alasio 8.0.0 → 10.0.0

package/dist/cli/src/manifests/disruption.js

@@ -1,16 +1,22 @@
+import { BINDING_LABEL } from "../../../src/binder/names.js";
 import { BUSY_LABEL } from "../../../src/kube/busy-label.js";
 import { componentName, labels, selectorLabels } from "./common.js";
 /** Whether a component of `scale` may run more than one replica. */
 export const replicated = ({ max }) => max > 1;
-/** The budget of `component`'s pods in `namespace`, of `scale`: one of them evicted at a time; none for a component of one replica. */
-export function replicaBudget(component, namespace, scale) {
+/**
+ * The budget of `component`'s pods in `namespace`, of `scale`: one of them evicted at a time;
+ * none for a component of one replica. `unlessBusy`, of its pods not labelled busy alone,
+ * which the budget of busy pods holds (busyBudget).
+ */
+export function replicaBudget(component, namespace, scale, { unlessBusy = false } = {}) {
     if (!replicated(scale))
         return [];
+    const notBusy = unlessBusy ? { matchExpressions: [{ key: BUSY_LABEL, operator: "NotIn", values: ["true"] }] } : {};
     return [{
             apiVersion: "policy/v1",
             kind: "PodDisruptionBudget",
             metadata: { name: componentName(component), namespace, labels: labels(component) },
-            spec: { maxUnavailable: 1, selector: { matchLabels: selectorLabels(component) } },
+            spec: { maxUnavailable: 1, selector: { matchLabels: selectorLabels(component), ...notBusy } },
         }];
 }
 /**
@@ -26,6 +32,15 @@ export function busyBudget(namespace) {
         spec: { maxUnavailable: 0, selector: { matchLabels: { [BUSY_LABEL]: "true" } }, unhealthyPodEvictionPolicy: "AlwaysAllow" },
     };
 }
+/** The budget of `namespace`'s bound pods, the sandbox service's: none of them evicted, but one not ready, as busyBudget's. */
+export function boundBudget(namespace) {
+    return {
+        apiVersion: "policy/v1",
+        kind: "PodDisruptionBudget",
+        metadata: { name: componentName("bound"), namespace, labels: labels("session") },
+        spec: { maxUnavailable: 0, selector: { matchExpressions: [{ key: BINDING_LABEL, operator: "Exists" }] }, unhealthyPodEvictionPolicy: "AlwaysAllow" },
+    };
+}
 /**
  * Where `component`'s replicas go, of `scale`: spread across nodes, where the cluster has
  * them, and zones; nothing to say of one replica. `strictly`, a replica is left unplaced

package/dist/cli/src/manifests/disruption.js.map

@@ -1 +1 @@
-{"version":3,"file":"disruption.js","sourceRoot":"","sources":["../../../../src/manifests/disruption.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGpE,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,EAAS,EAAW,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;AAE/D,uIAAuI;AACvI,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAY;IAC9E,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC;YACN,UAAU,EAAE,WAAW;YACvB,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;YAClF,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE;SAClF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9E,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,0BAA0B,EAAE,aAAa,EAAE;KAC5H,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,SAAiB,EAAE,KAAY,EAAE,QAAQ,GAAG,KAAK;IACtE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAE,IAAa,EAA8B,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,CAAC;QACV,WAAW;QACX,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;QAC5D,aAAa,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;KAC1D,CAAC,CAAC;IACH,6GAA6G;IAC7G,OAAO,EAAE,yBAAyB,EAAE,CAAC,MAAM,CAAC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AACnI,CAAC"}
+{"version":3,"file":"disruption.js","sourceRoot":"","sources":["../../../../src/manifests/disruption.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGpE,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,EAAS,EAAW,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAY,EAAE,EAAE,UAAU,GAAG,KAAK,EAAE,GAAsC,EAAE;IAC9I,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,OAAO,CAAC;YACN,UAAU,EAAE,WAAW;YACvB,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;YAClF,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,EAAE;SAC9F,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9E,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,0BAA0B,EAAE,aAAa,EAAE;KAC5H,CAAC;AACJ,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO;QACL,UAAU,EAAE,WAAW;QACvB,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAChF,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,0BAA0B,EAAE,aAAa,EAAE;KACrJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,SAAiB,EAAE,KAAY,EAAE,QAAQ,GAAG,KAAK;IACtE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAE,IAAa,EAA8B,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,CAAC;QACV,WAAW;QACX,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB;QAC5D,aAAa,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;KAC1D,CAAC,CAAC;IACH,6GAA6G;IAC7G,OAAO,EAAE,yBAAyB,EAAE,CAAC,MAAM,CAAC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AACnI,CAAC"}

