@rallycry/conveyor-k3 0.1.12 → 0.1.13

package/dist/index.d.ts

@@ -8,10 +8,14 @@ interface ClusterConnectionConfig {
     /** Test-only overrides; production reads the host-written control aliases. */
     readControlFile?: (path: string) => string | null;
     controlFileExists?: (path: string) => boolean;
+    /** Dial again after the server closes the socket. The daemon's connection only. */
+    reconnectWhenReplaced?: boolean;
 }
 declare class ClusterConnection {
     private socket;
     private readonly config;
+    private redialDelayMs;
+    private redialTimer;
     /** Called when Conveyor says the desired state changed. */
     onSyncRequested: (() => void) | null;
     /** Called when Conveyor asks the machine to remove itself. */
@@ -29,6 +33,8 @@ declare class ClusterConnection {
      * instead of waiting out the stale window.
      */
     sayGoodbye(timeoutMs?: number): Promise<void>;
+    /** Dial again after the server closed the socket, waiting longer each time. */
+    private redial;
     disconnect(): void;
 }
 
@@ -132,17 +138,29 @@ declare class ClusterDaemon {
     private readonly localImageHashes;
     /** How long the in-cluster registry has been not ready, across beats. */
     private readonly registryWatch;
+    /**
+     * Whether pod isolation is in force, from the last reconcile; undefined
+     * while desired state does not ask for it. Every heartbeat checks it again
+     * against k3s's own settings before reporting it.
+     */
+    private isolation;
     private timers;
     /** When the last store walk started, so one that failed is not retried on every reconcile. */
     private storeWalkStartedAt;
     /** Serializes reconcile against itself — a sync nudge during a reconcile
      *  must queue, not interleave two kubectl applies of the same manifests. */
     private reconciling;
+    /** The run queued behind the running one, until it starts. At most one waits. */
+    private queuedRun;
+    /** The next reconcile while pod isolation is not applied; `dueAt` 0 = none. */
+    private isolationRetry;
     constructor(ports: DaemonPorts);
     start(): Promise<void>;
     stop(): Promise<void>;
     /** Fetch the desired state and converge to it. Queued, never concurrent. */
     syncAndReconcile(): Promise<void>;
+    /** Reconcile again later while pod isolation is not applied; stop once it is. */
+    private scheduleIsolationRetry;
     private runReconcile;
     /**
      * The hourly clock: warm, re-pin, and reclaim if the pile justifies it.
@@ -293,6 +311,10 @@ interface TelemetryState {
     localImageHashes?: LocalImageHashCache;
     /** Present while desired state turns the in-cluster registry on. */
     localRegistry?: LocalRegistryWatch;
+    /** Present while desired state asks for pod isolation (a host-runtime machine). */
+    isolation?: {
+        applied: boolean;
+    };
     /**
      * The last measured size of k3s's containerd store. Null (or absent) until
      * the first measurement, and the heartbeat says null then: a 0 would read
@@ -395,6 +417,13 @@ interface ReconcileResult {
     recreatedPriorityClass: boolean;
     /** Empty pool namespaces of projects this machine no longer serves, removed. */
     prunedNamespaces: string[];
+    /**
+     * Whether pod isolation is in force, while desired state asks for it (a
+     * host-runtime machine). Undefined otherwise. Reported on every heartbeat.
+     */
+    isolation?: {
+        applied: boolean;
+    };
 }
 declare function reconcile(ctx: ReconcileContext, desired: PersonalClusterDesiredState): Promise<ReconcileResult>;
 
