@telorun/k8s-runner 0.13.0 → 0.15.0

package/src/k8s/routing/ingress-router.test.ts

@@ -0,0 +1,236 @@
+import { describe, expect, it } from "vitest";
+
+import type { PortMapping } from "@telorun/runner-core";
+
+import type { K8sRunnerConfig } from "../../config.js";
+import type { KubeClient } from "../client.js";
+import { buildSessionIngress, createIngressRouter } from "./ingress-router.js";
+import { endpointsFor } from "./session-endpoints.js";
+
+const config = {
+  sessionNamespace: "telo-sessions",
+  sessionRouting: {
+    mode: "ingress",
+    baseDomain: "telo.run",
+    ingressClassName: "nginx",
+    routeReadyTimeoutMs: 60_000,
+  },
+  managedByLabel: "telo-k8s-runner",
+} as K8sRunnerConfig;
+
+const sessionId = "hzyayvabgyvz";
+const ports: PortMapping[] = [
+  { port: 8080, protocol: "tcp" },
+  { port: 9090, protocol: "tcp" },
+  { port: 5000, protocol: "udp" },
+];
+
+function withRouting(patch: Partial<K8sRunnerConfig["sessionRouting"]>): K8sRunnerConfig {
+  return { ...config, sessionRouting: { ...config.sessionRouting, ...patch } } as K8sRunnerConfig;
+}
+
+describe("endpointsFor", () => {
+  it("gives every tcp port a <port>-<id>.<domain> host + url, udp host-less", () => {
+    expect(endpointsFor(config, sessionId, ports, true)).toEqual([
+      {
+        host: `8080-${sessionId}.telo.run`,
+        port: 8080,
+        protocol: "tcp",
+        url: `https://8080-${sessionId}.telo.run`,
+      },
+      {
+        host: `9090-${sessionId}.telo.run`,
+        port: 9090,
+        protocol: "tcp",
+        url: `https://9090-${sessionId}.telo.run`,
+      },
+      { host: "", port: 5000, protocol: "udp" },
+    ]);
+  });
+
+  it("leaves hosts blank when no routing base domain is configured", () => {
+    expect(endpointsFor(withRouting({ baseDomain: undefined }), sessionId, ports, true)).toEqual([
+      { host: "", port: 8080, protocol: "tcp" },
+      { host: "", port: 9090, protocol: "tcp" },
+      { host: "", port: 5000, protocol: "udp" },
+    ]);
+  });
+
+  it("advertises no url when nothing publishes routes, even with a base domain set", () => {
+    // `SESSION_ROUTING_MODE=none` with a domain configured is documented and
+    // valid. Keying on the domain alone handed the editor a URL nothing serves,
+    // and the route watch never runs in that mode — so no event said so either.
+    expect(endpointsFor(withRouting({ mode: "none" }), sessionId, ports, false)).toEqual([
+      { host: "", port: 8080, protocol: "tcp" },
+      { host: "", port: 9090, protocol: "tcp" },
+      { host: "", port: 5000, protocol: "udp" },
+    ]);
+  });
+
+  it("keeps the host scheme identical whatever layer routes it", () => {
+    const viaGateway = withRouting({ mode: "gateway", gateway: { name: "gw", namespace: "gw-ns" } });
+    expect(endpointsFor(viaGateway, sessionId, ports, true)).toEqual(
+      endpointsFor(config, sessionId, ports, true),
+    );
+  });
+});
+
+describe("buildSessionIngress", () => {
+  it("emits one rule per tcp port to the matching service port", () => {
+    const { ingress, hosts } = buildSessionIngress(
+      config,
+      sessionId,
+      `telo-run-${sessionId}`,
+      "pod",
+      "uid",
+      ports,
+    );
+    expect(hosts).toEqual([`8080-${sessionId}.telo.run`, `9090-${sessionId}.telo.run`]);
+    expect(ingress.spec?.ingressClassName).toBe("nginx");
+    expect(ingress.spec?.rules).toEqual([
+      {
