@telorun/k8s-runner 0.10.2 → 0.11.0

package/src/k8s/workspace-configmap.ts

@@ -0,0 +1,133 @@
+import { createHash } from "node:crypto";
+
+import { workspaceAppManifest, WORKSPACE_APP_FILENAME } from "@telorun/runner-core";
+
+import type { K8sRunnerConfig } from "../config.js";
+import type { KubeClient } from "./client.js";
+
+/**
+ * The workspace application's manifest, delivered to the pod as a ConfigMap.
+ *
+ * Named by a hash of its own content, so a runner upgrade that changes the
+ * manifest creates a NEW ConfigMap and leaves running sessions mounting the one
+ * they booted with — a mutable name would swap a manifest under a live pod, and
+ * kubelet ConfigMap propagation is asynchronous, so the failure would be a
+ * workspace container that restarts into a different surface at an arbitrary
+ * moment.
+ *
+ * Reconciled by the runner rather than shipped by the chart, so the manifest and
+ * the code that depends on it version as one artifact: a chart-only upgrade
+ * cannot leave them skewed. The cost is one RBAC rule (`configmaps: get, create`
+ * in the session namespace).
+ */
+const WORKSPACE_CONFIGMAP_PREFIX = "telo-workspace-app-";
+
+export function workspaceConfigMapName(): string {
+  const digest = createHash("sha256").update(workspaceAppManifest()).digest("hex").slice(0, 12);
+  return `${WORKSPACE_CONFIGMAP_PREFIX}${digest}`;
+}
+
+/** Create the ConfigMap if it is not already there. Content-addressed, so an
+ *  existing one with this name already holds exactly these bytes and a 409 is
+ *  success rather than a conflict to resolve. */
+export async function ensureWorkspaceConfigMap(
+  kube: KubeClient,
+  config: K8sRunnerConfig,
+): Promise<string> {
+  const name = workspaceConfigMapName();
+  try {
+    await kube.core.readNamespacedConfigMap({ name, namespace: config.sessionNamespace });
+    return name;
+  } catch (err) {
+    if (!isNotFound(err)) throw err;
+  }
+  try {
+    await kube.core.createNamespacedConfigMap({
+      namespace: config.sessionNamespace,
+      body: {
+        apiVersion: "v1",
+        kind: "ConfigMap",
+        metadata: {
+          name,
+          namespace: config.sessionNamespace,
+          labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+        },
+        data: { [WORKSPACE_APP_FILENAME]: workspaceAppManifest() },
+      },
+    });
+  } catch (err) {
+    // Two runners (or two concurrent starts) racing to create the same
+    // content-addressed name is not a failure — the loser mounts the winner's
+    // identical bytes.
+    if (!isConflict(err)) throw err;
+  }
+  return name;
+}
+
+function statusOf(err: unknown): number | undefined {
+  const e = err as { statusCode?: number; code?: number; response?: { statusCode?: number } };
+  return e?.statusCode ?? e?.code ?? e?.response?.statusCode;
+}
+
+function isNotFound(err: unknown): boolean {
+  return statusOf(err) === 404;
+}
+
+function isConflict(err: unknown): boolean {
+  return statusOf(err) === 409;
+}
+
+/**
+ * Delete workspace-app ConfigMaps no live pod mounts.
+ *
+ * The name is content-addressed, so every release that changes the manifest
+ * leaves the previous one behind — permanently, since nothing else removes it.
+ * Run at boot, alongside the orphan pod reap: a session that survives a runner
+ * restart is impossible (the registry is in memory), so anything a live pod
+ * still references is a pod this process is about to reap anyway.
+ *
+ * Keeps the CURRENT hash unconditionally, and skips any map a pod still lists —
+ * a mounted ConfigMap that disappears makes the kubelet fail the pod.
+ */
+export async function sweepWorkspaceConfigMaps(
+  kube: KubeClient,
+  config: K8sRunnerConfig,
+  log: { info(obj: unknown, msg: string): void; warn(obj: unknown, msg: string): void },
+): Promise<void> {
+  const keep = new Set([workspaceConfigMapName()]);
+  let pods: Awaited<ReturnType<KubeClient["core"]["listNamespacedPod"]>>;
+  let maps: Awaited<ReturnType<KubeClient["core"]["listNamespacedConfigMap"]>>;
+  try {
+    [pods, maps] = await Promise.all([
+      kube.core.listNamespacedPod({ namespace: config.sessionNamespace }),
+      kube.core.listNamespacedConfigMap({
+        namespace: config.sessionNamespace,
+        labelSelector: `app.kubernetes.io/managed-by=${config.managedByLabel}`,
+      }),
+    ]);
+  } catch (err) {
+    // Housekeeping, not correctness — a runner that cannot list is a runner
+    // whose next boot will try again.
+    log.warn({ err }, "could not sweep workspace-app ConfigMaps");
+    return;
+  }
+
+  for (const pod of pods.items ?? []) {
+    for (const volume of pod.spec?.volumes ?? []) {
+      if (volume.configMap?.name) keep.add(volume.configMap.name);
+    }
+  }
+
+  let removed = 0;
+  for (const map of maps.items ?? []) {
+    const name = map.metadata?.name;
+    if (!name?.startsWith(WORKSPACE_CONFIGMAP_PREFIX) || keep.has(name)) continue;
+    try {
+      await kube.core.deleteNamespacedConfigMap({ name, namespace: config.sessionNamespace });
+      removed += 1;
+    } catch (err) {
+      if (!isNotFound(err)) log.warn({ err, name }, "failed to delete a stale workspace ConfigMap");
+    }
+  }
+  if (removed > 0) log.info({ removed }, "swept stale workspace-app ConfigMaps");
+}

