@telorun/k8s-runner 0.14.0 → 0.15.0

package/src/k8s/routing/routing-mode.ts

@@ -0,0 +1,191 @@
+import type { K8sRunnerConfig } from "../../config.js";
+import { RunnerConfigError } from "../../config.js";
+import { apiReason } from "../api-error.js";
+import type { KubeClient } from "../client.js";
+
+const GATEWAY_GROUP = "gateway.networking.k8s.io";
+/** Preference order among served Gateway API versions. `v1` is GA; plenty of
+ *  clusters still serve only `v1beta1`, and an HTTPRoute posted at a version the
+ *  apiserver does not serve is a 404 at publish time rather than a bad route. */
+const GATEWAY_VERSIONS = ["v1", "v1beta1"];
+
+export type ResolvedRouting =
+  | { layer: "none"; reason: string }
+  | { layer: "ingress" }
+  | { layer: "gateway"; apiVersion: string };
+
+/** The annotation by which a cluster nominates the class unqualified Ingresses
+ *  go to — which is exactly what this runner creates when no class is set. */
+const DEFAULT_CLASS_ANNOTATION = "ingressclass.kubernetes.io/is-default-class";
+
+export interface ClusterRoutingSupport {
+  /** Served Gateway API version, preferred first; undefined when the group is
+   *  not served at all. */
+  gatewayApiVersion?: string;
+  /** Number of IngressClasses, or **undefined when the list could not be read**.
+   *  `networking.k8s.io` is always served, so the API being present is no
+   *  evidence anyone can route with it — an installed controller registers a
+   *  class, and that is the usable signal. Zero and unknown are kept apart
+   *  because a refusal phrased from them is a different claim: one is about the
+   *  cluster, the other about this runner's permissions. */
+  ingressClassCount?: number;
+  /** Set when at least one IngressClass carries the default-class annotation. */
+  hasDefaultIngressClass: boolean;
+  /** Why the IngressClass list could not be read, when it could not. */
+  ingressClassError?: unknown;
+}
+
+/** What the cluster can actually route with. Both probes fail SOFT — discovery
+ *  and IngressClass listing are the runner's least important permissions — but a
+ *  failure is REPORTED rather than folded into a zero, so nothing downstream can
+ *  turn a permission error into a claim about the cluster. */
+export async function detectRoutingSupport(kube: KubeClient): Promise<ClusterRoutingSupport> {
+  let gatewayApiVersion: string | undefined;
+  try {
+    const groups = await kube.apis.getAPIVersions();
+    const group = groups.groups?.find((g) => g.name === GATEWAY_GROUP);
+    const served = new Set((group?.versions ?? []).map((v) => v.version));
+    gatewayApiVersion =
+      GATEWAY_VERSIONS.find((v) => served.has(v)) ?? group?.preferredVersion?.version;
+  } catch {
+    gatewayApiVersion = undefined;
+  }
+
+  try {
+    const classes = await kube.networking.listIngressClass();
+    const items = classes.items ?? [];
+    return {
+      gatewayApiVersion,
+      ingressClassCount: items.length,
+      hasDefaultIngressClass: items.some(
+        (c) => c.metadata?.annotations?.[DEFAULT_CLASS_ANNOTATION] === "true",
+      ),
+    };
+  } catch (err) {
+    return { gatewayApiVersion, hasDefaultIngressClass: false, ingressClassError: err };
+  }
+}
+
+/**
+ * Decide the routing layer ONCE, at boot, so a misconfiguration fails the runner
+ * instead of 404-ing every session it later accepts.
+ *
+ * `auto` resolves on what is CONFIGURED before what is INSTALLED, and that order
+ * is the whole point: Gateway API CRDs are frequently present without being the
+ * intended path, so "both APIs available" is not evidence of intent and must not
+ * decide anything. Only a cluster that offers two usable layers and was told
+ * nothing is genuinely ambiguous — and there the answer is to refuse, because
+ * guessing wrong publishes routes nothing reconciles, which is silent.
+ */
+export async function resolveRouting(
+  kube: KubeClient,
+  config: K8sRunnerConfig,
+): Promise<ResolvedRouting> {
+  const routing = config.sessionRouting;
+
+  if (routing.mode === "none") {
+    return { layer: "none", reason: "SESSION_ROUTING_MODE=none" };
+  }
+  // The base domain is what makes a host constructible at all, so it stays the
+  // master switch it has always been — no domain, no routing, whatever the mode.
+  if (!routing.baseDomain) {
+    return {
+      layer: "none",
+      reason: "SESSION_ROUTING_BASE_DOMAIN is unset, so no session host can be constructed",
+    };
+  }
+
+  const support = await detectRoutingSupport(kube);
+  const resolved = decideLayer(config, support);
+  assertTlsMatchesLayer(config, resolved);
+  return resolved;
+}
+
+/** The origin certificate is refused HERE as well as at config load, because