+        host: `8080-${sessionId}.telo.run`,
+        http: {
+          paths: [
+            {
+              path: "/",
+              pathType: "Prefix",
+              backend: { service: { name: `telo-run-${sessionId}`, port: { number: 8080 } } },
+            },
+          ],
+        },
+      },
+      {
+        host: `9090-${sessionId}.telo.run`,
+        http: {
+          paths: [
+            {
+              path: "/",
+              pathType: "Prefix",
+              backend: { service: { name: `telo-run-${sessionId}`, port: { number: 9090 } } },
+            },
+          ],
+        },
+      },
+    ]);
+  });
+
+  it("produces no rules when there are no tcp ports", () => {
+    const { ingress, hosts } = buildSessionIngress(
+      config,
+      sessionId,
+      `telo-run-${sessionId}`,
+      "pod",
+      "uid",
+      [{ port: 5000, protocol: "udp" }],
+    );
+    expect(hosts).toEqual([]);
+    expect(ingress.spec?.rules).toEqual([]);
+  });
+
+  it("omits the tls block when no tls secret is configured", () => {
+    const { ingress } = buildSessionIngress(
+      config,
+      sessionId,
+      `telo-run-${sessionId}`,
+      "pod",
+      "uid",
+      ports,
+    );
+    expect(ingress.spec?.tls).toBeUndefined();
+  });
+
+  it("presents the configured tls secret for every tcp host", () => {
+    const { ingress } = buildSessionIngress(
+      withRouting({ tlsSecretName: "telo-origin-tls" }),
+      sessionId,
+      `telo-run-${sessionId}`,
+      "pod",
+      "uid",
+      ports,
+    );
+    expect(ingress.spec?.tls).toEqual([
+      {
+        hosts: [`8080-${sessionId}.telo.run`, `9090-${sessionId}.telo.run`],
+        secretName: "telo-origin-tls",
+      },
+    ]);
+  });
+
+  it("omits the tls block when there are no tcp hosts to secure", () => {
+    const { ingress } = buildSessionIngress(
+      withRouting({ tlsSecretName: "telo-origin-tls" }),
+      sessionId,
+      `telo-run-${sessionId}`,
+      "pod",
+      "uid",
+      [{ port: 5000, protocol: "udp" }],
+    );
+    expect(ingress.spec?.tls).toBeUndefined();
+  });
+
+  it("carries the session label and the pod ownerReference every routing object does", () => {
+    const { ingress } = buildSessionIngress(
+      config,
+      sessionId,
+      `telo-run-${sessionId}`,
+      "pod",
+      "uid",
+      ports,
+    );
+    expect(ingress.metadata?.labels?.["telo.run/session-id"]).toBe(sessionId);
+    expect(ingress.metadata?.ownerReferences?.[0]).toMatchObject({ kind: "Pod", name: "pod" });
+  });
+});
+
+describe("createIngressRouter.publish", () => {
+  function fakeKube() {
+    const rec = { created: 0, deleted: [] as string[] };
+    const kube = {
+      networking: {
+        createNamespacedIngress: async () => {
+          rec.created += 1;
+          return {};
+        },
+        deleteNamespacedIngress: async ({ name }: { name: string }) => {
+          rec.deleted.push(name);
+          return {};
+        },
+      },
+    } as unknown as KubeClient;
+    return { kube, rec };
+  }
+
+  const args = {
+    sessionId,
+    serviceName: `telo-run-${sessionId}`,
+    podName: "pod",
+    podUid: "uid",
+  };
+
+  it("deletes the session Ingress when a reload leaves no routable port", async () => {
+    // Returning early left the previous Ingress serving a port nothing listens
+    // on — the drop-all case the per-port gateway cleanup already handled.
