@telorun/k8s-runner 0.13.0 → 0.15.0

package/src/k8s/routing/routing-mode.test.ts

@@ -0,0 +1,218 @@
+import { describe, expect, it } from "vitest";
+
+import type { K8sRunnerConfig, SessionRoutingConfig } from "../../config.js";
+import { RunnerConfigError } from "../../config.js";
+import type { KubeClient } from "../client.js";
+import { resolveRouting } from "./routing-mode.js";
+
+/** A cluster: which Gateway API versions it serves, and how many IngressClasses
+ *  exist. Those are the two signals `auto` may fall back on. */
+function fakeKube(cluster: {
+  gatewayVersions?: string[];
+  ingressClasses?: number;
+  defaultIngressClass?: boolean;
+}): KubeClient {
+  return {
+    apis: {
+      getAPIVersions: async () => ({
+        groups: cluster.gatewayVersions
+          ? [
+              {
+                name: "gateway.networking.k8s.io",
+                versions: cluster.gatewayVersions.map((version) => ({ version })),
+                preferredVersion: { version: cluster.gatewayVersions[0] },
+              },
+            ]
+          : [],
+      }),
+    },
+    networking: {
+      listIngressClass: async () => ({
+        items: Array.from({ length: cluster.ingressClasses ?? 0 }, (_unused, i) => ({
+          metadata:
+            cluster.defaultIngressClass && i === 0
+              ? { annotations: { "ingressclass.kubernetes.io/is-default-class": "true" } }
+              : {},
+        })),
+      }),
+    },
+  } as unknown as KubeClient;
+}
+
+function configWith(routing: Partial<SessionRoutingConfig>): K8sRunnerConfig {
+  return {
+    sessionNamespace: "telo-sessions",
+    sessionRouting: {
+      mode: "auto",
+      baseDomain: "telo.run",
+      routeReadyTimeoutMs: 60_000,
+      ...routing,
+    },
+  } as K8sRunnerConfig;
+}
+
+describe("resolveRouting — logs-only", () => {
+  it("is none when the mode says so", async () => {
+    const resolved = await resolveRouting(fakeKube({}), configWith({ mode: "none" }));
+    expect(resolved).toMatchObject({ layer: "none" });
+  });
+
+  it("is none without a base domain, whatever the mode — no domain, no constructible host", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ ingressClasses: 1 }),
+      configWith({ mode: "ingress", baseDomain: undefined }),
+    );
+    expect(resolved).toMatchObject({ layer: "none" });
+  });
+});
+
+describe("resolveRouting — explicit modes", () => {
+  it("takes ingress at its word", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ gatewayVersions: ["v1"], ingressClasses: 0 }),
+      configWith({ mode: "ingress" }),
+    );
+    expect(resolved).toEqual({ layer: "ingress" });
+  });
+
+  it("prefers the GA Gateway API version when several are served", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ gatewayVersions: ["v1beta1", "v1"] }),
+      configWith({ mode: "gateway", gateway: { name: "gw", namespace: "gw-ns" } }),
+    );
+    expect(resolved).toEqual({ layer: "gateway", apiVersion: "v1" });
+  });
+
+  it("falls back to v1beta1 where that is all the cluster serves", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ gatewayVersions: ["v1beta1"] }),
+      configWith({ mode: "gateway", gateway: { name: "gw", namespace: "gw-ns" } }),
+    );
+    expect(resolved).toEqual({ layer: "gateway", apiVersion: "v1beta1" });
+  });
+
+  it("refuses gateway mode on a cluster that does not serve the API", async () => {
+    await expect(
+      resolveRouting(
+        fakeKube({ ingressClasses: 1 }),
+        configWith({ mode: "gateway", gateway: { name: "gw", namespace: "gw-ns" } }),
+      ),
+    ).rejects.toBeInstanceOf(RunnerConfigError);
+  });
+});
+
+describe("resolveRouting — auto", () => {
+  it("resolves on the CONFIGURED target before the installed one: a named Gateway wins even where Ingress is usable", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ gatewayVersions: ["v1"], ingressClasses: 3 }),
+      configWith({ gateway: { name: "gw", namespace: "gw-ns" } }),
+    );
+    expect(resolved).toEqual({ layer: "gateway", apiVersion: "v1" });
+  });
+
+  it("takes a configured IngressClass even where the Gateway API is installed — CRDs present is not intent", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ gatewayVersions: ["v1"], ingressClasses: 1 }),