+ *  under `auto` the effective layer is not known until now: a named Gateway wins,
+ *  so `mode: auto` + a Gateway + `SESSION_INGRESS_TLS_SECRET` passed the
+ *  config-time check and then routed on Gateway API with the certificate
+ *  ignored — plaintext origin traffic under a configuration that reads as
+ *  TLS-configured, which is the silent downgrade the check exists to prevent. */
+function assertTlsMatchesLayer(config: K8sRunnerConfig, resolved: ResolvedRouting): void {
+  if (resolved.layer !== "gateway" || !config.sessionRouting.tlsSecretName) return;
+  throw new RunnerConfigError(
+    "SESSION_INGRESS_TLS_SECRET is set but session routing resolved to Gateway API. Under Gateway " +
+      "API the origin certificate belongs to the Gateway listener's own `tls.certificateRefs`, not " +
+      "to the per-session route, so this Secret would be silently ignored. Move the reference to " +
+      "the Gateway and unset this, or set SESSION_ROUTING_MODE=ingress.",
+  );
+}
+
+function decideLayer(config: K8sRunnerConfig, support: ClusterRoutingSupport): ResolvedRouting {
+  const routing = config.sessionRouting;
+
+  if (routing.mode === "ingress") return { layer: "ingress" };
+
+  if (routing.mode === "gateway") {
+    if (!support.gatewayApiVersion) {
+      throw new RunnerConfigError(
+        `SESSION_ROUTING_MODE=gateway but the cluster does not serve '${GATEWAY_GROUP}'. ` +
+          "Install the Gateway API CRDs, or set SESSION_ROUTING_MODE=ingress.",
+      );
+    }
+    return { layer: "gateway", apiVersion: support.gatewayApiVersion };
+  }
+
+  // auto — configured target first.
+  if (routing.gateway) {
+    if (!support.gatewayApiVersion) {
+      throw new RunnerConfigError(
+        `SESSION_GATEWAY_NAME is set but the cluster does not serve '${GATEWAY_GROUP}'. ` +
+          "Install the Gateway API CRDs, or unset SESSION_GATEWAY_NAME to route via Ingress.",
+      );
+    }
+    return { layer: "gateway", apiVersion: support.gatewayApiVersion };
+  }
+  if (routing.ingressClassName) return { layer: "ingress" };
+  // A DEFAULT-marked IngressClass is configuration, not mere availability: the
+  // cluster has nominated where an unqualified Ingress goes, and unqualified is
+  // exactly what this runner creates. It therefore ranks with a named Gateway
+  // and a configured class rather than with "an IngressClass exists" — without
+  // which every cluster that ships the Gateway CRDs beside a default ingress
+  // controller would refuse to boot after this upgrade, having worked before.
+  if (support.hasDefaultIngressClass) return { layer: "ingress" };
+
+  const gatewayUsable = Boolean(support.gatewayApiVersion);
+  const ingressUsable = (support.ingressClassCount ?? 0) > 0;
+
+  if (gatewayUsable && ingressUsable) {
+    throw new RunnerConfigError(
+      `SESSION_ROUTING_MODE=auto cannot choose: this cluster serves '${GATEWAY_GROUP}' AND has ` +
+        `${support.ingressClassCount} IngressClass(es) with none marked default, and nothing says ` +
+        "which should carry session traffic. Set SESSION_ROUTING_MODE=ingress (with " +
+        "SESSION_INGRESS_CLASS) or SESSION_ROUTING_MODE=gateway (with SESSION_GATEWAY_NAME).",
+    );
+  }
+  if (gatewayUsable) {
+    throw new RunnerConfigError(
+      `SESSION_ROUTING_MODE=auto resolved to Gateway API, but SESSION_GATEWAY_NAME is unset — a ` +
+        "route has to name the Gateway it attaches to, and picking one of several would fail as " +
+        "silently as publishing none. Set SESSION_GATEWAY_NAME (and SESSION_GATEWAY_NAMESPACE " +
+        `when the Gateway is not in '${config.sessionNamespace}').`,
+    );
+  }
+  if (ingressUsable) return { layer: "ingress" };
+
+  // Say which of the two it is. Reporting a permission failure as "no
+  // IngressClass exists" is a claim about the cluster drawn from a fact about
+  // this runner's access, and it sends an operator to install a controller they
+  // already have.
+  if (support.ingressClassError !== undefined) {
+    throw new RunnerConfigError(
+      "SESSION_ROUTING_BASE_DOMAIN is set but the routing layer could not be resolved: listing " +
+        `IngressClasses failed (${apiReason(support.ingressClassError)}) and '${GATEWAY_GROUP}' is ` +
+        "not served. Grant `list` on `ingressclasses`, or set SESSION_ROUTING_MODE explicitly.",
+    );
+  }
+  throw new RunnerConfigError(
+    "SESSION_ROUTING_BASE_DOMAIN is set but this cluster offers no usable routing layer: no " +
+      `IngressClass exists and '${GATEWAY_GROUP}' is not served. Install an Ingress controller or ` +
+      "the Gateway API, or set SESSION_ROUTING_MODE=none to run logs-only.",
+  );
+}