package/dist/cli/src/manifests/folders.js

@@ -0,0 +1,131 @@
+import { FOLDER_TOKEN_FILE } from "../../../src/gateway/names.js";
+import { sandboxBaymaTelemetryEnv } from "../../../src/sandbox/telemetry.js";
+import { imageReference } from "../images.js";
+import { accountRole, componentName, envOf, given, hostVolumeMounts, hostVolumes, imagePullSecrets, NAMESPACE, otelEnv, RELEASE } from "./common.js";
+import { folderDeletionPolicy, folderPodPolicy, folderSecretPolicy } from "./admission.js";
+import { boundBudget } from "./disruption.js";
+import { priority } from "./priorities.js";
+/** The port a folder instance's bayma serves MCP on, as every bound pod's does, which the gateway passes requests to (./sandbox-gateway.ts POOL_POD_PORT). */
+export const FOLDER_PORT = 7290;
+/** The gateway's ServiceAccount, its user's name, and the receiver's Service (./sandbox-gateway.ts). */
+const GATEWAY = componentName("sandbox-gateway");
+const GATEWAY_USER = `system:serviceaccount:${NAMESPACE}:${GATEWAY}`;
+const RECEIVER = componentName("receiver");
+/** Whether the installation has folder workspaces, whose instances the sandbox gateway makes: the host profile. */
+export function foldersRun(config) {
+    return config.host.enabled;
+}
+/** The template of a folder instance's pod, as the operator runs bayma on their own machine: bayma itself, as them, with the machine's mounts, under the cluster's own runtime, which its process snapshots need. */
+export function hostPodTemplate(config) {
+    const { host } = config;
+    return {
+        metadata: { labels: { "app.kubernetes.io/part-of": "alasio", "app.kubernetes.io/instance": RELEASE, "app.kubernetes.io/component": "folder-bayma" } },
+        spec: {
+            // May restart alasio, by rolling out its Deployment, as an agent restarts it; its token
+            // mounted by the template itself, where the API server would mount one, so the pod the
+            // folder pods' policy pins is the pod as made.
+            serviceAccountName: componentName("host-agent"),
+            automountServiceAccountToken: false,
+            ...priority("turn"),
+            securityContext: {
+                runAsUser: host.uid,
+                runAsGroup: host.gid,
+                // The group the bayma token's Secret volume is given, which the operator's user
+                // reads it as; the node's own paths the mounts give are left as they are.
+                fsGroup: host.gid,
+                ...given("supplementalGroups", [...host.supplementalGroups]),
+            },
+            ...imagePullSecrets(config),
+            containers: [{
+                    name: "bayma",
+                    image: imageReference(host.baymaImage),
+                    imagePullPolicy: "IfNotPresent",
+                    args: ["mcp-http", "--host", "0.0.0.0", "--port", String(FOLDER_PORT), "--default-durability", "checkpointed"],
+                    workingDir: host.home,
+                    env: [{ name: "HOME", value: host.home }, ...envOf(host.env)],
+                    ports: [{ name: "mcp", containerPort: FOLDER_PORT }],
+                    securityContext: {
+                        // What bayma needs to snapshot its REPL sessions' processes as it stops and
+                        // restore them whole as it starts again.
+                        capabilities: { add: ["CHECKPOINT_RESTORE", "SYS_PTRACE"] },
+                        seccompProfile: { type: "Unconfined" },
+                        appArmorProfile: { type: "Unconfined" },
+                    },
+                    resources: host.resources,
+                    volumeMounts: [...hostVolumeMounts(config), { name: ACCOUNT_VOLUME, mountPath: ACCOUNT_DIRECTORY, readOnly: true }],
+                }],
+            volumes: [...hostVolumes(config), accountVolume],
+        },
+    };
+}
+/** The volume of the folder instances' account's token, and where it is mounted, as the API server mounts one. */
+const ACCOUNT_VOLUME = "alasio-host-agent-token";
+const ACCOUNT_DIRECTORY = "/var/run/secrets/kubernetes.io/serviceaccount";
+const accountVolume = {
+    name: ACCOUNT_VOLUME,
+    projected: {
+        defaultMode: 0o644,
+        sources: [
+            { serviceAccountToken: { expirationSeconds: 3607, path: "token" } },
+            { configMap: { name: "kube-root-ca.crt", items: [{ key: "ca.crt", path: "ca.crt" }] } },
+            { downwardAPI: { items: [{ path: "namespace", fieldRef: { apiVersion: "v1", fieldPath: "metadata.namespace" } }] } },
+        ],
+    },
+};
+/**
+ * The folder instances' template, as the gateway's configuration carries it: the host
+ * profile's, its bayma exporting its telemetry to the session telemetry receiver, as a
+ * bound pool pod's does, with its binding's token, the signals the installation exports, in
+ * their protocols, where it exports any.