package/src/server.ts

@@ -15,6 +15,7 @@ import { kubernetesRunnerCapabilities } from "./capabilities.js";
 import { loadK8sRunnerConfig, RunnerConfigError, type K8sRunnerConfig } from "./config.js";
 import { createKubernetesBackend } from "./k8s/backend.js";
 import { createKubeClient } from "./k8s/client.js";
+import { sweepWorkspaceConfigMaps } from "./k8s/workspace-configmap.js";
 
 const VERSION: string = packageJson.version;
 
@@ -32,6 +33,7 @@ export async function buildServer(deps: ServerDeps): Promise<ServerHandle> {
   // Load terms once; the capabilities getter is re-resolved per request so a
   // refreshed catalog (new tags) shows up without restarting the runner.
   const terms = loadTermsFromEnv(process.env);
+  const apps = loadResolvedApps(process.env);
 
   const handle = await coreBuildServer({
     backend: deps.backend,
@@ -44,11 +46,16 @@ export async function buildServer(deps: ServerDeps): Promise<ServerHandle> {
         defaultImage: deps.config.defaultImage,
         terms,
         imageEnum: catalog?.current(),
+        watch: deps.config.watch.enabled,
+        // A co-resident agent is drawn from the same catalog an app session
+        // launches from — the advertised set and the accepted set are one list,
+        // so they cannot drift.
+        agents: deps.config.watch.enabled ? Object.keys(apps) : undefined,
       }),
     defaultRegistryUrl: process.env.TELO_REGISTRY_URL,
     // Operator-predefined apps (RUNNER_APPS; none when unset). Advertised on
     // /v1/capabilities; app sessions run the catalog image directly (no build).
-    apps: loadResolvedApps(process.env),
+    apps,
     validateConfig: catalog
       ? (sessionConfig: SessionConfig): string | undefined =>
           catalog.isAllowed(sessionConfig.image)
@@ -106,6 +113,9 @@ async function main(): Promise<void> {
   // Reap pods orphaned by a prior runner process (in-memory registry).
   if (backend.reapOrphans) {
     await backend.reapOrphans().catch((err) => app.log.warn({ err }, "orphan reap failed"));
+    // After the pods are gone: a content-addressed workspace ConfigMap outlives
+    // every release that changed the manifest, and nothing else removes it.
+    await sweepWorkspaceConfigMaps(kube, config, app.log);
   }
 
   try {