package/src/k8s/routing/session-endpoints.ts

@@ -0,0 +1,45 @@
+import type { PortMapping, RunnerEndpoint } from "@telorun/runner-core";
+
+import type { K8sRunnerConfig } from "../../config.js";
+
+/** Host fronting a single tcp port: `<port>-<sessionId>.<domain>`. The port rides
+ *  as a leading label (no dots), so it stays a single label under the base domain
+ *  — matching the docker runner's proxy scheme and compatible with a single-label
+ *  wildcard cert (`*.<domain>`).
+ *
+ *  Shared by both routing layers on purpose: the host scheme is what a client is
+ *  told and what DNS is configured for, so it must not vary with the cluster's
+ *  choice of Ingress or Gateway API. */
+export function hostForPort(config: K8sRunnerConfig, sessionId: string, port: number): string {
+  return `${port}-${sessionId}.${config.sessionRouting.baseDomain}`;
+}
+
+/**
+ * Endpoints announced on the `running` status. Every tcp port is fronted by its
+ * own per-session host (served on 443) and carries an external `url`. udp ports
+ * aren't HTTP-routable, so they keep the host-less form. Without a base domain,
+ * host is left blank for the client adapter to fill (parity with docker).
+ *
+ * `routed` is what says a URL will be served, and it is separate from the base
+ * domain because the two can disagree: `SESSION_ROUTING_MODE=none` with a domain
+ * configured is a valid, documented setup that publishes nothing. Keying on the
+ * domain alone handed the editor a URL nothing serves — and the route watch
+ * never runs in that mode, so no `route` event would have said so either.
+ */
+export function endpointsFor(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  ports: PortMapping[],
+  routed: boolean,
+): RunnerEndpoint[] {
+  if (!routed || !config.sessionRouting.baseDomain || ports.length === 0) {
+    return ports.map((p) => ({ host: "", port: p.port, protocol: p.protocol }));
+  }
+  return ports.map((p) => {
+    if (p.protocol !== "tcp") {
+      return { host: "", port: p.port, protocol: p.protocol };
+    }
+    const host = hostForPort(config, sessionId, p.port);
+    return { host, port: p.port, protocol: p.protocol, url: `https://${host}` };
+  });
+}