+ */
+export function folderTemplate(config) {
+    const template = hostPodTemplate(config);
+    const exported = sandboxBaymaTelemetryEnv(Object.fromEntries(otelEnv(config).map(({ name, value }) => [name, value ?? ""])));
+    if (Object.keys(exported).length === 0)
+        return template;
+    const telemetry = [
+        { name: "OTEL_EXPORTER_OTLP_ENDPOINT", value: `http://${RECEIVER}.${NAMESPACE}.svc.cluster.local:${config.telemetry.receiverPort}` },
+        ...Object.entries(exported).map(([name, value]) => ({ name, value })),
+    ];
+    return {
+        ...template,
+        spec: {
+            ...template.spec,
+            containers: (template.spec?.containers ?? []).map((container) => ({
+                ...container,
+                args: [...(container.args ?? []), "--telemetry-token-file", FOLDER_TOKEN_FILE],
+                env: [...(container.env ?? []), ...telemetry],
+            })),
+        },
+    };
+}
+/**
+ * The gateway's identity in the folder namespace: it makes and deletes the folder instances'
+ * pods, reads their status and what the metrics server says they use, and holds their
+ * bindings' Leases there, and its folders' records beside them; and makes the Secret of each
+ * one's token, which the pod then owns. A bound one no drain evicts.
+ */
+export function folderObjects(config) {
+    if (!foldersRun(config))
+        return [];
+    const scope = { namespace: config.host.namespace, maker: GATEWAY_USER };
+    return [
+        ...accountRole(GATEWAY, "sandbox-gateway", config.host.namespace, [
+            { apiGroups: [""], resources: ["pods"], verbs: ["get", "list", "watch", "create", "update", "delete"] },
+            { apiGroups: [""], resources: ["secrets"], verbs: ["create", "patch", "delete"] },
+            { apiGroups: ["coordination.k8s.io"], resources: ["leases"], verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] },
+            // What each instance's bayma uses, which its folder's next instance requests (src/gateway/folders.ts SIZING).
+            { apiGroups: ["metrics.k8s.io"], resources: ["pods"], verbs: ["list"] },
+        ]),
+        // The receiver, which takes the telemetry of folder instances' bindings, watching their Leases.
+        ...accountRole(RECEIVER, "receiver", config.host.namespace, [{ apiGroups: ["coordination.k8s.io"], resources: ["leases"], verbs: ["list", "watch"] }]),
+        // Every pod of the folder namespace held to the folder template, as Pod Security cannot, and the gateway's Secrets there to their tokens.
+        ...folderPodPolicy(folderTemplate(config), { ...scope, stateRoot: config.host.stateRoot }),
+        ...folderSecretPolicy(scope),
+        // And what it deletes there, its own instances' pods and tokens alone.
+        ...folderDeletionPolicy(scope),
+        // A bound instance holds its REPLs live until its release: no drain evicts it, as none does a bound pool pod.
+        boundBudget(config.host.namespace),
+    ];
+}
+//# sourceMappingURL=folders.js.map

package/dist/cli/src/manifests/folders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folders.js","sourceRoot":"","sources":["../../../../src/manifests/folders.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErJ,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,8JAA8J;AAC9J,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAEhC,wGAAwG;AACxG,MAAM,OAAO,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,yBAAyB,SAAS,IAAI,OAAO,EAAE,CAAC;AACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;AAE3C,mHAAmH;AACnH,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,qNAAqN;AACrN,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,OAAO;QACL,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,2BAA2B,EAAE,QAAQ,EAAE,4BAA4B,EAAE,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,EAAE;QACrJ,IAAI,EAAE;YACJ,wFAAwF;YACxF,uFAAuF;YACvF,+CAA+C;YAC/C,kBAAkB,EAAE,aAAa,CAAC,YAAY,CAAC;YAC/C,4BAA4B,EAAE,KAAK;YACnC,GAAG,QAAQ,CAAC,MAAM,CAAC;YACnB,eAAe,EAAE;gBACf,SAAS,EAAE,IAAI,CAAC,GAAG;gBACnB,UAAU,EAAE,IAAI,CAAC,GAAG;gBACpB,gFAAgF;gBAChF,0EAA0E;gBAC1E,OAAO,EAAE,IAAI,CAAC,GAAG;gBACjB,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;aAC7D;YACD,GAAG,gBAAgB,CAAC,MAAM,CAAC;YAC3B,UAAU,EAAE,CAAC;oBACX,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;oBACtC,eAAe,EAAE,cAAc;oBAC/B,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,sBAAsB,EAAE,cAAc,CAAC;oBAC9G,UAAU,EAAE,IAAI,CAAC,IAAI;oBACrB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC7D,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;oBACpD,eAAe,EAAE;wBACf,4EAA4E;wBAC5E,yCAAyC;wBACzC,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;wBAC3D,cAAc,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;wBACtC,eAAe,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;qBACxC;oBACD,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;iBACpH,CAAC;YACF,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,kHAAkH;AAClH,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAC1E,MAAM,aAAa,GAAa;IAC9B,IAAI,EAAE,cAAc;IACpB,SAAS,EAAE;QACT,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE;YACP,EAAE,mBAAmB,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;YACnE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE;YACvF,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE;SACrH;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,MAAM,SAAS,GAAG;QAChB,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,UAAU,QAAQ,IAAI,SAAS,sBAAsB,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE;QACpI,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;KACtE,CAAC;IACF,OAAO;QACL,GAAG,QAAQ;QACX,IAAI,EAAE;YACJ,GAAG,QAAQ,CAAC,IAAI;YAChB,UAAU,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAChE,GAAG,SAAS;gBACZ,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,wBAAwB,EAAE,iBAAiB,CAAC;gBAC9E,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC;aAC9C,CAAC,CAAC;SACJ;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACxE,OAAO;QACL,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;YAChE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACvG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;YACjF,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;YACrI,8GAA8G;YAC9G,EAAE,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE;SACxE,CAAC;QACF,gGAAgG;QAChG,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACtJ,0IAA0I;QAC1I,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1F,GAAG,kBAAkB,CAAC,KAAK,CAAC;QAC5B,uEAAuE;QACvE,GAAG,oBAAoB,CAAC,KAAK,CAAC;QAC9B,8GAA8G;QAC9G,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/cli/src/manifests/grafana.js

@@ -6,7 +6,7 @@ import { replicaBudget, replicated, spread } from "./disruption.js";
 import { LAKE_QUERY_PORT } from "./lake.js";
 import { PROXY_HOST, PROXY_PORT } from "./neon.js";
 import { priority } from "./priorities.js";
-import { cpuUtilization, scaledObject } from "./scalers.js";
+import { cpuScaledObject } from "./scalers.js";
 import { verticalPodAutoscaler } from "./sizing.js";
 /** Grafana's name, its Secret's, and its pods' component. */
 export const GRAFANA = componentName("grafana");
@@ -129,7 +129,9 @@ export function grafanaObjects(config) {
         service,
         ...(ha ? [peers] : []),
         deployment,
-        ...scaledObject(deployment, scaling, [cpuUtilization(80)]),
+        // Its start (its plugins loaded, its database migrated, its alert rules first evaluated)
+        // keeps its CPU above 80 % of its request for up to two minutes or so.
+        ...cpuScaledObject(deployment, scaling, { percent: 80, startUpSeconds: 180 }),
         ...replicaBudget("grafana", NAMESPACE, scaling),
         verticalPodAutoscaler(deployment, "InPlace", scaled(scaling) ? ["memory"] : undefined),
     ];

package/dist/cli/src/manifests/grafana.js.map

@@ -1 +1 @@
-{"version":3,"file":"grafana.js","sourceRoot":"","sources":["../../../../src/manifests/grafana.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,MAAM,EACN,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,aAAa,EACb,MAAM,EACN,MAAM,EACN,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAChD,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,kCAAkC;AAClC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,YAAY,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7I,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAEhC,oIAAoI;AACpI,SAAS,KAAK;IACZ,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;QAC1E,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,GAAG,OAAO,UAAU,SAAS,sBAAsB,WAAW,EAAE,EAAE;QACjH,EAAE,IAAI,EAAE,0CAA0C,EAAE,KAAK,EAAE,aAAa,WAAW,EAAE,EAAE;QACvF,EAAE,IAAI,EAAE,+CAA+C,EAAE,KAAK,EAAE,MAAM,EAAE;QACxE,8DAA8D;QAC9D,EAAE,IAAI,EAAE,0CAA0C,EAAE,KAAK,EAAE,IAAI,EAAE;KAClE,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/B,uEAAuE;IACvE,MAAM,KAAK,GAAc;QACvB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,QAAQ,EAAE;QACnD,IAAI,EAAE;YACJ,SAAS,EAAE,MAAM;YACjB,wBAAwB,EAAE,IAAI;YAC9B,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC;YACnC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAChI;KACF,CAAC;IACF,MAAM,OAAO,GAAc;QACzB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE;KACjH,CAAC;IACF,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,IAAI,EAAE;YACJ,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;YACnI,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;YACpD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;gBACvC,IAAI,EAAE;oBACJ,4BAA4B,EAAE,KAAK;oBACnC,kBAAkB,EAAE,KAAK;oBACzB,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACpB,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC;oBAC7B,eAAe,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC;oBAC1D,GAAG,gBAAgB,CAAC,MAAM,CAAC;oBAC3B,cAAc,EAAE,CAAC;4BACf,IAAI,EAAE,mBAAmB;4BACzB,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;4BAC/C,eAAe,EAAE,cAAc;4BAC/B,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,uFAAuF,CAAC,CAAC;4BAC3H,GAAG,EAAE;gCACH,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;gCACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;gCAC7C,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE;gCAC3D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE;gCACxC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;gCACvC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE,EAAE;gCACnG,iDAAiD;gCACjD,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE;6BAC3C;4BACD,eAAe,EAAE,EAAE,GAAG,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;4BAC3E,GAAG,eAAe,EAAE;yBACrB,CAAC;oBACF,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,SAAS;4BACf,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;4BAC5C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,GAAG,EAAE;gCACH,kFAAkF;gCAClF,0EAA0E;gCAC1E,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,YAAY,4BAA4B,UAAU,IAAI,UAAU,YAAY,cAAc,EAAE,EAAE;gCAC9I,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,aAAa,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,EAAE;gCACvF,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gCAC7F,EAAE,IAAI,EAAE,2BAA2B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;gCAC7G,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACvB;4BACD,oFAAoF;4BACpF,