+    const { kube, rec } = fakeKube();
+    const routes = await createIngressRouter(kube, config).publish({
+      ...args,
+      ports: [{ port: 5000, protocol: "udp" }],
+    });
+    expect(routes).toEqual([]);
+    expect(rec.created).toBe(0);
+    expect(rec.deleted).toEqual([`telo-run-${sessionId}`]);
+  });
+
+  it("treats an already-absent Ingress as nothing to delete", async () => {
+    const kube = {
+      networking: {
+        deleteNamespacedIngress: async () => {
+          throw Object.assign(new Error("not found"), { code: 404 });
+        },
+      },
+    } as unknown as KubeClient;
+    await expect(
+      createIngressRouter(kube, config).publish({ ...args, ports: [] }),
+    ).resolves.toEqual([]);
+  });
+});

package/src/k8s/routing/ingress-router.ts

@@ -0,0 +1,157 @@
+import type { V1Ingress } from "@kubernetes/client-node";
+
+import type { PortMapping } from "@telorun/runner-core";
+
+import type { K8sRunnerConfig } from "../../config.js";
+import type { KubeClient } from "../client.js";
+import { is404 } from "../pod-status.js";
+import { createOrReplace } from "./create-or-replace.js";
+import { hostForPort } from "./session-endpoints.js";
+import { podOwnerRef, sessionObjectName } from "./session-service.js";
+import type {
+  PublishedRoute,
+  PublishRouteArgs,
+  RouteVerdict,
+  SessionRouter,
+} from "./session-router.js";
+
+/** One Ingress carries every host for a session: unlike Gateway API, an Ingress
+ *  rule is scoped to its own host, so per-host backends fit in one object. */
+export function buildSessionIngress(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  serviceName: string,
+  podName: string,
+  podUid: string,
+  ports: PortMapping[],
+): { ingress: V1Ingress; hosts: string[] } {
+  const rules = ports
+    .filter((p) => p.protocol === "tcp")
+    .map((p) => ({
+      host: hostForPort(config, sessionId, p.port),
+      http: {
+        paths: [
+          {
+            path: "/",
+            pathType: "Prefix" as const,
+            backend: { service: { name: serviceName, port: { number: p.port } } },
+          },
+        ],
+      },
+    }));
+  const ingress: V1Ingress = {
+    apiVersion: "networking.k8s.io/v1",
+    kind: "Ingress",
+    metadata: {
+      name: sessionObjectName(sessionId),
+      namespace: config.sessionNamespace,
+      labels: {
+        "app.kubernetes.io/managed-by": config.managedByLabel,
+        "telo.run/session-id": sessionId,
+      },
+      ownerReferences: [podOwnerRef(podName, podUid)],
+    },
+    spec: {
+      ...(config.sessionRouting.ingressClassName
+        ? { ingressClassName: config.sessionRouting.ingressClassName }
+        : {}),
+      // Present the predefined cert (e.g. a Cloudflare Origin cert) so an upstream
+      // in Full (Strict) mode can validate the origin. Only meaningful with routable
+      // hosts; a single wildcard `*.<domain>` Secret covers every session host.
+      ...(config.sessionRouting.tlsSecretName && rules.length > 0
+        ? {
+            tls: [
+              {
+                hosts: rules.map((r) => r.host),
+                secretName: config.sessionRouting.tlsSecretName,
+              },
+            ],
+          }
+        : {}),
+      rules,
+    },
+  };
+  return { ingress, hosts: rules.map((r) => r.host) };
+}
+
+export function createIngressRouter(kube: KubeClient, config: K8sRunnerConfig): SessionRouter {
+  const ns = config.sessionNamespace;
+
+  return {
+    layer: "ingress",
+
+    async publish(args: PublishRouteArgs): Promise<PublishedRoute[]> {
+      const { ingress } = buildSessionIngress(
+        config,
+        args.sessionId,
+        args.serviceName,
+        args.podName,
+        args.podUid,
+        args.ports,
+      );
+      const name = ingress.metadata!.name!;
+      const rules = ingress.spec?.rules ?? [];
+      // No tcp ports → nothing HTTP-routable. DELETE rather than return: a reload
+      // that drops the last routed port would otherwise leave the previous
+      // Ingress serving a port nothing listens on. (The Service stays for any udp.)