package/src/k8s/routing/session-router.ts

@@ -0,0 +1,59 @@
+import type { PortMapping } from "@telorun/runner-core";
+
+/** One published host and the session port behind it. */
+export interface PublishedRoute {
+  host: string;
+  port: number;
+}
+
+export interface PublishRouteArgs {
+  sessionId: string;
+  /** The Service the routing object points at. */
+  serviceName: string;
+  /** Owner of every object created — see `podOwnerRef`. */
+  podName: string;
+  podUid: string;
+  /** Every port the session must carry. Non-tcp ports are ignored: they are not
+   *  HTTP-routable, and the Service still exposes them. */
+  ports: PortMapping[];
+}
+
+/**
+ * What a routing layer has to say about one published host.
+ *
+ * `pending` is a real answer, not an absence: a controller that has not yet
+ * written status is indistinguishable from one that will never claim the route,
+ * and only time separates them.
+ */
+export type RouteVerdict =
+  | { kind: "programmed" }
+  | { kind: "pending" }
+  | { kind: "rejected"; reason: string };
+
+/**
+ * How this cluster publishes a session's public routes.
+ *
+ * The seam exists because Ingress and Gateway API are both current: neither is a
+ * migration target for the other, clusters ship one, the other, or both, and a
+ * runner that hardcodes either is unroutable on half of them. It deliberately
+ * stays inside the k8s backend — docker publishes host ports through its own
+ * proxy and has no use for it, and `runner-core` owns the backend-neutral `/v1`
+ * contract, where "Ingress or HTTPRoute" is not a distinction that exists.
+ */
+export interface SessionRouter {
+  /** Names the layer for diagnostics. */
+  readonly layer: "ingress" | "gateway";
+
+  /** Create-or-replace this session's routing objects. Returns the hosts it
+   *  published, which is what the route watch then asks about. */
+  publish(args: PublishRouteArgs): Promise<PublishedRoute[]>;
+
+  /** This layer's current verdict on one published host. Asked repeatedly by the
+   *  route watch until it settles or the deadline passes. */
+  verdictFor(sessionId: string, route: PublishedRoute): Promise<RouteVerdict>;
+
+  /** What to tell an operator when a route is still `pending` at the deadline.
+   *  Layer-specific because the causes are: no controller for the IngressClass,
+   *  versus a Gateway that never claimed the route. */
+  unclaimedReason(): string;
+}

package/src/k8s/routing/session-service.ts

@@ -0,0 +1,55 @@
+import type { V1OwnerReference, V1Service } from "@kubernetes/client-node";
+
+import type { PortMapping } from "@telorun/runner-core";
+
+import type { K8sRunnerConfig } from "../../config.js";
+
+/** OwnerReference to the session Pod so every routing object is garbage collected
+ *  when the Pod dies — essential for sub-minute sessions that would otherwise leak
+ *  routing objects. Both routing layers use it: an HTTPRoute is namespaced like an
+ *  Ingress, so the same ownership works unchanged. */
+export function podOwnerRef(podName: string, podUid: string): V1OwnerReference {
+  return {
+    apiVersion: "v1",
+    kind: "Pod",
+    name: podName,
+    uid: podUid,
+    controller: true,
+    blockOwnerDeletion: true,
+  };
+}
+
+/** The name every routing object for one session shares. */
+export function sessionObjectName(sessionId: string): string {
+  return `telo-run-${sessionId}`;
+}
+
+/** The Service both routing layers point at — the routing layer decides how
+ *  traffic ARRIVES, never what it arrives at, so this is layer-neutral. */
+export function buildSessionService(
+  config: K8sRunnerConfig,
+  sessionId: string,
+  podName: string,
+  podUid: string,
+  ports: PortMapping[],
+): V1Service {
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name: sessionObjectName(sessionId),
+      namespace: config.sessionNamespace,
+      labels: { "app.kubernetes.io/managed-by": config.managedByLabel },
+      ownerReferences: [podOwnerRef(podName, podUid)],
+    },
+    spec: {
+      selector: { "telo.run/session-id": sessionId },
+      ports: ports.map((p) => ({
+        name: `p${p.port}`,
+        port: p.port,
+        targetPort: p.port,
+        protocol: p.protocol.toUpperCase(),
+      })),
+    },
+  };
+}

