@toa.io/operations 1.0.0-alpha.34 → 1.0.0-alpha.340

package/src/deployment/.deployment/merge.test.js

@@ -0,0 +1,133 @@
+import { describe, it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { merge } from './merge.js'
+
+// a service is named the way it is deployed by the time it reaches `merge`
+const service = (name, extra = {}) => ({
+  group: 'group',
+  name: `group-${name}`,
+  version: '0',
+  ...extra
+})
+
+it('should merge services of all dependencies', () => {
+  const merged = merge([
+    { services: [service('one', { port: 8000 })] },
+    { services: [service('two', { port: 8001 })] }
+  ])
+
+  assert.strictEqual(merged.services.length, 2)
+})
+
+/*
+ * A workload that hosts services puts them in one process, so a port is claimed once
+ * within one. Services in separate pods share nothing.
+ */
+describe('port reservation', () => {
+  const hosted = (name, extra = {}) => service(name, { workload: ['mono'], ...extra })
+
+  it('should reject two services of one workload claiming one port', () => {
+    const dependencies = [
+      { services: [hosted('one', { port: 8000 })] },
+      { services: [hosted('two', { port: 8000 })] }
+    ]
+
+    assert.throws(
+      () => merge(dependencies),
+      (error) =>
+        /Port 8000 is claimed by both 'group-one' and 'group-two' in 'mono'/.test(
+          error.message
+        )
+    )
+  })
+
+  it('should allow two workloads to claim one port', () => {
+    const dependencies = [
+      { services: [service('one', { port: 8000, workload: ['edge'] })] },
+      { services: [service('two', { port: 8000, workload: ['inner'] })] }
+    ]
+
+    assert.doesNotThrow(() => merge(dependencies))
+  })
+
+  it('should reserve the ports of a service in every workload running it', () => {
+    const dependencies = [
+      { services: [service('one', { port: 8000, workload: ['edge', 'inner'] })] },
+      { services: [service('two', { port: 8000, workload: ['inner'] })] }
+    ]
+
+    assert.throws(
+      () => merge(dependencies),
+      (error) =>
+        /Port 8000 is claimed by both 'group-one' and 'group-two' in 'inner'/.test(
+          error.message
+        )
+    )
+  })
+
+  it('should allow two services deployed on their own to claim one port', () => {
+    const dependencies = [
+      { services: [service('one', { port: 8000 })] },
+      { services: [service('two', { port: 8000 })] }
+    ]
+
+    assert.doesNotThrow(() => merge(dependencies))
+  })
+
+  it('should reject a service claiming the port of the readiness probe', () => {
+    const dependencies = [
+      { probe: { path: '/.ready', port: 8001 } },
+      { services: [service('one', { port: 8001 })] }
+    ]
+
+    assert.throws(
+      () => merge(dependencies),
+      (error) =>
+        /Port 8001 is claimed by both the readiness probe and 'group-one'/.test(
+          error.message
+        )
+    )
+  })
+
+  it('should reject a probe claiming the port of another service of the workload', () => {
+    const dependencies = [
+      { services: [hosted('one', { port: 8000 })] },
+      {
+        services: [hosted('two', { port: 8002, probe: { path: '/.ready', port: 8000 } })]
+      }
+    ]
+
+    assert.throws(
+      () => merge(dependencies),
+      (error) =>
+        /Port 8000 is claimed by both 'group-one' and the readiness probe of 'group-two' in 'mono'/.test(
+          error.message
+        )
+    )
+  })
+
+  it('should allow a service to probe its own port', () => {
+    const dependencies = [
+      {
+        services: [service('one', { port: 8000, probe: { path: '/.ready', port: 8000 } })]
+      }
+    ]
+
+    assert.doesNotThrow(() => merge(dependencies))
+  })
+
+  it('should ignore services without a port', () => {
+    const dependencies = [{ services: [service('one'), service('two')] }]
+
+    assert.doesNotThrow(() => merge(dependencies))
+  })
+
+  it('should ignore a disabled probe', () => {
+    const dependencies = [
+      { probe: false, services: [service('one', { port: 8000, probe: false })] }
+    ]
+
+    assert.doesNotThrow(() => merge(dependencies))
+  })
+})

package/src/deployment/chart/templates/components.configmap.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.map }}
+# What every component of the context provides, by the version this deployment runs of it.
+# Mounted rather than rendered into a workload's environment: a variable would replace every pod
+# of the context on every deployment, and a pod that came up between two of them could not be
+# told. Carried gzipped, because what is read here is read by a program and a ConfigMap is capped
+# at a megabyte: `kubectl exec <pod> -- zcat {{ .Values.map.directory }}/{{ .Values.map.file }}`.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: components
+binaryData:
+  {{ .Values.map.file }}: {{ .Values.map.gzip | quote }}
+{{- end }}