+      if (rules.length === 0) {
+        try {
+          await kube.networking.deleteNamespacedIngress({ name, namespace: ns });
+        } catch (err) {
+          if (!is404(err)) throw err;
+        }
+        return [];
+      }
+      await createOrReplace(
+        () => kube.networking.createNamespacedIngress({ namespace: ns, body: ingress }),
+        async () => {
+          const existing = await kube.networking.readNamespacedIngress({ name, namespace: ns });
+          await kube.networking.replaceNamespacedIngress({
+            name,
+            namespace: ns,
+            body: {
+              ...ingress,
+              metadata: {
+                ...ingress.metadata,
+                resourceVersion: existing.metadata?.resourceVersion,
+              },
+            },
+          });
+        },
+      );
+      return args.ports
+        .filter((p) => p.protocol === "tcp")
+        .map((p) => ({ host: hostForPort(config, args.sessionId, p.port), port: p.port }));
+    },
+
+    /**
+     * Ingress offers no rejection signal — a controller that refuses a rule simply
+     * never writes status — so this only ever answers `programmed` or `pending`,
+     * and an unclaimed Ingress is caught by the deadline rather than by a reason
+     * the cluster gave. That is the weaker half of the two layers, and it is a
+     * property of the API, not of this implementation.
+     */
+    async verdictFor(sessionId: string): Promise<RouteVerdict> {
+      try {
+        const ingress = await kube.networking.readNamespacedIngress({
+          name: sessionObjectName(sessionId),
+          namespace: ns,
+        });
+        const assigned = ingress.status?.loadBalancer?.ingress ?? [];
+        return assigned.length > 0 ? { kind: "programmed" } : { kind: "pending" };
+      } catch (err) {
+        if (is404(err)) return { kind: "pending" };
+        throw err;
+      }
+    },
+
+    unclaimedReason(): string {
+      const cls = config.sessionRouting.ingressClassName;
+      return (
+        `no ingress controller claimed the session Ingress` +
+        (cls ? ` for class '${cls}'` : " (no ingressClassName configured)") +
+        `. Check that an Ingress controller is installed and watching namespace '${ns}'.`
+      );
+    },
+  };
+}

package/src/k8s/routing/route-health.test.ts

@@ -0,0 +1,215 @@
+import { describe, expect, it } from "vitest";
+
+import type { RouteState } from "@telorun/runner-core";
+
+import { watchRouteHealth } from "./route-health.js";
+import type { PublishedRoute, RouteVerdict, SessionRouter } from "./session-router.js";
+
+const routes: PublishedRoute[] = [
+  { host: "8080-abc.telo.run", port: 8080 },
+  { host: "9090-abc.telo.run", port: 9090 },
+];
+
+function router(verdicts: (route: PublishedRoute) => RouteVerdict): SessionRouter {
+  return {
+    layer: "gateway",
+    publish: async () => routes,
+    verdictFor: async (_id, route) => verdicts(route),
+    unclaimedReason: () => "nobody claimed it",
+  };
+}
+
+function collect() {
+  const seen: Array<{ host: string; state: RouteState; reason?: string }> = [];
+  return {
+    seen,
+    onState: (route: PublishedRoute, state: RouteState, reason?: string) =>
+      seen.push({ host: route.host, state, ...(reason ? { reason } : {}) }),
+  };
+}
+
+describe("watchRouteHealth", () => {
+  it("reports pending up front, then programmed per host", async () => {
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: router(() => ({ kind: "programmed" })),
+      sessionId: "abc",
+      routes,
+      onState,
+      signal: new AbortController().signal,
+      timeoutMs: 1_000,
+      intervalMs: 1,
+    });
+    expect(seen).toEqual([
+      { host: "8080-abc.telo.run", state: "pending" },
+      { host: "9090-abc.telo.run", state: "pending" },
+      { host: "8080-abc.telo.run", state: "programmed" },
+      { host: "9090-abc.telo.run", state: "programmed" },
+    ]);
+  });
+
+  it("carries a refusal's reason straight through", async () => {
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: router(() => ({ kind: "rejected", reason: "NotAllowedByListeners" })),
+      sessionId: "abc",
+      routes: [routes[0]],
+      onState,
+      signal: new AbortController().signal,
+      timeoutMs: 1_000,
+      intervalMs: 1,
+    });
+    expect(seen.at(-1)).toEqual({
+      host: "8080-abc.telo.run",
+      state: "unprogrammed",