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;4BAC3C,KAAK,EAAE;gCACL,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE;gCAC7C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC1J;4BACD,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;4BACrF,qEAAqE;4BACrE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;4BACnI,eAAe,EAAE,EAAE,GAAG,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;4BAC3E,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;yBACpG,CAAC;oBACF,oGAAoG;oBACpG,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;iBAC7G;aACF;SACF;KACF,CAAC;IACF,OAAO;QACL,OAAO;QACP,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,UAAU;QACV,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,GAAG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC/C,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;KACvF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"grafana.js","sourceRoot":"","sources":["../../../../src/manifests/grafana.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,MAAM,EACN,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,aAAa,EACb,MAAM,EACN,MAAM,EACN,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAChD,6BAA6B;AAC7B,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,kCAAkC;AAClC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,YAAY,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7I,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAEhC,oIAAoI;AACpI,SAAS,KAAK;IACZ,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;QAC1E,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,GAAG,OAAO,UAAU,SAAS,sBAAsB,WAAW,EAAE,EAAE;QACjH,EAAE,IAAI,EAAE,0CAA0C,EAAE,KAAK,EAAE,aAAa,WAAW,EAAE,EAAE;QACvF,EAAE,IAAI,EAAE,+CAA+C,EAAE,KAAK,EAAE,MAAM,EAAE;QACxE,8DAA8D;QAC9D,EAAE,IAAI,EAAE,0CAA0C,EAAE,KAAK,EAAE,IAAI,EAAE;KAClE,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/B,uEAAuE;IACvE,MAAM,KAAK,GAAc;QACvB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,QAAQ,EAAE;QACnD,IAAI,EAAE;YACJ,SAAS,EAAE,MAAM;YACjB,wBAAwB,EAAE,IAAI;YAC9B,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC;YACnC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAChI;KACF,CAAC;IACF,MAAM,OAAO,GAAc;QACzB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,IAAI,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE;KACjH,CAAC;IACF,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,IAAI,EAAE;YACJ,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;YACnI,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;YACpD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;gBACvC,IAAI,EAAE;oBACJ,4BAA4B,EAAE,KAAK;oBACnC,kBAAkB,EAAE,KAAK;oBACzB,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACpB,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC;oBAC7B,eAAe,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC;oBAC1D,GAAG,gBAAgB,CAAC,MAAM,CAAC;oBAC3B,cAAc,EAAE,CAAC;4BACf,IAAI,EAAE,mBAAmB;4BACzB,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;4BAC/C,eAAe,EAAE,cAAc;4BAC/B,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,uFAAuF,CAAC,CAAC;4BAC3H,GAAG,EAAE;gCACH,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;gCACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE;gCAC7C,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE;gCAC3D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE;gCACxC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;gCACvC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE,EAAE;gCACnG,iDAAiD;gCACjD,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE;6BAC3C;4BACD,eAAe,EAAE,EAAE,GAAG,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;4BAC3E,GAAG,eAAe,EAAE;yBACrB,CAAC;oBACF,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,SAAS;4BACf,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;4BAC5C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,GAAG,EAAE;gCACH,kFAAkF;gCAClF,0EAA0E;gCAC1E,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,YAAY,4BAA4B,UAAU,IAAI,UAAU,YAAY,cAAc,EAAE,EAAE;gCAC9I,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,aAAa,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE,EAAE;gCACvF,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gCAC7F,EAAE,IAAI,EAAE,2BAA2B,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE;gCAC7G,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACvB;4BACD,oFAAoF;4BACpF,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;4BAC3C,KAAK,EAAE;gCACL,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE;gCAC7C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC1J;4BACD,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;4BACrF,qEAAqE;4BACrE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;4BACnI,eAAe,EAAE,EAAE,GAAG,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;4BAC3E,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;4BACnC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;yBACpG,CAAC;oBACF,oGAAoG;oBACpG,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;iBAC7G;aACF;SACF;KACF,CAAC;IACF,OAAO;QACL,OAAO;QACP,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,UAAU;QACV,yFAAyF;QACzF,uEAAuE;QACvE,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;QAC7E,GAAG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC/C,qBAAqB,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;KACvF,CAAC;AACJ,CAAC"}

package/dist/cli/src/manifests/harness-pools.js

@@ -0,0 +1,236 @@
+/**
+ * Conversations' harnesses' pools (src/gateway/harnesses.ts, src/harness/program.ts): each
+ * conversation's harness host, `alasio harness`, runs in a pod of its harness's pool, which the
+ * sandbox gateway binds to the conversation while it has work.