+      configWith({ ingressClassName: "nginx" }),
+    );
+    expect(resolved).toEqual({ layer: "ingress" });
+  });
+
+  it("picks the only usable layer when nothing is configured", async () => {
+    const resolved = await resolveRouting(fakeKube({ ingressClasses: 1 }), configWith({}));
+    expect(resolved).toEqual({ layer: "ingress" });
+  });
+
+  it("refuses when both layers are usable and nothing says which", async () => {
+    await expect(
+      resolveRouting(fakeKube({ gatewayVersions: ["v1"], ingressClasses: 2 }), configWith({})),
+    ).rejects.toThrow(/cannot choose/);
+  });
+
+  it("refuses a Gateway-only cluster with no Gateway named — picking one would fail as silently as publishing none", async () => {
+    await expect(
+      resolveRouting(fakeKube({ gatewayVersions: ["v1"] }), configWith({})),
+    ).rejects.toThrow(/SESSION_GATEWAY_NAME/);
+  });
+
+  it("refuses a cluster with no usable layer at all rather than publishing into the void", async () => {
+    await expect(resolveRouting(fakeKube({}), configWith({}))).rejects.toThrow(
+      /no usable routing layer/,
+    );
+  });
+
+  it("does not read an IngressClass count as usable when the API refused the list", async () => {
+    const kube = {
+      apis: { getAPIVersions: async () => ({ groups: [] }) },
+      networking: {
+        listIngressClass: async () => {
+          throw new Error("forbidden");
+        },
+      },
+    } as unknown as KubeClient;
+    // A permission failure must not be reported as a fact about the cluster:
+    // "no IngressClass exists" sends an operator to install a controller they
+    // already have.
+    await expect(resolveRouting(kube, configWith({}))).rejects.toThrow(
+      /listing IngressClasses failed/,
+    );
+    await expect(resolveRouting(kube, configWith({}))).rejects.not.toThrow(
+      /no IngressClass exists/,
+    );
+  });
+
+  it("takes a DEFAULT-marked IngressClass as intent, even beside the Gateway API", async () => {
+    // The cluster has nominated where an unqualified Ingress goes, and
+    // unqualified is what this runner creates. Without this, every cluster
+    // shipping the Gateway CRDs beside a default ingress controller would
+    // refuse to boot after the upgrade, having worked before it.
+    const resolved = await resolveRouting(
+      fakeKube({ gatewayVersions: ["v1"], ingressClasses: 1, defaultIngressClass: true }),
+      configWith({}),
+    );
+    expect(resolved).toEqual({ layer: "ingress" });
+  });
+
+  it("still refuses when several classes exist and none is marked default", async () => {
+    await expect(
+      resolveRouting(
+        fakeKube({ gatewayVersions: ["v1"], ingressClasses: 2, defaultIngressClass: false }),
+        configWith({}),
+      ),
+    ).rejects.toThrow(/cannot choose/);
+  });
+
+  it("lets a named Gateway win over a default IngressClass — the more specific configuration", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ gatewayVersions: ["v1"], ingressClasses: 1, defaultIngressClass: true }),
+      configWith({ gateway: { name: "gw", namespace: "gw-ns" } }),
+    );
+    expect(resolved).toEqual({ layer: "gateway", apiVersion: "v1" });
+  });
+});
+
+describe("resolveRouting — origin TLS against the RESOLVED layer", () => {
+  it("refuses an ingress TLS secret when auto resolves to Gateway API", async () => {
+    // The config-time check only sees `mode`, and `auto` is the default: a named
+    // Gateway decides the layer later, so this combination booted, routed on
+    // Gateway API and ignored the certificate — plaintext origin traffic under a
+    // configuration that reads as TLS-configured.
+    await expect(
+      resolveRouting(
+        fakeKube({ gatewayVersions: ["v1"] }),
+        configWith({
+          gateway: { name: "gw", namespace: "gw-ns" },
+          tlsSecretName: "origin-tls",
+        }),
+      ),
+    ).rejects.toThrow(/belongs to the Gateway listener/);
+  });
+
+  it("allows an ingress TLS secret when the resolved layer is ingress", async () => {
+    const resolved = await resolveRouting(
+      fakeKube({ ingressClasses: 1 }),
+      configWith({ ingressClassName: "nginx", tlsSecretName: "origin-tls" }),
+    );
+    expect(resolved).toEqual({ layer: "ingress" });
+  });
+});