package/src/k8s/watch-session.ts

@@ -25,7 +25,15 @@ import type { K8sRunnerConfig } from "../config.js";
 import { clampLimits } from "../limits.js";
 import { apiFailure, apiReason } from "./api-error.js";
 import type { KubeClient } from "./client.js";
-import { buildSessionIngress, buildSessionService, endpointsFor } from "./ingress.js";
+import {
+  buildSessionService,
+  createOrReplace,
+  endpointsFor,
+  sessionObjectName,
+  watchRouteHealth,
+  type PublishedRoute,
+  type SessionRouter,
+} from "./routing/index.js";
 import { buildWatchPod, inspectPortFor, WORKSPACE_PORT } from "./pod-spec.js";
 import { deletePod, is404, msg, podPhase, podStatus, provisionMessage } from "./pod-status.js";
 import { ensureWorkspaceConfigMap } from "./workspace-configmap.js";
@@ -49,6 +57,8 @@ interface ResizableSocket {
 export interface WatchSessionDeps {
   kube: KubeClient;
   config: K8sRunnerConfig;
+  /** Resolved at boot; absent → logs-only. */
+  router?: SessionRouter;
 }
 
 /**
@@ -64,7 +74,7 @@ export async function startWatchSession(
   deps: WatchSessionDeps,
   spec: BackendStartSpec,
 ): Promise<BackendSession> {
-  const { kube, config } = deps;
+  const { kube, config, router } = deps;
   const ns = config.sessionNamespace;
   const limits = clampLimits(config.appLimits, undefined);
 
@@ -86,6 +96,9 @@ export async function startWatchSession(
     stdins: Map<string, PassThrough>;
     abort: AbortController;
     stopWatch: () => void;
+    /** Aborts the previous route-health watch when a reload republishes routes —
+     *  the old host set is no longer what the session serves. */
+    routeAbort?: AbortController;
   }
   let runtime: PodRuntime | null = null;
 
@@ -166,22 +179,22 @@ export async function startWatchSession(
     const agent = agentEndpoint();
     spec.onStatus({
       kind: "running",
-      endpoints: endpointsFor(config, spec.sessionId, allPorts(apps)),
+      endpoints: endpointsFor(config, spec.sessionId, allPorts(apps), Boolean(router)),
       ...(agent ? { agent } : {}),
     });
   }
 
   /** Where this session's co-resident agent answers. The pod's containers share
    *  one network namespace, so the agent rides the session's own Service and
-   *  Ingress — the port is simply in the routed set, and the host follows the
+   *  routing objects — the port is simply in the routed set, and the host follows the
    *  same `<port>-<sessionId>` scheme every app port does. */
   function agentEndpoint(): RunnerEndpoint | undefined {
     const port = spec.agent?.port;
     if (port === undefined) return undefined;
-    return endpointsFor(config, spec.sessionId, [{ port, protocol: "tcp" }])[0];
+    return endpointsFor(config, spec.sessionId, [{ port, protocol: "tcp" }], Boolean(router))[0];
   }
 