package/src/deployment/chart/templates/components.yaml

@@ -6,11 +6,12 @@ metadata:
 spec:
   type: ClusterIP
   selector:
-    {{ . }}: "1"
+    toa/component-{{ . }}: "1"
   ports:
+    # what a streamed call is dialled at; see documentation/ports.md
     - name: http-binding
       protocol: TCP
-      port: 3000
-      targetPort: 3000
+      port: 8005
+      targetPort: 8005
 ---
 {{- end }}

package/src/deployment/chart/templates/compositions.yaml

@@ -5,29 +5,134 @@ metadata:
   name: composition-{{ required "composition name is required" .name }}
 spec:
   replicas: {{ .replicas | default 2 }}
+  # A backstop for stuck rollouts only. Must stay above the `helm upgrade --timeout`
+  # the deploy runs with, so a slow but progressing rollout is not marked failed.
+  progressDeadlineSeconds: 900
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      # a replacement must pass readiness before a running replica is taken out, and every
+      # replacement starts at once: the rollout takes one start-up, not one per replica
+      maxUnavailable: 0
+      maxSurge: 100%
   selector:
     matchLabels:
-      toa.io/composition: {{ .name }}
+      toa/composition: {{ .name }}
   template:
     metadata:
       labels:
-        toa.io/composition: {{ .name }}
+        toa/composition: {{ .name }}
         {{- range .components }}
-        {{ . }}: "1"
+        toa/component-{{ . }}: "1"
+        {{- end }}
+        {{- range .hosted }}
+        toa/service-{{ . }}: "1"
         {{- end }}
     spec:
       containers:
         - name: {{ .name }}
           image: {{ .image }}
-          {{- if .variables }}
+          {{- if .resources }}
+          resources:
+            {{- if or .resources.cpu .resources.memory }}
+            requests:
+              {{- if .resources.cpu }}
+              cpu: {{ index .resources.cpu 0 }}
+              {{- end }}
+              {{- if .resources.memory }}
+              memory: {{ index .resources.memory 0 }}
+              {{- end }}
+            limits:
+              {{- if .resources.cpu }}
+              cpu: {{ index .resources.cpu 1 }}
+              {{- end }}
+              {{- if .resources.memory }}
+              memory: {{ index .resources.memory 1 }}
+              {{- end }}
+            {{- end }}
+          {{- end }}          
+          {{- if or .variables .services }}
           env:
+            {{- if .services }}
+            - name: TOA_SERVICES
+              value: {{ join " " .services | quote }}
+            {{- end }}
             {{- range .variables }}
             {{- include "env.var" . | indent 12 }}
             {{- end }}
           {{- end }}
+          {{- if or .backends .probe }}
+          ports:
+            {{- range .backends }}
+            - containerPort: {{ .port }}
+            {{- end }}
+            {{- if .probe }}
+            - containerPort: {{ .probe.port }}
+            {{- end }}
+          {{- end }}
+          {{- if .probe }}
+          startupProbe:
+            httpGet:
+              path: {{ .probe.path }}
+              port: {{ .probe.port }}
+            {{- if .probe.delay }}
+            initialDelaySeconds: {{ .probe.delay }}
+            {{- end }}
+            periodSeconds: 2
+            timeoutSeconds: 3
+            failureThreshold: 150
+          readinessProbe:
+            httpGet:
+              path: {{ .probe.path }}
+              port: {{ .probe.port }}
+            # a replica is ready when it says so, not at the next tick of a slow clock
+            periodSeconds: 2
+            timeoutSeconds: 3
+            failureThreshold: 5
+          {{- end }}
+          {{- if or .mounts $.Values.map }}
+          volumeMounts:
+            {{- range .mounts }}
+            - name: {{ .name }}
+              mountPath: {{ .path }}
+            {{- end }}
+            {{- if $.Values.map }}
+            - name: components
+              mountPath: {{ $.Values.map.directory }}
+              readOnly: true
+            {{- end }}
+          {{- end }}
+          lifecycle:
+            preStop:
+              exec:
+                command: [sleep, "5"]
+      terminationGracePeriodSeconds: 45
       {{- if $.Values.credentials }}
       imagePullSecrets:
         - name: {{ $.Values.credentials }}
       {{- end }}
+      {{- if or .mounts $.Values.map }}
+      volumes:
+        {{- range .mounts }}
+        - name: {{ .name }}
+          persistentVolumeClaim:
+            claimName: {{ .claim }}
+        {{- end }}
+        {{- if $.Values.map }}
+        - name: components
+          configMap:
+            name: components
+        {{- end }}
+      {{- end }}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              toa/composition: {{ .name }}
+          # only this revision's pods: a rollout spreads the new ones, whatever the old ones occupy
+          matchLabelKeys:
+            - pod-template-hash
 ---
 {{- end }}

