@rallycry/conveyor-k3 0.1.12 → 0.1.14

package/dist/index.d.ts

@@ -8,10 +8,14 @@ interface ClusterConnectionConfig {
     /** Test-only overrides; production reads the host-written control aliases. */
     readControlFile?: (path: string) => string | null;
     controlFileExists?: (path: string) => boolean;
+    /** Dial again after the server closes the socket. The daemon's connection only. */
+    reconnectWhenReplaced?: boolean;
 }
 declare class ClusterConnection {
     private socket;
     private readonly config;
+    private redialDelayMs;
+    private redialTimer;
     /** Called when Conveyor says the desired state changed. */
     onSyncRequested: (() => void) | null;
     /** Called when Conveyor asks the machine to remove itself. */
@@ -29,6 +33,8 @@ declare class ClusterConnection {
      * instead of waiting out the stale window.
      */
     sayGoodbye(timeoutMs?: number): Promise<void>;
+    /** Dial again after the server closed the socket, waiting longer each time. */
+    private redial;
     disconnect(): void;
 }
 
@@ -132,17 +138,31 @@ declare class ClusterDaemon {
     private readonly localImageHashes;
     /** How long the in-cluster registry has been not ready, across beats. */
     private readonly registryWatch;
+    /**
+     * Whether pod isolation is in force, from the last reconcile; undefined
+     * while desired state does not ask for it. Every heartbeat checks it again
+     * against k3s's own settings before reporting it.
+     */
+    private isolation;
+    /** Whether the pod slice's CPU cap is in force, from the last reconcile. */
+    private cpuQuotaApplied;
     private timers;
     /** When the last store walk started, so one that failed is not retried on every reconcile. */
     private storeWalkStartedAt;
     /** Serializes reconcile against itself — a sync nudge during a reconcile
      *  must queue, not interleave two kubectl applies of the same manifests. */
     private reconciling;
+    /** The run queued behind the running one, until it starts. At most one waits. */
+    private queuedRun;
+    /** The next reconcile while pod isolation is not applied; `dueAt` 0 = none. */
+    private isolationRetry;
     constructor(ports: DaemonPorts);
     start(): Promise<void>;
     stop(): Promise<void>;
     /** Fetch the desired state and converge to it. Queued, never concurrent. */
     syncAndReconcile(): Promise<void>;
+    /** Reconcile again later while pod isolation is not applied; stop once it is. */
+    private scheduleIsolationRetry;
     private runReconcile;
     /**
      * The hourly clock: warm, re-pin, and reclaim if the pile justifies it.
@@ -229,6 +249,12 @@ interface PruneResult {
     removed: number;
     bytesReclaimed: number;
     failures: string[];
+    /**
+     * Removals crictl stopped waiting for. containerd carries on deleting a
+     * multi-gigabyte image after crictl's deadline, so these are not failures:
+     * the next prune finds the image gone, or tries it again.
+     */
+    pending: string[];
 }
 /** Remove the stranded images. Individual failures are reported, not thrown. */
 declare function pruneStrandedImages(exec: Executor, inventory: ImageInventory, wantedImages: string[]): Promise<PruneResult>;
@@ -293,6 +319,12 @@ interface TelemetryState {
     localImageHashes?: LocalImageHashCache;
     /** Present while desired state turns the in-cluster registry on. */
     localRegistry?: LocalRegistryWatch;
+    /** Present while desired state asks for pod isolation (a host-runtime machine). */
+    isolation?: {
+        applied: boolean;
+    };
+    /** Present while a host-runtime machine's desired state reserves CPU. */
+    cpuQuotaApplied?: boolean | undefined;
     /**
      * The last measured size of k3s's containerd store. Null (or absent) until
      * the first measurement, and the heartbeat says null then: a 0 would read
@@ -395,6 +427,18 @@ interface ReconcileResult {
     recreatedPriorityClass: boolean;
     /** Empty pool namespaces of projects this machine no longer serves, removed. */
     prunedNamespaces: string[];
+    /**
+     * Whether pod isolation is in force, while desired state asks for it (a
+     * host-runtime machine). Undefined otherwise. Reported on every heartbeat.
+     */
+    isolation?: {
+        applied: boolean;
+    };
+    /**
+     * Whether the pod slice is hard-capped at the CPU the reserve leaves, on a
+     * host-runtime machine whose desired state reserves CPU. Undefined otherwise.
+     */
+    cpuQuotaApplied?: boolean;
 }
 declare function reconcile(ctx: ReconcileContext, desired: PersonalClusterDesiredState): Promise<ReconcileResult>;
 