+ *
+ * - A pool of each harness in each environment's own namespace, beside its alasio (main's, or
+ *   a branch's, ./branch.ts), for its session conversations: alasio's image, restricted, as
+ *   alasio's own user, with no ServiceAccount token, its own directory on its node
+ *   (src/node-agent/names.ts ATTACH_ROOT, by `subPathExpr` of its namespace and its name) at
+ *   /attach, where its node's agent writes its binding once the gateway binds it; it serves
+ *   once it is there, and is ready only then. Its database is its environment's Neon, as the
+ *   harness host's role, its rows its conversation's alone, as its grant says
+ *   (src/harness/grant.ts); what its harness does on its own it tells the sandbox gateway, with
+ *   its binding's token, which tells it on its environment's events topic, as the pod reaches
+ *   no log; and alasio tells its lake's loader of what it commits.
+ * - A pool of each harness of main's folder conversations, where the host profile is on,
+ *   beside main's alasio: the same, run as the operator, in their home, with the machine's
+ *   mounts, as alasio's own pod is under the host profile; not in the folder namespace, whose
+ *   pods are the folder instances' alone, the operator's bayma, which the folder pods' policy
+ *   holds them to (./admission.ts folderPodPolicy), and which has none of the Secrets a host
+ *   runs on.
+ *
+ * KEDA keeps `min` free of each, and makes more, to `max`, for the binds that wait; a bound pod
+ * is out of its Deployment, which replaces it, and is evicted by no drain (./disruption.ts
+ * boundBudget). The gateway may claim, read and delete each pool's pods and hold their
+ * bindings' Leases, in each of their namespaces, and make no pod, nor write another Lease there
+ * (./admission.ts harnessPodPolicy). Every pool's pod is made of its template alone, and
+ * changes but its binding (./admission.ts harnessPoolPodPolicy): a folder conversation's as the
+ * operator, with the machine's mounts the host profile gives and no capability of its own, and
+ * nothing else; and its NetworkPolicies give it the gateway in, and what it needs out
+ * (./network-policies.ts). Its node's directory for it it reads alone: its binding, which it
+ * marks served in a directory of its own (src/harness/program.ts).
+ *
+ * What a pool's pod holds of the installation's secrets, as its harness runs on them: Claude
+ * Code's login, CLAUDE_CODE_OAUTH_TOKEN, where the installation gives one (alasio.claude), as
+ * alasio's own pod does; and, of a folder conversation's Codex, the operator's Codex
+ * configuration, copied each turn (src/codex/configuration.ts), whose config.toml may hold
+ * secrets of its own (an MCP server's token among them). Never Codex's login, which alasio
+ * alone holds and relays to it, each turn's token good for minutes (src/codex/login-relay.ts).
