@rulebricks/cli 2.1.5 → 2.1.6

package/dist/commands/deploy.js

@@ -8,7 +8,7 @@ import { loadDeploymentConfig, loadDeploymentState, saveDeploymentState, updateD
 import { setupTerraformWorkspace, terraformInit, terraformPlan, terraformApply, terraformDestroy, cleanupOrphanedResources, updateKubeconfig, hasTerraformState, isTerraformInstalled, generateTerraformVars, } from "../lib/terraform.js";
 import { checkGcpApplicationDefaultCredentials, checkAzureResourceProviders, checkAzureVmQuota, AZURE_TIER_CORES, } from "../lib/cloudCli.js";
 import { installOrUpgradeChart, upgradeChart, isHelmInstalled, } from "../lib/helm.js";
-import { isKubectlInstalled, checkClusterAccessible, } from "../lib/kubernetes.js";
+import { isKubectlInstalled, checkClusterAccessible, waitForCertificatesReady, } from "../lib/kubernetes.js";
 import { generateHelmValues, updateHelmValuesForTLS, } from "../lib/helmValues.js";
 import { isSupportedDnsProvider, getNamespace, getReleaseName, } from "../types/index.js";
 function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
@@ -20,11 +20,13 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
     const [useExternalDns, setUseExternalDns] = useState(false);
     const infraStartedRef = useRef(false); // Track if we started infra provisioning (ref for sync access)
     const [cleanupError, setCleanupError] = useState(null);
+    const [tlsWarning, setTlsWarning] = useState(null);
     const [status, setStatus] = useState({
         preflight: "pending",
         infrastructure: "pending",
         kubeconfig: "pending",
         helmInstall: "pending",
+        certCheck: "pending",
         dnsConfig: "pending",
         helmUpgradeTls: "pending",
     });
@@ -83,7 +85,17 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
             const releaseName = getReleaseName(config.name);
             // Upgrade the chart with TLS enabled
             await upgradeChart(name, { releaseName, namespace, version, wait: true });
-            setStatus((s) => ({ ...s, helmUpgradeTls: "success" }));
+            setStatus((s) => ({ ...s, helmUpgradeTls: "success", certCheck: "running" }));
+            setStep("cert-check");
+            try {
+                await waitForCertificatesReady(namespace);
+                setStatus((s) => ({ ...s, certCheck: "success" }));
+            }
+            catch (certErr) {
+                setStatus((s) => ({ ...s, certCheck: "error" }));
+                setTlsWarning("TLS certificates are still being issued. " +
+                    "HTTPS may not be available yet.");
+            }
             // Update state
             await updateDeploymentStatus(name, "running", {
                 application: {
@@ -113,6 +125,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
             ...s,
             dnsConfig: "skipped",
             helmUpgradeTls: "skipped",
+            certCheck: "skipped",
         }));
         const namespace = getNamespace(config.name);
         // Mark as running without TLS upgrade
@@ -223,7 +236,18 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                     helmInstall: "success",
                     dnsConfig: "skipped", // External DNS handles this
                     helmUpgradeTls: "skipped", // TLS enabled from start
+                    certCheck: "running",
                 }));
+                setStep("cert-check");
+                try {
+                    await waitForCertificatesReady(namespace);
+                    setStatus((s) => ({ ...s, certCheck: "success" }));
+                }
+                catch (certErr) {
+                    setStatus((s) => ({ ...s, certCheck: "error" }));
+                    setTlsWarning("TLS certificates are still being issued. " +
+                        "HTTPS may not be available yet.");
+                }
                 // Update state to running
                 await updateDeploymentStatus(name, "running", {
                     application: {
@@ -254,6 +278,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                         ...s,
                         dnsConfig: "skipped",
                         helmUpgradeTls: "skipped",
+                        certCheck: "skipped",
                     }));
                     await updateDeploymentStatus(name, "waiting-dns", {
                         application: {
@@ -421,7 +446,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
     // Complete screen
     if (step === "complete") {
         const tlsSkipped = status.helmUpgradeTls === "skipped" && !useExternalDns;