@@ -519,12 +563,11 @@ declare function ownerConfiguredKeys(ownerConfig: string | null): Set<string>;
  * they chose, and last-writer-wins on their own file is exactly what this
  * module exists not to do.
  */
-declare function renderK3sDropIn(kubelet: PersonalClusterKubeletState, ownerConfig: string | null): DropInRenderResult;
-/**
- * @deprecated Use {@link renderK3sDropIn}. Kept as a named alias because the
- * package exports it and a published CLI may still import it by this name.
- */
-declare const renderKubeletDropIn: typeof renderK3sDropIn;
+declare function renderK3sDropIn(kubelet: PersonalClusterKubeletState, ownerConfig: string | null, 
+/** False on an adopted k3s: its components stay as its owner set them. */
+options?: {
+    disableComponents?: boolean;
+}): DropInRenderResult;
 
 interface UnitRenderOptions {
     /** Absolute path to the installed `conveyor-k3` binary. */
@@ -585,6 +628,18 @@ interface MachineState {
      */
     k3sStoreBytes?: number;
     k3sStoreMeasuredAt?: string;
+    /**
+     * "host" once `conveyor-k3 host setup` or `host link` enrolled this machine
+     * as a host-runtime instance. Absent on a VM guest, including every state
+     * file written before the host runtime existed.
+     */
+    runtime?: "host";
+    /**
+     * True once setup installed this machine's k3s. Absent on a k3s setup found
+     * already installed, and in every state file written before the field
+     * existed. See {@link managesK3s}.
+     */
+    k3sInstalledByConveyor?: boolean;
 }
 declare function readState(fs: FileSystemPort$1): Promise<MachineState>;
 declare function writeState(fs: FileSystemPort$1, state: MachineState): Promise<void>;
@@ -597,7 +652,7 @@ declare function writeState(fs: FileSystemPort$1, state: MachineState): Promise<
  * help output below is part of the product: every verb states what it does to
  * their machine, and `uninstall` states what it does not.
  */
-declare const VERBS: readonly ["vm", "setup", "start", "stop", "status", "sync", "update", "registry", "runners", "uninstall", "daemon"];
+declare const VERBS: readonly ["vm", "host", "setup", "start", "stop", "status", "sync", "update", "registry", "runners", "uninstall", "daemon"];
 type Verb = (typeof VERBS)[number];
 declare function isVerb(value: string): value is Verb;
 interface ParsedArgs {
@@ -613,7 +668,7 @@ interface ParsedArgs {
  * this surface is nine verbs and six flags, not a general CLI framework.
  */
 declare function parseArgs(argv: readonly string[]): ParsedArgs;
-declare const HELP = "conveyor-k3 \u2014 managed personal compute for Conveyor\n\nUsage: conveyor-k3 <command> [options]\n\nCommands:\n  vm                    Manage isolated compute on macOS or Linux.\n                        Run conveyor-k3 vm for host lifecycle commands.\n  setup                 Install and enrol this machine. Safe to re-run.\n  start                 Start the tunnel and the daemon.\n  stop                  Stop both, and tell Conveyor at once so your next\n                        build goes straight to project compute.\n  status [--json]       What is running, what Conveyor knows, and what is\n                        missing.\n  sync                  Re-read your settings from Conveyor and apply them.\n  update                Update conveyor-k3, cloudflared, and (when you have\n                        allowed it and nothing is running) k3s.\n  registry list         Which registry credentials are configured, and which\n                        ones your projects still need.\n  registry add <host>   Add one registry credential.\n                          --username <user>\n                          --password-stdin      read the password from stdin\n                          --no-restart          skip the required k3s restart\n  registry gc           Delete superseded shadow-bake images from the image\n                        registry inside this cluster. Runs daily on its own,\n                        and only while no Conveyor pod or bake is running.\n                          --dry-run             list what it would delete\n  runners list          Which GitHub Actions runners this machine hosts, and\n                        whether each may import a locally baked image.\n  runners grant <user>\u2026 Let those runner users import a locally baked image\n                        into this node and pin it. Writes one file under\n                        /etc/sudoers.d, checked with visudo first. Needed only\n                        when a project has Bake Locally turned on.\n  uninstall             Remove Conveyor's units, environment, state, and image\n                        registry. Your k3s config, your own registries.yaml\n                        entries, your workloads, and the registry's data are\n                        left alone.\n                          --purge-k3s --yes     also remove k3s itself and the\n                                                registry's data\n  daemon                Run in the foreground (what the systemd unit calls).\n\nOptions:\n  --version             Print the version.\n  --help                Print this message.\n\nDocs: https://conveyor.rallycryapp.com/docs/guides/managed-personal-compute\n";
+declare const HELP = "conveyor-k3 \u2014 Personal Compute for Conveyor\n\nUsage: conveyor-k3 <command> [options]\n\nOne product, two runtimes. Pick the one that fits the machine:\n\nOn your computer or server:\n  vm                    Personal computer runtime: an isolated VM on macOS or\n                        Linux. Run conveyor-k3 vm for its commands.\n  host                  Dedicated server runtime: k3s and the daemon on this\n                        Linux machine, with no VM. Root only. Run\n                        conveyor-k3 host for its commands.\n\nInside a linked machine (the VM guest, or the server itself):\n  setup                 VM guest only: install and enrol this machine. Safe\n                        to re-run. On a server, use conveyor-k3 host setup.\n  start                 Start the tunnel and the daemon.\n  stop                  Stop both, and tell Conveyor at once so your next\n                        build goes straight to project compute.\n  status [--json]       What is running, what Conveyor knows, and what is\n                        missing.\n  sync                  Re-read your settings from Conveyor and apply them.\n  update                Update conveyor-k3, cloudflared, and (when you have\n                        allowed it and nothing is running) k3s.\n  registry list         Which registry credentials are configured, and which\n                        ones your projects still need.\n  registry add <host>   Add one registry credential.\n                          --username <user>\n                          --password-stdin      read the password from stdin\n                          --no-restart          skip the required k3s restart\n  registry gc           Delete superseded shadow-bake images from the image\n                        registry inside this cluster. Runs daily on its own,\n                        and only while no Conveyor pod or bake is running.\n                          --dry-run             list what it would delete\n  runners list          Which GitHub Actions runners this machine hosts, and\n                        whether each may import a locally baked image.\n  runners grant <user>\u2026 Let those runner users import a locally baked image\n                        into this node and pin it. Writes one file under\n                        /etc/sudoers.d, checked with visudo first. Needed only\n                        when a project has Bake Locally turned on.\n  uninstall             VM guest only: remove Conveyor's units, environment,\n                        state, and image registry. Your k3s config, your own\n                        registries.yaml entries, your workloads, and the\n                        registry's data are left alone. On a server, use\n                        conveyor-k3 host uninstall: it also removes the\n                        device key.\n                          --purge-k3s --yes     also remove k3s itself and the\n                                                registry's data\n  daemon                Run in the foreground (what the systemd unit calls).\n\nOptions:\n  --version             Print the version.\n  --help                Print this message.\n\nDocs: https://conveyor.rallycryapp.com/docs/guides/managed-personal-compute\n";
 
