@serve.zone/interfaces 32.58.0 → 32.60.0

package/ts/data/serviceruntime.ts

@@ -89,6 +89,7 @@ const serviceRuntimeRefusals = [
   'network-workload-pool-missing', 'network-workload-pool-exhausted',
   'volume-driver-unsupported', 'volume-options-unsupported', 'volume-shared-unsupported',
   'volume-placement-unsupported', 'volume-initialization-unknown', 'volume-ownership-unknown',
+  'launcher-secret-ownership-unknown',
   'objectstorage-endpoint-missing', 'objectstorage-binding-invalid', 'objectstorage-environment-conflict',
   'objectstorage-endpoint-unselected', 'database-endpoint-missing', 'database-endpoint-unselected',
   'published-port-reserved', 'published-port-symmetric-without-egress', 'readiness-network-unsupported',
@@ -128,11 +129,18 @@ export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[n
  * `volume-ownership-unknown` a `run-as` ownership under `runAs: null`
  * (`deriveServiceVolumeClaimInitialization`); neither is defaulted.
  *
+ * `launcher-secret-ownership-unknown` is a service with launcher-environment secrets whose runtime
+ * spec runs the image's own user (`runAs: null`) while that user's numeric owner is not known: a
+ * named non-root user, a numeric part above the identity bound, a group a `0o440` delivery would grant that the image does not state
+ * numerically, or platforms of the pinned index that derive different owners
+ * (`deriveLauncherSecretDeliveryOwner`). WorkloadInit could not read secret files owned by a guess.
+ *
  * The object-storage refusals name why a binding's environment cannot be composed
  * (`composeObjectStorageServiceEnvironment`): `objectstorage-endpoint-missing` a binding whose node
  * states no valid `corestoreObjectStorage`, `objectstorage-binding-invalid` a binding
  * `createObjectStorageBindingEnvironment` refuses, and `objectstorage-environment-conflict` a name
- * the service's own environment or another binding already sets.
+ * the service's own environment, one of its launcher-environment secrets or another binding already
+ * sets.
  *
  * `database-endpoint-missing` is an enabled database binding placed on a node that states no valid
  * `corestoreDatabase`: its credential cannot be addressed to any host a workload reaches, so it is

package/ts/platform/objectstorageenvironment.ts

@@ -201,10 +201,17 @@ const findEnvironmentCollisions = (
   keysArg: readonly string[],
 ): string[] => keysArg.filter((keyArg) => claimedKeysArg.has(keyArg)).sort();
 
-const describeEnvironmentCollisions = (collisionsArg: readonly string[]): string => (
-  `objectstorage binding environment collides with ${collisionsArg.join(', ')} already set on the `
-    + 'workload'
-);
+const describeEnvironmentCollisions = (
+  collisionsArg: readonly string[],
+  secretNamesArg: ReadonlySet<string> = new Set(),
+): string => {
+  const secretCollisions = collisionsArg.filter((keyArg) => secretNamesArg.has(keyArg));
+  return `objectstorage binding environment collides with ${collisionsArg.join(', ')} already set on `
+    + 'the workload' + (secretCollisions.length > 0
+      ? `; ${secretCollisions.join(', ')} reaches it as a launcher-environment secret, which would `
+        + 'replace the binding\'s value'
+      : '');
+};
 
 /**
  * A workload environment with one binding's environment added.
@@ -252,8 +259,8 @@ export type TObjectStorageEnvironmentWaitingReason = Extract<
  * `corestoreObjectStorage`; `objectstorage-binding-invalid` a binding
  * `createObjectStorageBindingEnvironment()` refuses (not `objectstorage`, no canonical bucket, no
  * canonical retention intent, or evidence that does not prove this binding);
- * `objectstorage-environment-conflict` a name the service's own environment or another binding
- * already sets.
+ * `objectstorage-environment-conflict` a name the service's own environment, one of its
+ * launcher-environment secrets or another binding already sets.
  */
 export type TObjectStorageEnvironmentRefusal = Extract<
   TServiceRuntimeRefusal,
@@ -285,16 +292,27 @@ export type TObjectStorageServiceEnvironmentComposition =
  * already claims all twenty of its names, so a collision with it is refused now, not once its
  * evidence arrives. The first refusal is answered, otherwise the first wait, otherwise the
  * composed environment. The inputs are not changed.
+ *
+ * `secretEnvironmentNamesArg` names the variables the workload receives as launcher-environment
+ * secrets (each `ISecretResolvedLauncherEnvironmentDelivery.variableName` of its desired
+ * manifest), names only, never a value. The launcher sets a secret over a plain variable of the same name, so a
+ * secret named like one of a binding's names would silently replace the binding's value: such a
+ * name claims the binding's name exactly as the service's own environment does, and is refused as
+ * `objectstorage-environment-conflict`. A secret by any other name is not this composition's
+ * concern, and neither are a binding's credential names (`corestoreObjectStorageCredentialSecretKeys`),
+ * which the binding itself delivers as secrets and never as plain names.
  */
 export const composeObjectStorageServiceEnvironment = async (
   serviceEnvironmentArg: Readonly<Record<string, string>>,
   sourcesArg: readonly IObjectStorageBindingEnvironmentSource[],
+  secretEnvironmentNamesArg: readonly string[] = [],
 ): Promise<TObjectStorageServiceEnvironmentComposition> => {
   const sources = [...sourcesArg].sort((leftArg, rightArg) => (
     leftArg.binding.id < rightArg.binding.id ? -1 : leftArg.binding.id > rightArg.binding.id ? 1 : 0
   ));
   let environment: Record<string, string> = { ...serviceEnvironmentArg };
-  const claimedKeys = new Set(Object.keys(environment));
+  const secretNames: ReadonlySet<string> = new Set(secretEnvironmentNamesArg);
+  const claimedKeys = new Set([...Object.keys(environment), ...secretNames]);
   let wait: Extract<TObjectStorageServiceEnvironmentComposition, { status: 'waiting' }> | null = null;
   for (const source of sources) {
     const bindingId = source.binding.id;
@@ -308,7 +326,7 @@ export const composeObjectStorageServiceEnvironment = async (
     const collisions = findEnvironmentCollisions(claimedKeys, keys);
     if (collisions.length > 0) {
       return { status: 'refused', reason: 'objectstorage-environment-conflict', bindingId,
-        message: describeEnvironmentCollisions(collisions) };
+        message: describeEnvironmentCollisions(collisions, secretNames) };
     }
     for (const key of keys) claimedKeys.add(key);
     if (resolution.status === 'composed') {

