candidate)
+				if seen[candidate.GetName()] || owner == nil || owner.Kind != "Rollout" || owner.APIVersion != root.GetAPIVersion() || owner.Name != root.GetName() || owner.UID != root.GetUID() || candidate.GetUID() == "" || candidate.GetAnnotations()["rollout.argoproj.io/revision"] != revision {
+					continue
+				}
+				runs = append(runs, candidate.DeepCopy())
+				seen[candidate.GetName()] = true
+			}
+			if page.GetContinue() == "" {
+				break
+			}
+			options.Continue = page.GetContinue()
+		}
+	}
+	slices.SortFunc(runs, func(a, b *unstructured.Unstructured) int { return strings.Compare(a.GetName(), b.GetName()) })
+	for _, run := range runs {
+		metrics, _, _ := unstructured.NestedSlice(run.Object, "spec", "metrics")
+		results, _, _ := unstructured.NestedSlice(run.Object, "status", "metricResults")
+		for _, raw := range metrics {
+			metric, _ := raw.(map[string]any)
+			name, _ := metric["name"].(string)
+			count, _ := metric["count"].(int64)
+			condition, _ := metric["successCondition"].(string)
+			item := sohaapi.ProgressiveRolloutMetric{AnalysisRun: run.GetName(), UID: string(run.GetUID()), Name: name, Phase: argoString(run, "status", "phase"), Interval: fmt.Sprint(metric["interval"]), TargetCount: int(count), SuccessCondition: condition}
+			for _, raw := range results {
+				result, _ := raw.(map[string]any)
+				if result["name"] != name {
+					continue
+				}
+				item.Phase, _ = result["phase"].(string)
+				for key, target := range map[string]*int{"count": &item.Count, "successful": &item.Successful, "failed": &item.Failed} {
+					value, _ := result[key].(int64)
+					*target = int(value)
+				}
+				measurements, _ := result["measurements"].([]any)
+				if len(measurements) > 0 {
+					last, _ := measurements[len(measurements)-1].(map[string]any)
+					item.Value, _ = last["value"].(string)
+					first, _ := measurements[0].(map[string]any)
+					item.StartedAt, _ = first["startedAt"].(string)
+					item.FinishedAt, _ = last["finishedAt"].(string)
+				}
+			}
+			state.Metrics = append(state.Metrics, item)
+		}
+	}
+	return nil
+}
+
+func validateRolloutOwner(object *unstructured.Unstructured, owner, rootName string) error {
+	if owner == "" || object.GetAnnotations()[RolloutOwnerAnnotation] != owner+":"+rootName || object.GetUID() == "" || object.GetResourceVersion() == "" || object.GetDeletionTimestamp() != nil {
+		return fmt.Errorf("%w: rollout resource has another owner or is being deleted", ErrResourceOwnership)
+	}
+	clean := object.DeepCopy()
+	clean.SetKind("OwnedRolloutResource")
+	annotations := clean.GetAnnotations()
+	delete(annotations, RolloutOwnerAnnotation)
+	clean.SetAnnotations(annotations)
+	if err := ValidateDirectManifestOwner(clean); err != nil {
+		return err
+	}
+	for _, field := range object.GetManagedFields() {
+		if strings.HasPrefix(field.Manager, "opensoha-") && field.Manager != owner {
+			return fmt.Errorf("%w: rollout resource has another Soha field owner", ErrResourceOwnership)
+		}
+	}
+	return nil
+}