+      reason: "NotAllowedByListeners",
+    });
+  });
+
+  it("calls a route that stays pending unprogrammed at the deadline — the silent-404 case", async () => {
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: router(() => ({ kind: "pending" })),
+      sessionId: "abc",
+      routes: [routes[0]],
+      onState,
+      signal: new AbortController().signal,
+      timeoutMs: 5,
+      intervalMs: 1,
+    });
+    expect(seen.at(-1)).toEqual({
+      host: "8080-abc.telo.run",
+      state: "unprogrammed",
+      reason: "nobody claimed it",
+    });
+  });
+
+  it("settles each host independently", async () => {
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: router((route) =>
+        route.port === 8080 ? { kind: "programmed" } : { kind: "rejected", reason: "no listener" },
+      ),
+      sessionId: "abc",
+      routes,
+      onState,
+      signal: new AbortController().signal,
+      timeoutMs: 1_000,
+      intervalMs: 1,
+    });
+    expect(seen.filter((s) => s.state !== "pending")).toEqual([
+      { host: "8080-abc.telo.run", state: "programmed" },
+      { host: "9090-abc.telo.run", state: "unprogrammed", reason: "no listener" },
+    ]);
+  });
+
+  it("keeps polling through a transient API error instead of declaring the route dead", async () => {
+    let calls = 0;
+    const flaky: SessionRouter = {
+      layer: "ingress",
+      publish: async () => routes,
+      verdictFor: async () => {
+        calls += 1;
+        if (calls < 3) throw new Error("apiserver hiccup");
+        return { kind: "programmed" };
+      },
+      unclaimedReason: () => "nobody claimed it",
+    };
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: flaky,
+      sessionId: "abc",
+      routes: [routes[0]],
+      onState,
+      signal: new AbortController().signal,
+      timeoutMs: 1_000,
+      intervalMs: 1,
+    });
+    expect(seen.at(-1)).toEqual({ host: "8080-abc.telo.run", state: "programmed" });
+  });
+
+  it("reports the READ failure at the deadline, not the Gateway advice", async () => {
+    // A permanent read failure (no RBAC, an unserved API version) polls out the
+    // whole deadline. Reporting `unclaimedReason()` there sends an operator to
+    // inspect the Gateway when the runner could not read its own object.
+    const denied: SessionRouter = {
+      layer: "gateway",
+      publish: async () => routes,
+      verdictFor: async () => {
+        throw Object.assign(new Error("httproutes is forbidden"), { code: 403 });
+      },
+      unclaimedReason: () => "no controller claimed the session HTTPRoute",
+    };
+    const seenErrors: unknown[] = [];
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: denied,
+      sessionId: "abc",
+      routes: [routes[0]],
+      onState,
+      onReadError: (err) => seenErrors.push(err),
+      signal: new AbortController().signal,
+      timeoutMs: 5,
+      intervalMs: 1,
+    });
+    expect(seen.at(-1)?.state).toBe("unprogrammed");
+    expect(seen.at(-1)?.reason).toMatch(/route status could not be read/);
+    expect(seen.at(-1)?.reason).not.toMatch(/claimed the session HTTPRoute/);
+    // Reported once, not once per poll.
+    expect(seenErrors).toHaveLength(1);
+  });
+
+  it("does not blame a transient read failure once a verdict was obtained", async () => {
+    let calls = 0;
+    const flaky: SessionRouter = {
+      layer: "gateway",
+      publish: async () => routes,
+      verdictFor: async () => {
+        calls += 1;
+        if (calls === 1) throw new Error("apiserver hiccup");
+        return { kind: "pending" };
+      },
+      unclaimedReason: () => "nobody claimed it",
+    };
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: flaky,
+      sessionId: "abc",
+      routes: [routes[0]],
+      onState,
+      signal: new AbortController().signal,
+      timeoutMs: 8,
+      intervalMs: 1,
+    });
+    expect(seen.at(-1)?.reason).toBe("nobody claimed it");
+  });
+
+  it("stops on abort without reporting a verdict it never reached", async () => {
+    const abort = new AbortController();
+    const { seen, onState } = collect();
+    abort.abort();
+    await watchRouteHealth({
+      router: router(() => ({ kind: "pending" })),
+      sessionId: "abc",
+      routes,
+      onState,
+      signal: abort.signal,
+      timeoutMs: 1_000,
+      intervalMs: 1,
+    });
+    expect(seen.every((s) => s.state === "pending")).toBe(true);