@@ -519,7 +548,11 @@ declare function ownerConfiguredKeys(ownerConfig: string | null): Set<string>;
  * they chose, and last-writer-wins on their own file is exactly what this
  * module exists not to do.
  */
-declare function renderK3sDropIn(kubelet: PersonalClusterKubeletState, ownerConfig: string | null): DropInRenderResult;
+declare function renderK3sDropIn(kubelet: PersonalClusterKubeletState, ownerConfig: string | null, 
+/** False on an adopted k3s: its components stay as its owner set them. */
+options?: {
+    disableComponents?: boolean;
+}): DropInRenderResult;
 /**
  * @deprecated Use {@link renderK3sDropIn}. Kept as a named alias because the
  * package exports it and a published CLI may still import it by this name.
@@ -585,6 +618,18 @@ interface MachineState {
      */
     k3sStoreBytes?: number;
     k3sStoreMeasuredAt?: string;
+    /**
+     * "host" once `conveyor-k3 host setup` or `host link` enrolled this machine
+     * as a host-runtime instance. Absent on a VM guest, including every state
+     * file written before the host runtime existed.
+     */
+    runtime?: "host";
+    /**
+     * True once setup installed this machine's k3s. Absent on a k3s setup found
+     * already installed, and in every state file written before the field
+     * existed. See {@link managesK3s}.
+     */
+    k3sInstalledByConveyor?: boolean;
 }
 declare function readState(fs: FileSystemPort$1): Promise<MachineState>;
 declare function writeState(fs: FileSystemPort$1, state: MachineState): Promise<void>;
@@ -597,7 +642,7 @@ declare function writeState(fs: FileSystemPort$1, state: MachineState): Promise<
  * help output below is part of the product: every verb states what it does to
  * their machine, and `uninstall` states what it does not.
  */
-declare const VERBS: readonly ["vm", "setup", "start", "stop", "status", "sync", "update", "registry", "runners", "uninstall", "daemon"];
+declare const VERBS: readonly ["vm", "host", "setup", "start", "stop", "status", "sync", "update", "registry", "runners", "uninstall", "daemon"];
 type Verb = (typeof VERBS)[number];
 declare function isVerb(value: string): value is Verb;
 interface ParsedArgs {
@@ -613,7 +658,7 @@ interface ParsedArgs {
  * this surface is nine verbs and six flags, not a general CLI framework.
  */
 declare function parseArgs(argv: readonly string[]): ParsedArgs;
-declare const HELP = "conveyor-k3 \u2014 managed personal compute for Conveyor\n\nUsage: conveyor-k3 <command> [options]\n\nCommands:\n  vm                    Manage isolated compute on macOS or Linux.\n                        Run conveyor-k3 vm for host lifecycle commands.\n  setup                 Install and enrol this machine. Safe to re-run.\n  start                 Start the tunnel and the daemon.\n  stop                  Stop both, and tell Conveyor at once so your next\n                        build goes straight to project compute.\n  status [--json]       What is running, what Conveyor knows, and what is\n                        missing.\n  sync                  Re-read your settings from Conveyor and apply them.\n  update                Update conveyor-k3, cloudflared, and (when you have\n                        allowed it and nothing is running) k3s.\n  registry list         Which registry credentials are configured, and which\n                        ones your projects still need.\n  registry add <host>   Add one registry credential.\n                          --username <user>\n                          --password-stdin      read the password from stdin\n                          --no-restart          skip the required k3s restart\n  registry gc           Delete superseded shadow-bake images from the image\n                        registry inside this cluster. Runs daily on its own,\n                        and only while no Conveyor pod or bake is running.\n                          --dry-run             list what it would delete\n  runners list          Which GitHub Actions runners this machine hosts, and\n                        whether each may import a locally baked image.\n  runners grant <user>\u2026 Let those runner users import a locally baked image\n                        into this node and pin it. Writes one file under\n                        /etc/sudoers.d, checked with visudo first. Needed only\n                        when a project has Bake Locally turned on.\n  uninstall             Remove Conveyor's units, environment, state, and image\n                        registry. Your k3s config, your own registries.yaml\n                        entries, your workloads, and the registry's data are\n                        left alone.\n                          --purge-k3s --yes     also remove k3s itself and the\n                                                registry's data\n  daemon                Run in the foreground (what the systemd unit calls).\n\nOptions:\n  --version             Print the version.\n  --help                Print this message.\n\nDocs: https://conveyor.rallycryapp.com/docs/guides/managed-personal-compute\n";
+declare const HELP = "conveyor-k3 \u2014 Personal Compute for Conveyor\n\nUsage: conveyor-k3 <command> [options]\n\nOne product, two runtimes. Pick the one that fits the machine:\n\nOn your computer or server:\n  vm                    Personal computer runtime: an isolated VM on macOS or\n                        Linux. Run conveyor-k3 vm for its commands.\n  host                  Dedicated server runtime: k3s and the daemon on this\n                        Linux machine, with no VM. Root only. Run\n                        conveyor-k3 host for its commands.\n\nInside a linked machine (the VM guest, or the server itself):\n  setup                 VM guest only: install and enrol this machine. Safe\n                        to re-run. On a server, use conveyor-k3 host setup.\n  start                 Start the tunnel and the daemon.\n  stop                  Stop both, and tell Conveyor at once so your next\n                        build goes straight to project compute.\n  status [--json]       What is running, what Conveyor knows, and what is\n                        missing.\n  sync                  Re-read your settings from Conveyor and apply them.\n  update                Update conveyor-k3, cloudflared, and (when you have\n                        allowed it and nothing is running) k3s.\n  registry list         Which registry credentials are configured, and which\n                        ones your projects still need.\n  registry add <host>   Add one registry credential.\n                          --username <user>\n                          --password-stdin      read the password from stdin\n                          --no-restart          skip the required k3s restart\n  registry gc           Delete superseded shadow-bake images from the image\n                        registry inside this cluster. Runs daily on its own,\n                        and only while no Conveyor pod or bake is running.\n                          --dry-run             list what it would delete\n  runners list          Which GitHub Actions runners this machine hosts, and\n                        whether each may import a locally baked image.\n  runners grant <user>\u2026 Let those runner users import a locally baked image\n                        into this node and pin it. Writes one file under\n                        /etc/sudoers.d, checked with visudo first. Needed only\n                        when a project has Bake Locally turned on.\n  uninstall             VM guest only: remove Conveyor's units, environment,\n                        state, and image registry. Your k3s config, your own\n                        registries.yaml entries, your workloads, and the\n                        registry's data are left alone. On a server, use\n                        conveyor-k3 host uninstall: it also removes the\n                        device key.\n                          --purge-k3s --yes     also remove k3s itself and the\n                                                registry's data\n  daemon                Run in the foreground (what the systemd unit calls).\n\nOptions:\n  --version             Print the version.\n  --help                Print this message.\n\nDocs: https://conveyor.rallycryapp.com/docs/guides/managed-personal-compute\n";
 
 /**
  * `conveyor-k3 registry add|list|gc` — where an owner adds registry
@@ -729,6 +774,12 @@ interface UpdateBinaries {
 }
 interface UpdateDecisionInput {
     autoUpgradeK3s: boolean;
+    /**
+     * False on a server whose k3s setup did not install (`managesK3s`): the
+     * installer would turn off the owner's traefik and servicelb. Absent reads
+     * as true, which is every VM guest.
+     */
+    managesK3s?: boolean;
     /** Null when the count could not be read — treated exactly like "busy". */
     runningConveyorPods: number | null;
     installedK3s: [number, number] | null;