package/src/k8s/routing/routing-mode.ts

@@ -0,0 +1,191 @@
+import type { K8sRunnerConfig } from "../../config.js";
+import { RunnerConfigError } from "../../config.js";
+import { apiReason } from "../api-error.js";
+import type { KubeClient } from "../client.js";
+
+const GATEWAY_GROUP = "gateway.networking.k8s.io";
+/** Preference order among served Gateway API versions. `v1` is GA; plenty of
+ *  clusters still serve only `v1beta1`, and an HTTPRoute posted at a version the
+ *  apiserver does not serve is a 404 at publish time rather than a bad route. */
+const GATEWAY_VERSIONS = ["v1", "v1beta1"];
+
+export type ResolvedRouting =
+  | { layer: "none"; reason: string }
+  | { layer: "ingress" }
+  | { layer: "gateway"; apiVersion: string };
+
+/** The annotation by which a cluster nominates the class unqualified Ingresses
+ *  go to — which is exactly what this runner creates when no class is set. */
+const DEFAULT_CLASS_ANNOTATION = "ingressclass.kubernetes.io/is-default-class";
+
+export interface ClusterRoutingSupport {
+  /** Served Gateway API version, preferred first; undefined when the group is
+   *  not served at all. */
+  gatewayApiVersion?: string;
+  /** Number of IngressClasses, or **undefined when the list could not be read**.
+   *  `networking.k8s.io` is always served, so the API being present is no
+   *  evidence anyone can route with it — an installed controller registers a
+   *  class, and that is the usable signal. Zero and unknown are kept apart
+   *  because a refusal phrased from them is a different claim: one is about the
+   *  cluster, the other about this runner's permissions. */
+  ingressClassCount?: number;
+  /** Set when at least one IngressClass carries the default-class annotation. */
+  hasDefaultIngressClass: boolean;
+  /** Why the IngressClass list could not be read, when it could not. */
+  ingressClassError?: unknown;
+}
+
+/** What the cluster can actually route with. Both probes fail SOFT — discovery
+ *  and IngressClass listing are the runner's least important permissions — but a
+ *  failure is REPORTED rather than folded into a zero, so nothing downstream can
+ *  turn a permission error into a claim about the cluster. */
+export async function detectRoutingSupport(kube: KubeClient): Promise<ClusterRoutingSupport> {
+  let gatewayApiVersion: string | undefined;
+  try {
+    const groups = await kube.apis.getAPIVersions();
+    const group = groups.groups?.find((g) => g.name === GATEWAY_GROUP);
+    const served = new Set((group?.versions ?? []).map((v) => v.version));
+    gatewayApiVersion =
+      GATEWAY_VERSIONS.find((v) => served.has(v)) ?? group?.preferredVersion?.version;
+  } catch {
+    gatewayApiVersion = undefined;
+  }
+
+  try {
+    const classes = await kube.networking.listIngressClass();
+    const items = classes.items ?? [];
+    return {
+      gatewayApiVersion,
+      ingressClassCount: items.length,
+      hasDefaultIngressClass: items.some(
+        (c) => c.metadata?.annotations?.[DEFAULT_CLASS_ANNOTATION] === "true",
+      ),
+    };
+  } catch (err) {
+    return { gatewayApiVersion, hasDefaultIngressClass: false, ingressClassError: err };
+  }
+}
+
+/**
+ * Decide the routing layer ONCE, at boot, so a misconfiguration fails the runner
+ * instead of 404-ing every session it later accepts.
+ *
+ * `auto` resolves on what is CONFIGURED before what is INSTALLED, and that order
+ * is the whole point: Gateway API CRDs are frequently present without being the
+ * intended path, so "both APIs available" is not evidence of intent and must not
+ * decide anything. Only a cluster that offers two usable layers and was told
+ * nothing is genuinely ambiguous — and there the answer is to refuse, because
+ * guessing wrong publishes routes nothing reconciles, which is silent.
+ */
+export async function resolveRouting(
+  kube: KubeClient,
+  config: K8sRunnerConfig,
+): Promise<ResolvedRouting> {
+  const routing = config.sessionRouting;
+
+  if (routing.mode === "none") {
+    return { layer: "none", reason: "SESSION_ROUTING_MODE=none" };
+  }
+  // The base domain is what makes a host constructible at all, so it stays the
+  // master switch it has always been — no domain, no routing, whatever the mode.
+  if (!routing.baseDomain) {
+    return {
+      layer: "none",
+      reason: "SESSION_ROUTING_BASE_DOMAIN is unset, so no session host can be constructed",
+    };
+  }
+
+  const support = await detectRoutingSupport(kube);
+  const resolved = decideLayer(config, support);
+  assertTlsMatchesLayer(config, resolved);
+  return resolved;
+}
+
+/** The origin certificate is refused HERE as well as at config load, because