package/src/deployment/chart/templates/mono.yaml

@@ -0,0 +1,199 @@
+{{- if .Values.mono }}
+{{- with .Values.mono }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mono
+spec:
+  replicas: {{ .replicas | default 2 }}
+  progressDeadlineSeconds: 900
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 100%
+  selector:
+    matchLabels:
+      toa/composition: mono
+  template:
+    metadata:
+      labels:
+        toa/composition: mono
+        {{- range .components }}
+        toa/component-{{ . }}: "1"
+        {{- end }}
+    spec:
+      containers:
+        - name: mono
+          image: {{ .image }}
+          {{- if or .backends .probe }}
+          ports:
+            {{- range .backends }}
+            - containerPort: {{ .port }}
+            {{- end }}
+            {{- if .probe }}
+            - containerPort: {{ .probe.port }}
+            {{- end }}
+          {{- end }}
+          {{- if .resources }}
+          resources:
+            {{- if or .resources.cpu .resources.memory }}
+            requests:
+              {{- if .resources.cpu }}
+              cpu: {{ index .resources.cpu 0 }}
+              {{- end }}
+              {{- if .resources.memory }}
+              memory: {{ index .resources.memory 0 }}
+              {{- end }}
+            limits:
+              {{- if .resources.cpu }}
+              cpu: {{ index .resources.cpu 1 }}
+              {{- end }}
+              {{- if .resources.memory }}
+              memory: {{ index .resources.memory 1 }}
+              {{- end }}
+            {{- end }}
+          {{- end }}
+          {{- if or .variables .services }}
+          env:
+            {{- if .services }}
+            - name: TOA_SERVICES
+              value: {{ join " " .services | quote }}
+            {{- end }}
+            {{- range .variables }}
+            {{- include "env.var" . | indent 12 }}
+            {{- end }}
+          {{- end }}
+          {{- if .probe }}
+          startupProbe:
+            httpGet:
+              path: {{ .probe.path }}
+              port: {{ .probe.port }}
+            {{- if .probe.delay }}
+            initialDelaySeconds: {{ .probe.delay }}
+            {{- end }}
+            periodSeconds: 2
+            timeoutSeconds: 3
+            failureThreshold: 150
+          readinessProbe:
+            httpGet:
+              path: {{ .probe.path }}
+              port: {{ .probe.port }}
+            # a replica is ready when it says so, not at the next tick of a slow clock
+            periodSeconds: 2
+            timeoutSeconds: 3
+            failureThreshold: 5
+          {{- end }}
+          {{- if or .mounts $.Values.map }}
+          volumeMounts:
+            {{- range .mounts }}
+            - name: {{ .name }}
+              mountPath: {{ .path }}
+            {{- end }}
+            {{- if $.Values.map }}
+            - name: components
+              mountPath: {{ $.Values.map.directory }}
+              readOnly: true
+            {{- end }}
+          {{- end }}
+          lifecycle:
+            preStop:
+              exec:
+                command: [sleep, "5"]
+      terminationGracePeriodSeconds: 45
+      {{- if $.Values.credentials }}
+      imagePullSecrets:
+        - name: {{ $.Values.credentials }}
+      {{- end }}
+      {{- if or .mounts $.Values.map }}
+      volumes:
+        {{- range .mounts }}
+        - name: {{ .name }}
+          persistentVolumeClaim:
+            claimName: {{ .claim }}
+        {{- end }}
+        {{- if $.Values.map }}
+        - name: components
+          configMap:
+            name: components
+        {{- end }}
+      {{- end }}
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              toa/composition: mono
+          # only this revision's pods: a rollout spreads the new ones, whatever the old ones occupy
+          matchLabelKeys:
+            - pod-template-hash
+{{- if .backends }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mono
+  {{- if .annotations }}
+  annotations:
+{{ toYaml .annotations | indent 4 }}
+  {{- end }}
+spec:
+  type: ClusterIP
+  selector:
+    toa/composition: mono
+  ports:
+    {{- range .backends }}
+    - name: port-{{ .port }}
+      protocol: TCP
+      port: {{ .port }}
+      targetPort: {{ .port }}
+    {{- end }}
+{{- end }}
+{{- if .ingress }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mono
+  {{- if .ingress.annotations }}
+  annotations:
+{{ toYaml .ingress.annotations | indent 4 }}
+  {{- end }}
+spec:
+  {{- if .ingress.class }}
+  ingressClassName: {{ .ingress.class }}
+  {{- end }}
+  {{- $backends := .backends }}
+  rules:
+    {{- range .ingress.hosts }}
+    - host: {{ . }}
+      http:
+        paths:
+          {{- range $backends }}
+          - path: {{ .path }}
+            pathType: Prefix
+            backend:
+              service:
+                name: mono
+                port:
+                  number: {{ .port }}
+          {{- end }}
+    {{- end }}
+    {{- if .ingress.default }}
+    - http:
+        paths:
+          {{- range $backends }}
+          - path: {{ .path }}
+            pathType: Prefix
+            backend:
+              service:
+                name: mono
+                port:
+                  number: {{ .port }}
+          {{- end }}
+    {{- end }}
+{{- end }}
+---
+{{- end }}
+{{- end }}