-  /** Every port the session's Service and Ingress must carry: the apps' declared
+  /** Every port the session's Service and routing objects must carry: the apps' declared
    *  ports plus the agent's. Kept apart from `allPorts`, which answers what the
    *  APPLICATIONS declare — that set is what the client is told about and what a
    *  reload re-reads, and the agent belongs in neither. */
@@ -322,8 +335,8 @@ export async function startWatchSession(
    * which matters, because a manifest the runner could not parse would otherwise
    * have to leave routing alone and report, on the hot path of every save.
    *
-   * A pod's `containerPort` list is documentation; the Service and the Ingress
-   * are what make a port reachable, so this needs no pod recreate.
+   * A pod's `containerPort` list is documentation; the Service and the routing
+   * objects are what make a port reachable, so this needs no pod recreate.
    */
   async function applyPortsResolved(appName: string, frame: DebugFrame): Promise<void> {
     const declared = portsResolvedFrom(frame);
@@ -365,10 +378,10 @@ export async function startWatchSession(
     }
     spec.onEndpoints(appName, {
       ...(accepted.length > 0
-        ? { added: endpointsFor(config, spec.sessionId, accepted) }
+        ? { added: endpointsFor(config, spec.sessionId, accepted, Boolean(router)) }
         : {}),
       ...(removed.length > 0
-        ? { removed: endpointsFor(config, spec.sessionId, removed) }
+        ? { removed: endpointsFor(config, spec.sessionId, removed, Boolean(router)) }
         : {}),
       ...(rejected.length > 0
         ? {
@@ -488,21 +501,25 @@ export async function startWatchSession(
   }
 
   /**
-   * Create or re-patch the Service and Ingress for the session's whole declared
-   * port set. Adding a `ports:` entry is as ordinary an edit as adding an
-   * import, and a container may bind any port regardless of what the pod spec
-   * declares — so without this the app listens and is simply unreachable: no
-   * ingress, no error, no event. The pod's `containerPort` list is
-   * documentation; the Service and Ingress are what make a port reachable, which
-   * is why this needs no pod recreate.
+   * Create or re-patch the Service and the routing objects for the session's
+   * whole declared port set. Adding a `ports:` entry is as ordinary an edit as
+   * adding an import, and a container may bind any port regardless of what the
+   * pod spec declares — so without this the app listens and is simply
+   * unreachable: no route, no error, no event. The pod's `containerPort` list is
+   * documentation; the Service and the routing objects are what make a port
+   * reachable, which is why this needs no pod recreate.
+   *
+   * An EMPTY routed set still reaches the router, because dropping the last
+   * declared port is a reload like any other and its routes must go with it —
+   * returning early here left them serving a port nothing listens on.
    */
   async function publishEndpoints(rt: PodRuntime, forApps: BackendAppSpec[]): Promise<void> {
-    if (!config.sessionIngressBaseDomain) return;
+    if (!router) return;
     const ports = routedPorts(forApps);
-    if (ports.length === 0) return;
-    const service = buildSessionService(config, spec.sessionId, rt.name, rt.uid, ports);
-    const serviceName = service.metadata!.name!;
-    await upsert(
+    const serviceName = sessionObjectName(spec.sessionId);
+    if (ports.length > 0) {
+      const service = buildSessionService(config, spec.sessionId, rt.name, rt.uid, ports);
+      await createOrReplace(
       () => kube.core.createNamespacedService({ namespace: ns, body: service }),
       async () => {
         // A Service replace must carry the assigned `clusterIP` and the current
@@ -527,37 +544,51 @@ export async function startWatchSession(
           },
         });
       },
-    );
-    const { ingress } = buildSessionIngress(
-      config,
-      spec.sessionId,
+      );
+    }
+    const published = await router.publish({
+      sessionId: spec.sessionId,
       serviceName,
-      rt.name,
-      rt.uid,
+      podName: rt.name,
+      podUid: rt.uid,
       ports,
-    );
-    if (!ingress.spec?.rules?.length) return;
-    const ingressName = ingress.metadata!.name!;
-    await upsert(
-      () => kube.networking.createNamespacedIngress({ namespace: ns, body: ingress }),
-      async () => {
-        const existing = await kube.networking.readNamespacedIngress({
-          name: ingressName,
-          namespace: ns,
-        });
-        await kube.networking.replaceNamespacedIngress({
-          name: ingressName,
-          namespace: ns,
-          body: {
-            ...ingress,
-            metadata: {
-              ...ingress.metadata,
-              resourceVersion: existing.metadata?.resourceVersion,
-            },
-          },
-        });
-      },
-    );
+    });
+    watchRoutes(rt, router, published, forApps);
+  }
+
+  /** Verify the routing layer programmed what was just published, and report each
+   *  host. A watch session republishes on every reload, so the previous watch is
+   *  dropped and a fresh one started against the new host set. */
+  function watchRoutes(
+    rt: PodRuntime,
+    sessionRouter: SessionRouter,
+    published: PublishedRoute[],
+    forApps: BackendAppSpec[],
+  ): void {
+    rt.routeAbort?.abort();
+    if (published.length === 0) return;
+    const abort = new AbortController();
+    rt.routeAbort = abort;
+    // A port belongs to at most one app (the session-wide uniqueness rule); the
+    // co-resident agent's port belongs to none, and reports with no `app`.
+    const ownerOf = new Map<number, string>();
+    for (const app of forApps) {
+      for (const p of app.ports) ownerOf.set(p.port, app.name);
+    }
+    void watchRouteHealth({
+      router: sessionRouter,
+      sessionId: spec.sessionId,
+      routes: published,
+      onState: (route, state, reason) =>
+        spec.onRoute(ownerOf.get(route.port), {
+          host: route.host,
+          port: route.port,
+          state,
+          reason,
+        }),
+      signal: AbortSignal.any([abort.signal, rt.abort.signal]),
+      timeoutMs: config.sessionRouting.routeReadyTimeoutMs,
+    });
   }
 