+ *  under `auto` the effective layer is not known until now: a named Gateway wins,
+ *  so `mode: auto` + a Gateway + `SESSION_INGRESS_TLS_SECRET` passed the
+ *  config-time check and then routed on Gateway API with the certificate
+ *  ignored — plaintext origin traffic under a configuration that reads as
+ *  TLS-configured, which is the silent downgrade the check exists to prevent. */
+function assertTlsMatchesLayer(config: K8sRunnerConfig, resolved: ResolvedRouting): void {
+  if (resolved.layer !== "gateway" || !config.sessionRouting.tlsSecretName) return;
+  throw new RunnerConfigError(
+    "SESSION_INGRESS_TLS_SECRET is set but session routing resolved to Gateway API. Under Gateway " +
+      "API the origin certificate belongs to the Gateway listener's own `tls.certificateRefs`, not " +
+      "to the per-session route, so this Secret would be silently ignored. Move the reference to " +
+      "the Gateway and unset this, or set SESSION_ROUTING_MODE=ingress.",
+  );
+}
+
+function decideLayer(config: K8sRunnerConfig, support: ClusterRoutingSupport): ResolvedRouting {
+  const routing = config.sessionRouting;
+
+  if (routing.mode === "ingress") return { layer: "ingress" };
+
+  if (routing.mode === "gateway") {
+    if (!support.gatewayApiVersion) {
+      throw new RunnerConfigError(
+        `SESSION_ROUTING_MODE=gateway but the cluster does not serve '${GATEWAY_GROUP}'. ` +
+          "Install the Gateway API CRDs, or set SESSION_ROUTING_MODE=ingress.",
+      );
+    }
+    return { layer: "gateway", apiVersion: support.gatewayApiVersion };
+  }
+
+  // auto — configured target first.
+  if (routing.gateway) {
+    if (!support.gatewayApiVersion) {
+      throw new RunnerConfigError(
+        `SESSION_GATEWAY_NAME is set but the cluster does not serve '${GATEWAY_GROUP}'. ` +
+          "Install the Gateway API CRDs, or unset SESSION_GATEWAY_NAME to route via Ingress.",
+      );
+    }
+    return { layer: "gateway", apiVersion: support.gatewayApiVersion };
+  }
+  if (routing.ingressClassName) return { layer: "ingress" };
+  // A DEFAULT-marked IngressClass is configuration, not mere availability: the
+  // cluster has nominated where an unqualified Ingress goes, and unqualified is
+  // exactly what this runner creates. It therefore ranks with a named Gateway
+  // and a configured class rather than with "an IngressClass exists" — without
+  // which every cluster that ships the Gateway CRDs beside a default ingress
+  // controller would refuse to boot after this upgrade, having worked before.
+  if (support.hasDefaultIngressClass) return { layer: "ingress" };
+
+  const gatewayUsable = Boolean(support.gatewayApiVersion);
+  const ingressUsable = (support.ingressClassCount ?? 0) > 0;
+
+  if (gatewayUsable && ingressUsable) {
+    throw new RunnerConfigError(
+      `SESSION_ROUTING_MODE=auto cannot choose: this cluster serves '${GATEWAY_GROUP}' AND has ` +
+        `${support.ingressClassCount} IngressClass(es) with none marked default, and nothing says ` +
+        "which should carry session traffic. Set SESSION_ROUTING_MODE=ingress (with " +
+        "SESSION_INGRESS_CLASS) or SESSION_ROUTING_MODE=gateway (with SESSION_GATEWAY_NAME).",
+    );
+  }
+  if (gatewayUsable) {
+    throw new RunnerConfigError(
+      `SESSION_ROUTING_MODE=auto resolved to Gateway API, but SESSION_GATEWAY_NAME is unset — a ` +
+        "route has to name the Gateway it attaches to, and picking one of several would fail as " +
+        "silently as publishing none. Set SESSION_GATEWAY_NAME (and SESSION_GATEWAY_NAMESPACE " +
+        `when the Gateway is not in '${config.sessionNamespace}').`,
+    );
+  }
+  if (ingressUsable) return { layer: "ingress" };
+
+  // Say which of the two it is. Reporting a permission failure as "no
+  // IngressClass exists" is a claim about the cluster drawn from a fact about
+  // this runner's access, and it sends an operator to install a controller they
+  // already have.
+  if (support.ingressClassError !== undefined) {
+    throw new RunnerConfigError(
+      "SESSION_ROUTING_BASE_DOMAIN is set but the routing layer could not be resolved: listing " +
+        `IngressClasses failed (${apiReason(support.ingressClassError)}) and '${GATEWAY_GROUP}' is ` +
+        "not served. Grant `list` on `ingressclasses`, or set SESSION_ROUTING_MODE explicitly.",
+    );
+  }
+  throw new RunnerConfigError(
+    "SESSION_ROUTING_BASE_DOMAIN is set but this cluster offers no usable routing layer: no " +
+      `IngressClass exists and '${GATEWAY_GROUP}' is not served. Install an Ingress controller or ` +
+      "the Gateway API, or set SESSION_ROUTING_MODE=none to run logs-only.",
+  );
+}