package/src/deployment/chart/templates/services.yaml

@@ -1,21 +1,52 @@
 {{- range .Values.services }}
+{{- if not .workload }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: extension-{{ required "deployment name is required" .name }}
 spec:
   replicas: {{ .replicas | default 2 }}
+  # A backstop for stuck rollouts only. Must stay above the `helm upgrade --timeout`
+  # the deploy runs with, so a slow but progressing rollout is not marked failed.
+  progressDeadlineSeconds: 900
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      # a replacement must pass readiness before a running replica is taken out, and every
+      # replacement starts at once: the rollout takes one start-up, not one per replica
+      maxUnavailable: 0
+      maxSurge: 100%
   selector:
     matchLabels:
-      toa.io/service: extension-{{ .name }}
+      toa/service: extension-{{ .name }}
   template:
     metadata:
       labels:
-        toa.io/service: extension-{{ .name }}
+        toa/service: extension-{{ .name }}
+        toa/service-{{ .name }}: "1"
     spec:
       containers:
         - name: extension-{{ .name }}
           image: {{ .image }}
+          {{- if .resources }}
+          resources:
+            {{- if or .resources.cpu .resources.memory }}
+            requests:
+              {{- if .resources.cpu }}
+              cpu: {{ index .resources.cpu 0 }}
+              {{- end }}
+              {{- if .resources.memory }}
+              memory: {{ index .resources.memory 0 }}
+              {{- end }}
+            limits:
+              {{- if .resources.cpu }}
+              cpu: {{ index .resources.cpu 1 }}
+              {{- end }}
+              {{- if .resources.memory }}
+              memory: {{ index .resources.memory 1 }}
+              {{- end }}
+            {{- end }}
+          {{- end }}
           {{- if .variables }}
           env:
             {{- range .variables }}
@@ -23,31 +54,78 @@ spec:
             {{- end }}
           {{- end }}
           {{- if .probe }}
-          readinessProbe:
+          startupProbe:
             httpGet:
               path: {{ .probe.path }}
               port: {{ .probe.port }}
             {{- if .probe.delay }}
             initialDelaySeconds: {{ .probe.delay }}
             {{- end }}
+            periodSeconds: 2
+            timeoutSeconds: 3
+            failureThreshold: 150
+          readinessProbe:
+            httpGet:
+              path: {{ .probe.path }}
+              port: {{ .probe.port }}
+            # a replica is ready when it says so, not at the next tick of a slow clock
+            periodSeconds: 2
+            timeoutSeconds: 3
+            failureThreshold: 5
+          {{- end }}
+          {{- if $.Values.map }}
+          volumeMounts:
+            - name: components
+              mountPath: {{ $.Values.map.directory }}
+              readOnly: true
           {{- end }}
+          lifecycle:
+            preStop:
+              exec:
+                command: [sleep, "5"]
+      {{- if $.Values.map }}
+      volumes:
+        - name: components
+          configMap:
+            name: components
+      {{- end }}
+      terminationGracePeriodSeconds: 45
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              toa/service: extension-{{ .name }}
+          # only this revision's pods: a rollout spreads the new ones, whatever the old ones occupy
+          matchLabelKeys:
+            - pod-template-hash
+{{- end }}
+{{- if .port }}
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: extension-{{ .name }}
+  {{- if .annotations }}
+  annotations:
+{{ toYaml .annotations | indent 4 }}
+  {{- end }}
 spec:
   type: ClusterIP
   selector:
-    toa.io/service: extension-{{ .name }}
+    toa/service-{{ .name }}: "1"
   ports:
     - name: port-{{ .port }}
       protocol: TCP
       port: {{ .port }}
       targetPort: {{ .port }}
----
+{{- end }}
 {{- if .ingress }}
 {{- $service := .name }}
+{{- $port := .port }}
+{{- $path := .ingress.path | default "/" }}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -65,13 +143,25 @@ spec:
     - host: {{ . }}
       http:
         paths:
-          - path: /
+          - path: {{ $path }}
             pathType: Prefix
             backend:
               service:
                 name: extension-{{ $service }}
                 port:
-                  number: 8000
+                  number: {{ $port }}
+    {{- end }}
+    {{- if .ingress.default }}
+    - http:
+        paths:
+          - path: {{ $path }}
+            pathType: Prefix
+            backend:
+              service:
+                name: extension-{{ $service }}
+                port:
+                  number: {{ $port }}
     {{- end }}
 {{- end }}
+---
 {{- end }}