 /**
  * `conveyor-k3 registry add|list|gc` — where an owner adds registry
@@ -687,27 +742,21 @@ interface UninstallResult {
 declare function uninstall(ports: UninstallPorts, options?: UninstallOptions): Promise<UninstallResult>;
 
 /**
- * `conveyor-k3 update` — the maintenance-window updater.
- *
- * Updates ride a systemd timer and NEVER runtime self-replacement. The agent
- * removed runtime self-update after the 2026-07-19 eviction outage; a daemon
- * that swaps its own binary mid-run has exactly the same failure shape. Here
- * the package is replaced by a separate oneshot unit, and the daemon is
- * restarted afterwards by systemd.
- *
- * Three independent pieces, each with its own decision:
- *
- * - **The package.** Installed at the EXACT version Conveyor's desired state
- *   names, never `@latest` — the npm dist-tag is a root-execution channel on
- *   every enrolled machine, so a compromised publish would reach them all
- *   within a day. The daemon restarts only if the version actually moved.
- * - **cloudflared.** `cloudflared update` exits 11 to mean "updated"; that is
- *   the only case that needs a tunnel restart.
- * - **k3s.** Only when the owner allowed it AND nothing of Conveyor's is
- *   running. A k3s upgrade at the wrong moment interrupts someone's build, and
- *   no upgrade is worth that.
+ * Who keeps this machine's cloudflared current.
+ *
+ * `cloudflared update` only works on a binary cloudflared installed itself. A
+ * package-manager build refuses: it prints "cloudflared was installed by a
+ * package manager" and exits 0 — the same exit as "already current". Read by
+ * exit code alone, such a machine reports a current cloudflared forever while
+ * apt (or nothing) is what actually updates it.
+ *
+ * The literal path lies, too. On a server where `/usr/local/bin/cloudflared`
+ * is a symlink to apt's `/usr/bin/cloudflared` there is ONE binary, owned by
+ * dpkg, so the owner check runs against the resolved path.
  */
 