package/ts/requests/externalregistry.ts

@@ -12,7 +12,7 @@ export interface IReq_GetRegistryById extends plugins.typedrequestInterfaces.imp
     id: string;
   };
   response: {
-    registry: data.IExternalRegistry;
+    registry: data.IExternalRegistryPublic;
   };
 }
 
@@ -25,7 +25,7 @@ export interface IReq_GetRegistries extends plugins.typedrequestInterfaces.imple
     identity: userInterfaces.IIdentity;
   };
   response: {
-    registries: data.IExternalRegistry[];
+    registries: data.IExternalRegistryPublic[];
   };
 }
 
@@ -39,7 +39,7 @@ export interface IReq_CreateRegistry extends plugins.typedrequestInterfaces.impl
     registryData: data.IExternalRegistry['data'];
   };
   response: {
-    registry: data.IExternalRegistry;
+    registry: data.IExternalRegistryPublic;
   };
 }
 
@@ -51,10 +51,14 @@ export interface IReq_UpdateRegistry extends plugins.typedrequestInterfaces.impl
   request: {
     identity: userInterfaces.IIdentity;
     registryId: string;
-    registryData: data.IExternalRegistry['data'];
+    /**
+     * The operator fields to change; a field left out keeps its stored value. `password` is
+     * write-only: missing or empty keeps the stored credential, and `authType: 'none'` removes it.
+     */
+    registryData: Partial<data.TExternalRegistryOperatorData>;
   };
   response: {
-    resultRegistry: data.IExternalRegistry;
+    resultRegistry: data.IExternalRegistryPublic;
   };
 }
 
@@ -82,8 +86,10 @@ export interface IReq_VerifyRegistry extends plugins.typedrequestInterfaces.impl
     registryId: string;
   };
   response: {
+    /** True exactly for the `authenticated` and `anonymous` outcomes. */
     success: boolean;
+    outcome: data.TExternalRegistryVerifyOutcome;
     message?: string;
-    registry?: data.IExternalRegistry;
+    registry: data.IExternalRegistryPublic;
   };
 }

package/ts/requests/service.ts

@@ -455,7 +455,22 @@ extends plugins.typedrequestInterfaces.implementsTR<
   request: {
     identity: IIdentity;
     serviceId: string;
-    serviceData: TServiceUpdateWritableData;
+    /**
+     * The fields to change, merged over the stored service one key deep: a key the update omits
+     * keeps its stored value, and a key it states replaces the stored value whole (a stated
+     * `ports`, `mail` or `domains` is the complete new value, not a patch of the old one).
+     * `containerArgs: null` removes the stored argument vector; no other field takes `null`.
+     * `registryTarget` is the exception to "replaces": Cloudly derives it from the service and
+     * its image version, so a stated one only makes Cloudly derive it again and is never stored.
+     * An optional field cannot be cleared yet: a key whose value is `undefined` is dropped in
+     * transit, so it reads as omitted (explicit `null` removal for optional fields is a follow-up).
+     *
+     * Cloudly's guards ask which keys an update states, so send only the fields that change: a
+     * service with a runtime spec refuses any update stating `placement` or `scaleFactor`, and an
+     * immutable service refuses `imageId`, `imageVersion`, `registryTarget`, `scaleFactor` and
+     * `placement`, even when the stated value repeats the stored one.
+     */
+    serviceData: Partial<TServiceUpdateWritableData>;
   };
   response: {
     service: IService;