+ */
+import { posix } from "node:path";
+import { freeLabels } from "../../../src/binder/names.js";
+import { ALASIO_GATEWAY_URL_VARIABLE, HARNESS_CONTAINER } from "../../../src/gateway/names.js";
+import { HARNESS_NAMES } from "../../../src/harness/names.js";
+import { ATTACH_ROOT, BINDING_FILE } from "../../../src/node-agent/names.js";
+import { imageReference } from "../images.js";
+import { READY_ONCE_BOUND_ANNOTATION } from "../kube/rollout.js";
+import { componentName, envOf, given, hostVolumeMounts, hostVolumes, imagePullSecrets, labels, NAMESPACE, otelEnv, restrictedContainer, restrictedPod, } from "./common.js";
+import { durationSeconds } from "./config.js";
+import { boundBudget } from "./disruption.js";
+import { foldersRun } from "./folders.js";
+import { priority } from "./priorities.js";
+import { GATEWAY, GATEWAY_COMPONENT, GATEWAY_PORT, GATEWAY_USER } from "./sandbox-gateway.js";
+import { harnessPodPolicy, harnessPoolPodPolicy } from "./admission.js";
+import { scaledObject } from "./scalers.js";
+import { verticalPodAutoscaler } from "./sizing.js";
+/** The component of a harness pool's pods. */
+export const HARNESS_COMPONENT = "harness";
+/** The port a harness pool's pod's host serves on. */
+export const HARNESS_POD_PORT = 8080;
+/** How long a released harness pool's pod's host is given to drain: no turn after, the turn running waited for, its harness's session mirrored. */
+const DRAIN_SECONDS = 120;
+/** Each harness's pool's name, of session conversations, in each environment's namespace; and of main's folder conversations, in main's namespace beside them. */
+export const HARNESS_POOLS = { codex: "harness-codex", claude: "harness-claude" };
+export const FOLDER_HARNESS_POOLS = { codex: "harness-folder-codex", claude: "harness-folder-claude" };
+/** Where a harness pool's pod keeps what it writes as it runs (received files, its session filesystems' Codex home): alasio's own, so a session's harness directory is where alasio's would be. */
+const STATE_DIR = "/var/lib/alasio/state";
+/** Where a pool's pod's Codex has its home, of its own: no login in it, alasio's relayed to it (src/harness/given-codex-login.ts). */
+const CODEX_HOME = "/var/lib/alasio/codex";
+/** Where a session pool's pod's harnesses have their home, of their own. */
+const SESSION_HOME = "/var/lib/alasio/home";
+/**
+ * The template of the pool `pool`'s pods, of `environment`, as the module says: of its session
+ * conversations; or, `folder`, of main's folder conversations, as the operator.
+ */
+function harnessTemplate(config, environment, pool, folder) {
+    const { alasio, host, sessions } = config;
+    const home = folder ? host.home : SESSION_HOME;
+    const [uid, gid] = folder ? [host.uid, host.gid] : [alasio.runAsUser, alasio.runAsGroup];
+    const groups = folder ? [...new Set([...alasio.supplementalGroups, ...host.supplementalGroups])] : [...alasio.supplementalGroups];
+    const env = [
+        // alasio's, first, so that what the pod sets itself is its own: its homes, which the configuration may not set (config.ts), among it.
+        ...envOf(alasio.env),
+        { name: "POD_NAME", valueFrom: { fieldRef: { fieldPath: "metadata.name" } } },
+        { name: "POD_NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
+        { name: "ALASIO_HARNESS_BINDING_FILE", value: `/attach/${BINDING_FILE}` },
+        { name: "ALASIO_HARNESS_PORT", value: String(HARNESS_POD_PORT) },
+        { name: "ALASIO_STATE_DIR", value: STATE_DIR },
+        { name: "HOME", value: home },
+        // Its Codex's home, its own, which holds no login: a folder conversation's is given the operator's configuration each turn.
+        { name: "CODEX_HOME", value: CODEX_HOME },
+        { name: "ALASIO_DATABASE_URL_FILE", value: "/run/alasio/database/url" },
+        ...(environment.branch ? [{ name: "ALASIO_BRANCH", value: environment.branch }] : []),
+        // Its turns' workspaces' bayma, and its session's files, through the gateway, by what each turn gives.
+        { name: ALASIO_GATEWAY_URL_VARIABLE, value: `http://${GATEWAY}.${NAMESPACE}.svc.cluster.local:${GATEWAY_PORT}` },
+        ...(alasio.claude.existingSecret ? [{ name: "CLAUDE_CODE_OAUTH_TOKEN", valueFrom: { secretKeyRef: { name: alasio.claude.existingSecret, key: alasio.claude.key } } }] : []),
+        ...otelEnv(config, environment),
+    ];
+    const volumeMounts = [
+        // Its own directory on its node, by its namespace and its name, as pods of two namespaces may share a name, where its binding is written: its to read alone, so it fills nothing of its node's.
+        { name: "attach", mountPath: "/attach", subPathExpr: "$(POD_NAMESPACE)/$(POD_NAME)", readOnly: true },
+        { name: "state", mountPath: STATE_DIR },
+        { name: "codex", mountPath: CODEX_HOME },
+        // The operator's own Codex home, their login in it, hidden where the machine's mounts would show it.