   async function teardownPod(): Promise<void> {
@@ -639,14 +670,6 @@ export async function startWatchSession(
     return app.io === "tty" ? "tty" : real;
   }
 
-  async function upsert(create: () => Promise<unknown>, replace: () => Promise<unknown>) {
-    try {
-      await create();
-    } catch (err) {
-      if (!isConflict(err)) throw err;
-      await replace();
-    }
-  }
 }
 
 function allPorts(apps: BackendAppSpec[]): PortMapping[] {
@@ -668,11 +691,6 @@ function freshPodName(sessionId: string): string {
   return `telo-watch-${sessionId}-${Date.now().toString(36)}${podSequence.toString(36)}`;
 }
 
-function isConflict(err: unknown): boolean {
-  const e = err as { statusCode?: number; code?: number; response?: { statusCode?: number } };
-  return (e?.statusCode ?? e?.code ?? e?.response?.statusCode) === 409;
-}
-
 function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(resolve, ms);

package/src/k8s/workspace-configmap.ts

@@ -4,6 +4,7 @@ import { workspaceAppManifest, WORKSPACE_APP_FILENAME } from "@telorun/runner-co
 
 import type { K8sRunnerConfig } from "../config.js";
 import type { KubeClient } from "./client.js";
+import { is404, isConflict } from "./pod-status.js";
 
 /**
  * The workspace application's manifest, delivered to the pod as a ConfigMap.
@@ -39,7 +40,7 @@ export async function ensureWorkspaceConfigMap(
     await kube.core.readNamespacedConfigMap({ name, namespace: config.sessionNamespace });
     return name;
   } catch (err) {
-    if (!isNotFound(err)) throw err;
+    if (!is404(err)) throw err;
   }
   try {
     await kube.core.createNamespacedConfigMap({
@@ -64,19 +65,6 @@ export async function ensureWorkspaceConfigMap(
   return name;
 }
 
-function statusOf(err: unknown): number | undefined {
-  const e = err as { statusCode?: number; code?: number; response?: { statusCode?: number } };
-  return e?.statusCode ?? e?.code ?? e?.response?.statusCode;
-}
-
-function isNotFound(err: unknown): boolean {
-  return statusOf(err) === 404;
-}
-
-function isConflict(err: unknown): boolean {
-  return statusOf(err) === 409;
-}
-
 /**
  * Delete workspace-app ConfigMaps no live pod mounts.
  *
@@ -126,7 +114,7 @@ export async function sweepWorkspaceConfigMaps(
       await kube.core.deleteNamespacedConfigMap({ name, namespace: config.sessionNamespace });
       removed += 1;
     } catch (err) {
-      if (!isNotFound(err)) log.warn({ err, name }, "failed to delete a stale workspace ConfigMap");
+      if (!is404(err)) log.warn({ err, name }, "failed to delete a stale workspace ConfigMap");
     }
   }
   if (removed > 0) log.info({ removed }, "swept stale workspace-app ConfigMaps");