-        return (_jsx(BorderBox, { title: "Deployment Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Rulebricks deployed successfully!" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["URL:", " ", _jsxs(Text, { color: colors.accent, children: ["https://", config?.domain, "/auth/signup"] })] }), useExternalDns && (_jsx(Text, { color: colors.muted, children: "DNS records will be created automatically by external-dns" })), tlsSkipped && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 TLS not configured. Run `rulebricks deploy ", name, "` again after DNS setup."] }) }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Next steps:" }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Visit the URL to complete initial setup"] }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check deployment health"] }), tlsSkipped && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Configure DNS and re-run deploy for TLS"] }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, dimColor: true, children: "Tip: If the URL isn't accessible yet, your local DNS may need time to propagate." }), _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Flush DNS cache: ", getDnsFlushCommand()] })] })] }) }));
+        return (_jsx(BorderBox, { title: "Deployment Complete", children: _jsxs(Box, { flexDirection: "column", marginY: 1, children: [_jsx(Text, { color: colors.success, bold: true, children: "\u2713 Rulebricks deployed successfully!" }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: ["URL:", " ", _jsxs(Text, { color: colors.accent, children: ["https://", config?.domain, "/auth/signup"] })] }), useExternalDns && (_jsx(Text, { color: colors.muted, children: "DNS records will be created automatically by external-dns" })), tlsSkipped && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 TLS not configured. Run `rulebricks deploy ", name, "` again after DNS setup."] }) })), tlsWarning && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: colors.warning, children: ["\u26A0 ", tlsWarning] }) }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Next steps:" }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Visit the URL to complete initial setup"] }), _jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check deployment health"] }), tlsSkipped && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Configure DNS and re-run deploy for TLS"] })), tlsWarning && (_jsxs(Text, { color: colors.muted, children: [" ", "\u2022 Run `rulebricks status ", name, "` to check TLS certificate status"] }))] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { color: colors.muted, dimColor: true, children: "Tip: If the URL isn't accessible yet, your local DNS may need time to propagate." }), _jsxs(Text, { color: colors.muted, dimColor: true, children: ["Flush DNS cache: ", getDnsFlushCommand()] })] })] }) }));
     }
     // Progress screen
     const helmInstallLabel = useExternalDns
@@ -435,7 +460,7 @@ function DeployCommandInner({ name, skipInfra, skipDns, version, }) {
                                 ? "Planning changes"
                                 : step === "infra-apply"
                                     ? "Applying infrastructure"
-                                    : undefined }), _jsx(StatusLine, { status: status.kubeconfig, label: "Kubernetes configuration" }), _jsx(StatusLine, { status: status.helmInstall, label: helmInstallLabel }), !useExternalDns && (_jsxs(_Fragment, { children: [_jsx(StatusLine, { status: status.dnsConfig, label: "DNS configuration" }), _jsx(StatusLine, { status: status.helmUpgradeTls, label: "TLS configuration" })] })), step !== "dns-wait" && (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: getStepLabel(step, useExternalDns) }) }))] }) }));
+                                    : undefined }), _jsx(StatusLine, { status: status.kubeconfig, label: "Kubernetes configuration" }), _jsx(StatusLine, { status: status.helmInstall, label: helmInstallLabel }), !useExternalDns && (_jsxs(_Fragment, { children: [_jsx(StatusLine, { status: status.dnsConfig, label: "DNS configuration" }), _jsx(StatusLine, { status: status.helmUpgradeTls, label: "TLS configuration" })] })), _jsx(StatusLine, { status: status.certCheck, label: "TLS certificate verification" }), step !== "dns-wait" && (_jsx(Box, { marginTop: 1, children: _jsx(Spinner, { label: getStepLabel(step, useExternalDns) }) }))] }) }));
 }
 function getDnsFlushCommand() {
     switch (platform()) {
@@ -471,6 +496,8 @@ function getStepLabel(step, useExternalDns) {
             return "Waiting for DNS configuration...";
         case "helm-upgrade-tls":
             return "Enabling TLS certificates...";
+        case "cert-check":
+            return "Verifying TLS certificates...";
         default:
             return "Processing...";
     }