package/src/k8s/routing/session-endpoints.ts

@@ -0,0 +1,45 @@
+import type { PortMapping, RunnerEndpoint } from "@telorun/runner-core";
+
+import type { K8sRunnerConfig } from "../../config.js";
+
+/** Host fronting a single tcp port: `<port>-<sessionId>.<domain>`. The port rides
+ *  as a leading label (no dots), so it stays a single label under the base domain
+ *  — matching the docker runner's proxy scheme and compatible with a single-label
+ *  wildcard cert (`*.<domain>`).
+ *
+ *  Shared by both routing layers on purpose: the host scheme is what a client is
+ *  told and what DNS is configured for, so it must not vary with the cluster's
+ *  choice of Ingress or Gateway API. */
+export function hostForPort(config: K8sRunnerConfig, sessionId: string, port: number): string {
+  return `${port}-${sessionId}.${config.sessionRouting.baseDomain}`;
+}
+
+/**
+ * Endpoints announced on the `running` status. Every tcp port is fronted by its
+ * own per-session host (served on 443) and carries an external `url`. udp ports
+ * aren't HTTP-routable, so they keep the host-less form. Without a base domain,
+ * host is left blank for the client adapter to fill (parity with docker).
+ *
+ * `routed` is what says a URL will be served, and it is separate from the base
+ * domain because the two can disagree: `SESSION_ROUTING_MODE=none` with a domain
+ * configured is a valid, documented setup that publishes nothing. Keying on the
+ * domain alone handed the editor a URL nothing serves — and the route watch
+ * never runs in that mode, so no `route` event would have said so either.
+ */
+export function endpointsFor(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  ports: PortMapping[],
+  routed: boolean,
+): RunnerEndpoint[] {
+  if (!routed || !config.sessionRouting.baseDomain || ports.length === 0) {
+    return ports.map((p) => ({ host: "", port: p.port, protocol: p.protocol }));
+  }
+  return ports.map((p) => {
+    if (p.protocol !== "tcp") {
+      return { host: "", port: p.port, protocol: p.protocol };
+    }
+    const host = hostForPort(config, sessionId, p.port);
+    return { host, port: p.port, protocol: p.protocol, url: `https://${host}` };
+  });
+}