+type CloudflaredUpdater = "conveyor" | "package-manager";
+
 interface UpdatePorts {
     exec: Executor;
     log: (line: string) => void;
@@ -729,6 +778,12 @@ interface UpdateBinaries {
 }
 interface UpdateDecisionInput {
     autoUpgradeK3s: boolean;
+    /**
+     * False on a server whose k3s setup did not install (`managesK3s`): the
+     * installer would turn off the owner's traefik and servicelb. Absent reads
+     * as true, which is every VM guest.
+     */
+    managesK3s?: boolean;
     /** Null when the count could not be read — treated exactly like "busy". */
     runningConveyorPods: number | null;
     installedK3s: [number, number] | null;
@@ -751,6 +806,8 @@ declare function decideK3sUpgrade(input: UpdateDecisionInput): K3sUpgradeDecisio
 interface UpdateResult {
     packageUpdated: boolean;
     cloudflaredUpdated: boolean;
+    /** Who keeps cloudflared current; null when this run could not tell. */
+    cloudflaredUpdater: CloudflaredUpdater | null;
     k3sUpgraded: boolean;
     notes: string[];
 }
@@ -959,4 +1016,4 @@ declare function pathsForRoot(root: string, instance?: string): {
 };
 type HostPaths = ReturnType<typeof pathsForRoot>;
 
-export { ClusterConnection, type ClusterConnectionConfig, ClusterDaemon, CommandError, type CrictlImage, DEFAULT_INSTANCE, type DaemonPorts, type Executor, type FileSystemPort$1 as FileSystemPort, type GuestDnsProvision, type GuestSrvRecord, HELP, type HostPaths, type ImageInventory, K3S_DISABLED_COMPONENTS, K3S_INSTALL_EXEC, type K3sUpgradeDecision, type MachineState, type NetworkEndpoint, type NetworkPolicy, type QemuNetworkPolicy, type ReconcileContext, type ReconcileResult, type RegistriesFile, type ResolvedNetwork, type ResolvedNetworkHost, type SRVLookup, type UninstallResult, type UnitRenderOptions, VERBS, type Verb, cloudflaredSrvRecords, collectHeartbeat, configuredAuthHosts, countRunningConveyorPods, createMemoryFileSystem, decideK3sUpgrade, hostPaths, isGloballyRoutableIPv4, isVerb, maximumGuestMemoryGiB, maximumGuestMemoryGiBWithin, meetsK3sMinimum, missingAuthHosts, nodeFileSystem, ownerConfiguredKeys, ownerConfiguredKubeletFlags, parseArgs, parseInstanceName, parseK3sVersion, parseRegistries, pruneStrandedImages, readImageInventory, readState, reconcile, registryAdd, registryList, renderAllUnits, renderGuestDnsProvision, renderK3sDropIn, renderKubeletDropIn, renderRegistryAuthSummary, resolveCloudflaredSrvRecords, resolveNetwork, rewriteQemuArgs, runOrThrow, runUpdate, selectStrandedImages, serializeRegistries, spawnExecutor, uninstall, upsertRegistryAuth, warmImages, writeState };
+export { ClusterConnection, type ClusterConnectionConfig, ClusterDaemon, CommandError, type CrictlImage, DEFAULT_INSTANCE, type DaemonPorts, type Executor, type FileSystemPort$1 as FileSystemPort, type GuestDnsProvision, type GuestSrvRecord, HELP, type HostPaths, type ImageInventory, K3S_DISABLED_COMPONENTS, K3S_INSTALL_EXEC, type K3sUpgradeDecision, type MachineState, type NetworkEndpoint, type NetworkPolicy, type QemuNetworkPolicy, type ReconcileContext, type ReconcileResult, type RegistriesFile, type ResolvedNetwork, type ResolvedNetworkHost, type SRVLookup, type UninstallResult, type UnitRenderOptions, VERBS, type Verb, cloudflaredSrvRecords, collectHeartbeat, configuredAuthHosts, countRunningConveyorPods, createMemoryFileSystem, decideK3sUpgrade, hostPaths, isGloballyRoutableIPv4, isVerb, maximumGuestMemoryGiB, maximumGuestMemoryGiBWithin, meetsK3sMinimum, missingAuthHosts, nodeFileSystem, ownerConfiguredKeys, ownerConfiguredKubeletFlags, parseArgs, parseInstanceName, parseK3sVersion, parseRegistries, pruneStrandedImages, readImageInventory, readState, reconcile, registryAdd, registryList, renderAllUnits, renderGuestDnsProvision, renderK3sDropIn, renderRegistryAuthSummary, resolveCloudflaredSrvRecords, resolveNetwork, rewriteQemuArgs, runOrThrow, runUpdate, selectStrandedImages, serializeRegistries, spawnExecutor, uninstall, upsertRegistryAuth, warmImages, writeState };