package/dist/lib/kubernetes.d.ts

@@ -58,7 +58,31 @@ export interface CertificateStatus {
     name: string;
     dnsNames: string[];
     ready: boolean;
+    failed: boolean;
+    message?: string;
 }
+/**
+ * Deletes a failed cert-manager Certificate and recreates it from its spec,
+ * bypassing cert-manager's exponential backoff on failed issuance attempts.
+ * The delete cascades to the failed CertificateRequest and ACME Order via
+ * owner references, so the recreated Certificate starts with a clean slate.
+ */
+export declare function recreateFailedCertificate(namespace: string, certName: string): Promise<boolean>;
+/**
+ * Polls cert-manager Certificates until all are Ready, with automatic retry
+ * for transient ACME failures (e.g. order finalization race conditions).
+ *
+ * On failure detection: deletes and recreates the Certificate resource to
+ * bypass cert-manager's 1-hour exponential backoff, then continues polling.
+ *
+ * Throws on timeout with details about which certs are not ready.
+ * Returns silently if no Certificate resources exist in the namespace.
+ */
+export declare function waitForCertificatesReady(namespace: string, options?: {
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    maxRetries?: number;
+}): Promise<void>;
 /**
  * Streams logs from a pod
  */

package/dist/lib/kubernetes.js

@@ -258,16 +258,109 @@ export async function getCertificateStatus(namespace = DEFAULT_NAMESPACE) {
             "json",
         ]);
         const data = JSON.parse(stdout);
-        return data.items.map((cert) => ({
-            name: cert.metadata.name,
-            dnsNames: cert.spec.dnsNames ?? [],
-            ready: cert.status.conditions?.some((c) => c.type === "Ready" && c.status === "True") ?? false,
-        }));
+        return data.items.map((cert) => {
+            const readyCond = cert.status.conditions?.find((c) => c.type === "Ready");
+            const issuingCond = cert.status.conditions?.find((c) => c.type === "Issuing");
+            const ready = readyCond?.status === "True";
+            const failed = !ready &&
+                issuingCond?.status === "False" &&
+                issuingCond?.reason === "Failed";
+            return {
+                name: cert.metadata.name,
+                dnsNames: cert.spec.dnsNames ?? [],
+                ready,
+                failed: failed ?? false,
+                message: failed ? issuingCond?.message : readyCond?.message,
+            };
+        });
     }
     catch {
         return [];
     }
 }
+/**
+ * Deletes a failed cert-manager Certificate and recreates it from its spec,
+ * bypassing cert-manager's exponential backoff on failed issuance attempts.
+ * The delete cascades to the failed CertificateRequest and ACME Order via
+ * owner references, so the recreated Certificate starts with a clean slate.
+ */
+export async function recreateFailedCertificate(namespace, certName) {
+    try {
+        const { stdout } = await execa("kubectl", [
+            "get",
+            "certificate",
+            certName,
+            "-n",
+            namespace,
+            "-o",
+            "json",
+        ]);
+        const cert = JSON.parse(stdout);
+        const recreated = {
+            apiVersion: "cert-manager.io/v1",
+            kind: "Certificate",
+            metadata: {
+                name: cert.metadata.name,
+                namespace: cert.metadata.namespace,
+                ...(cert.metadata.labels ? { labels: cert.metadata.labels } : {}),
+                ...(cert.metadata.annotations
+                    ? { annotations: cert.metadata.annotations }
+                    : {}),
+            },
+            spec: cert.spec,
+        };
+        await execa("kubectl", ["delete", "certificate", certName, "-n", namespace]);
+        await execa("kubectl", ["apply", "-f", "-"], {
+            input: JSON.stringify(recreated),
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Polls cert-manager Certificates until all are Ready, with automatic retry
+ * for transient ACME failures (e.g. order finalization race conditions).
+ *
+ * On failure detection: deletes and recreates the Certificate resource to
+ * bypass cert-manager's 1-hour exponential backoff, then continues polling.
+ *
+ * Throws on timeout with details about which certs are not ready.
+ * Returns silently if no Certificate resources exist in the namespace.
+ */
+export async function waitForCertificatesReady(namespace, options) {
+    const { timeoutMs = 120_000, pollIntervalMs = 5_000, maxRetries = 1, } = options ?? {};
+    let retriesUsed = 0;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const certs = await getCertificateStatus(namespace);
+        if (certs.length === 0)
+            return;
+        if (certs.every((c) => c.ready))
+            return;
+        const failed = certs.filter((c) => c.failed);
+        if (failed.length > 0 && retriesUsed < maxRetries) {
+            for (const cert of failed) {
+                await recreateFailedCertificate(namespace, cert.name);
+            }
+            retriesUsed++;
+        }
+        await sleep(pollIntervalMs);
+    }
+    // Final check after timeout
+    const certs = await getCertificateStatus(namespace);
+    if (certs.length > 0 && certs.every((c) => c.ready))
+        return;
+    const notReady = certs.filter((c) => !c.ready);
+    if (notReady.length > 0) {
+        const details = notReady
+            .map((c) => `  ${c.name}: ${c.message || "not ready"}`)
+            .join("\n");
+        throw new Error(`TLS certificates not ready after ${timeoutMs / 1000}s:\n${details}\n\n` +
+            `Run 'rulebricks status' to check certificate status.`);
+    }
+}
 /**
  * Streams logs from a pod
  */

package/dist/types/index.d.ts

@@ -701,7 +701,7 @@ export declare const ProfileConfigSchema: z.ZodObject<{
 }>;
 export type ProfileConfig = z.infer<typeof ProfileConfigSchema>;
 export declare const CHANGELOG_URL = "https://rulebricks.com/docs/changelog";
-export declare const HELM_CHART_OCI = "oci://ghcr.io/rulebricks/charts/stack";
+export declare const HELM_CHART_OCI = "oci://ghcr.io/rulebricks/helm/stack";
 export declare const DEFAULT_NAMESPACE = "rulebricks";
 export declare const LEGACY_RELEASE_NAME = "rulebricks";
 /**

package/dist/types/index.js

@@ -603,7 +603,7 @@ export const ProfileConfigSchema = z.object({
 });
 // Constants
 export const CHANGELOG_URL = "https://rulebricks.com/docs/changelog";
-export const HELM_CHART_OCI = "oci://ghcr.io/rulebricks/charts/stack";
+export const HELM_CHART_OCI = "oci://ghcr.io/rulebricks/helm/stack";
 // Legacy namespace/release name - kept for backwards compatibility with existing deployments
 export const DEFAULT_NAMESPACE = "rulebricks";
 export const LEGACY_RELEASE_NAME = "rulebricks";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulebricks/cli",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "description": "CLI for deploying and managing private Rulebricks instances",
   "type": "module",
   "bin": {