package/src/k8s/routing/session-router.ts

@@ -0,0 +1,59 @@
+import type { PortMapping } from "@telorun/runner-core";
+
+/** One published host and the session port behind it. */
+export interface PublishedRoute {
+  host: string;
+  port: number;
+}
+
+export interface PublishRouteArgs {
+  sessionId: string;
+  /** The Service the routing object points at. */
+  serviceName: string;
+  /** Owner of every object created — see `podOwnerRef`. */
+  podName: string;
+  podUid: string;
+  /** Every port the session must carry. Non-tcp ports are ignored: they are not
+   *  HTTP-routable, and the Service still exposes them. */
+  ports: PortMapping[];
+}
+
+/**
+ * What a routing layer has to say about one published host.
+ *
+ * `pending` is a real answer, not an absence: a controller that has not yet
+ * written status is indistinguishable from one that will never claim the route,
+ * and only time separates them.
+ */
+export type RouteVerdict =
+  | { kind: "programmed" }
+  | { kind: "pending" }
+  | { kind: "rejected"; reason: string };
+
+/**
+ * How this cluster publishes a session's public routes.
+ *
+ * The seam exists because Ingress and Gateway API are both current: neither is a
+ * migration target for the other, clusters ship one, the other, or both, and a
+ * runner that hardcodes either is unroutable on half of them. It deliberately
+ * stays inside the k8s backend — docker publishes host ports through its own
+ * proxy and has no use for it, and `runner-core` owns the backend-neutral `/v1`
+ * contract, where "Ingress or HTTPRoute" is not a distinction that exists.
+ */
+export interface SessionRouter {
+  /** Names the layer for diagnostics. */
+  readonly layer: "ingress" | "gateway";
+
+  /** Create-or-replace this session's routing objects. Returns the hosts it
+   *  published, which is what the route watch then asks about. */
+  publish(args: PublishRouteArgs): Promise<PublishedRoute[]>;
+
+  /** This layer's current verdict on one published host. Asked repeatedly by the
+   *  route watch until it settles or the deadline passes. */
+  verdictFor(sessionId: string, route: PublishedRoute): Promise<RouteVerdict>;
+
+  /** What to tell an operator when a route is still `pending` at the deadline.
+   *  Layer-specific because the causes are: no controller for the IngressClass,
+   *  versus a Gateway that never claimed the route. */
+  unclaimedReason(): string;
+}

package/src/k8s/routing/session-service.ts

@@ -0,0 +1,55 @@
+import type { V1OwnerReference, V1Service } from "@kubernetes/client-node";
+
+import type { PortMapping } from "@telorun/runner-core";
+
+import type { K8sRunnerConfig } from "../../config.js";
+
+/** OwnerReference to the session Pod so every routing object is garbage collected
+ *  when the Pod dies — essential for sub-minute sessions that would otherwise leak
+ *  routing objects. Both routing layers use it: an HTTPRoute is namespaced like an
+ *  Ingress, so the same ownership works unchanged. */
+export function podOwnerRef(podName: string, podUid: string): V1OwnerReference {
+  return {
+    apiVersion: "v1",
+    kind: "Pod",
+    name: podName,
+    uid: podUid,
+    controller: true,
+    blockOwnerDeletion: true,
+  };
+}
+
+/** The name every routing object for one session shares. */
+export function sessionObjectName(sessionId: string): string {
+  return `telo-run-${sessionId}`;
+}
+
+/** The Service both routing layers point at — the routing layer decides how
+ *  traffic ARRIVES, never what it arrives at, so this is layer-neutral. */
+export function buildSessionService(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  podName: string,
+  podUid: string,
+  ports: PortMapping[],
+): V1Service {
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name: sessionObjectName(sessionId),
+      namespace: config.sessionNamespace,
+      labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+      ownerReferences: [podOwnerRef(podName, podUid)],
+    },
+    spec: {
+      selector: { "telo.run/session-id": sessionId },
+      ports: ports.map((p) => ({
+        name: `p${p.port}`,
+        port: p.port,
+        targetPort: p.port,
+        protocol: p.protocol.toUpperCase(),
+      })),
+    },
+  };
+}

package/src/k8s/watch-pod-spec.test.ts

@@ -6,7 +6,6 @@ import { buildSessionPod, buildWatchPod } from "./pod-spec.js";
 
 const BASE_ENV = {
   RUNNER_SELF_URL: "http://k8s-runner.telo-runner.svc:8062",
-  RUNNER_IMAGE_REPOSITORY: "registry.telo-runner.svc:5000/telo-sessions",
   RUNNER_WATCH_SESSIONS: "true",
 };