+  });
+
+  it("does nothing when nothing was published", async () => {
+    const { seen, onState } = collect();
+    await watchRouteHealth({
+      router: router(() => ({ kind: "programmed" })),
+      sessionId: "abc",
+      routes: [],
+      onState,
+      signal: new AbortController().signal,
+      timeoutMs: 1_000,
+    });
+    expect(seen).toEqual([]);
+  });
+});

package/src/k8s/routing/route-health.ts

@@ -0,0 +1,95 @@
+import { abortableDelay, type RouteState } from "@telorun/runner-core";
+
+import { apiReason } from "../api-error.js";
+import type { PublishedRoute, SessionRouter } from "./session-router.js";
+
+export interface WatchRouteHealthOptions {
+  router: SessionRouter;
+  sessionId: string;
+  /** The hosts `publish` reported. Empty → nothing to watch. */
+  routes: PublishedRoute[];
+  /** Receives every transition for one host. */
+  onState: (route: PublishedRoute, state: RouteState, reason?: string) => void;
+  /** Aborts the watch — wire to the session's teardown. */
+  signal: AbortSignal;
+  /** How long a route may stay unclaimed before it is reported `unprogrammed`. */
+  timeoutMs: number;
+  /** Poll interval while waiting for a verdict. */
+  intervalMs?: number;
+  /** Receives a read failure once, so a permanent one (a missing RBAC grant, an
+   *  unserved API version) reaches the runner's log and not only the client. */
+  onReadError?: (err: unknown) => void;
+}
+
+const DEFAULT_INTERVAL_MS = 2_000;
+
+/**
+ * Watch whether the routing layer actually programmed each published host.
+ *
+ * This is the check whose absence made an unroutable cluster indistinguishable
+ * from a healthy one: the runner already dials the workload's own address, which
+ * proves the app is listening and says nothing about whether traffic can reach
+ * it. A session whose routing objects are reconciled by no controller reported
+ * every port reachable while every public URL 404'd.
+ *
+ * REPORTS, never fails the session: a slow controller and an absent one look the
+ * same for the first few seconds, and killing a healthy session over routing that
+ * arrives late would trade a visible problem for a worse one.
+ */
+export async function watchRouteHealth(options: WatchRouteHealthOptions): Promise<void> {
+  const { router, sessionId, routes, onState, signal } = options;
+  if (routes.length === 0) return;
+  const interval = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const deadline = Date.now() + options.timeoutMs;
+
+  const pending = new Map(routes.map((r) => [r.host, r]));
+  for (const route of routes) onState(route, "pending");
+
+  // A read failure is NOT a verdict, but it is also not nothing: a permanent one
+  // (no RBAC on the routing objects, an API version this runner did not resolve)
+  // polls out the whole deadline and would otherwise be reported as
+  // `unclaimedReason()` — sending an operator to inspect the Gateway when the
+  // runner could not read its own object. So the last one is retained and wins
+  // at the deadline.
+  let lastReadError: unknown;
+  let reportedReadError = false;
+
+  while (pending.size > 0 && !signal.aborted) {
+    for (const [host, route] of [...pending]) {
+      if (signal.aborted) return;
+      let verdict;
+      try {
+        verdict = await router.verdictFor(sessionId, route);
+      } catch (err) {
+        lastReadError = err;
+        if (!reportedReadError) {
+          reportedReadError = true;
+          options.onReadError?.(err);
+        }
+        continue;
+      }
+      // A verdict of ANY kind proves the read path works, so an earlier failure
+      // was transient and must not decide the message at the deadline.
+      lastReadError = undefined;
+      if (verdict.kind === "programmed") {
+        pending.delete(host);
+        onState(route, "programmed");
+      } else if (verdict.kind === "rejected") {
+        pending.delete(host);
+        onState(route, "unprogrammed", verdict.reason);
+      }
+    }
+    if (pending.size === 0) return;
+    if (Date.now() >= deadline) break;
+    await abortableDelay(interval, signal);
+  }
+
+  if (signal.aborted) return;
+  const reason =
+    lastReadError !== undefined
+      ? `route status could not be read: ${apiReason(lastReadError)}`
+      : router.unclaimedReason();
+  for (const route of pending.values()) {
+    onState(route, "unprogrammed", reason);
+  }
+}