+        ...(folder ? [...hostVolumeMounts(config), { name: "codex-hidden", mountPath: posix.join(home, ".codex"), readOnly: true }] : [{ name: "home", mountPath: home }]),
+        { name: "database", mountPath: "/run/alasio/database", readOnly: true },
+    ];
+    const volumes = [
+        { name: "attach", hostPath: { path: ATTACH_ROOT, type: "DirectoryOrCreate" } },
+        { name: "state", emptyDir: {} },
+        { name: "codex", emptyDir: {} },
+        ...(folder ? [...hostVolumes(config), { name: "codex-hidden", emptyDir: {} }] : [{ name: "home", emptyDir: {} }]),
+        { name: "database", secret: { secretName: componentName("harness-database"), items: [{ key: "url", path: "url" }] } },
+    ];
+    return {
+        metadata: { labels: { ...labels(HARNESS_COMPONENT), ...freeLabels(pool) } },
+        spec: {
+            ...priority("turn"),
+            securityContext: { ...restrictedPod(uid, gid), ...given("supplementalGroups", groups) },
+            automountServiceAccountToken: false,
+            enableServiceLinks: false,
+            ...imagePullSecrets(config),
+            // On the nodes the node agents run on, as its node's agent writes its binding beside it:
+            // the sessions' nodes. The untrusted code there runs under gVisor, in pods of its own, in
+            // its sessions' namespace, behind their deny-all, so a harness pod sits beside it, not in
+            // it; the agents themselves run there alone, as they assume gVisor's runtime and are
+            // privileged, so they are not run on alasio's nodes for it.
+            ...given("nodeSelector", { ...sessions.nodeSelector }),
+            ...given("tolerations", [...sessions.tolerations]),
+            containers: [{
+                    name: HARNESS_CONTAINER,
+                    image: imageReference(config.images.alasio),
+                    imagePullPolicy: config.images.pullPolicy,
+                    args: ["node", "/opt/alasio/src/harness/main.ts"],
+                    workingDir: home,
+                    env,
+                    ports: [{ name: "host", containerPort: HARNESS_POD_PORT }],
+                    // Ready once it serves, which it does once bound.
+                    readinessProbe: { httpGet: { path: "/healthz", port: "host" }, periodSeconds: 2 },
+                    securityContext: restrictedContainer(),
+                    resources: folder ? config.harness.folder.resources : config.harness.session.resources,
+                    volumeMounts,
+                }],
+            volumes,
+        },
+    };
+}
+/** A pool's Deployment, the ScaledObject that keeps its free pods, and its VPA. */
+function poolObjects(config, environment, pool, folder) {
+    const deployment = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        // Ready, as `alasio up` and `alasio status` say it, once its pods run: each is ready only once bound.
+        metadata: { name: pool.name, namespace: pool.namespace, labels: labels(HARNESS_COMPONENT), annotations: { [READY_ONCE_BOUND_ANNOTATION]: "true" } },
+        spec: {
+            selector: { matchLabels: { ...freeLabels(pool) } },
+            // None is ready before it is bound: the old free pods go as the new come.
+            strategy: { type: "Recreate" },
+            template: harnessTemplate(config, environment, pool, folder),
+        },
+    };
+    // As many free as binds wait for, past `min`: each is claimed by one.
+    const waiting = {
+        type: "metrics-api",
+        metadata: { url: `http://${GATEWAY}.${NAMESPACE}.svc.cluster.local:${GATEWAY_PORT}/counts/${pool.namespace}/${pool.name}`, valueLocation: "waiting", targetValue: "1" },
+    };
+    // Sized as recommended alone: a host's resources change only as a new pod is made.
+    return [deployment, ...scaledObject(deployment, config.harness.pools.scaling, [waiting]), verticalPodAutoscaler(deployment, "Recommended")];
+}
+/** What the gateway may do with a namespace's harness pools: claim, read and delete their pods, and hold their Leases; make none. */
+function gatewayRole(namespace, pools) {
+    const metadata = { name: componentName("sandbox-gateway-harnesses"), namespace, labels: labels(GATEWAY_COMPONENT) };
+    const role = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "Role",
+        metadata,
+        rules: [
+            // Its pools' pods, claimed by an update of the version read, and deleted as they are released.
+            { apiGroups: [""], resources: ["pods"], verbs: ["get", "list", "watch", "update", "delete"] },
+            { apiGroups: ["coordination.k8s.io"], resources: ["leases"], verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] },
+            { apiGroups: ["apps"], resources: ["deployments"], verbs: ["get"], resourceNames: [...pools] },
+        ],
+    };
+    const binding = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "RoleBinding",
+        metadata,
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: metadata.name },
+        subjects: [{ kind: "ServiceAccount", name: GATEWAY, namespace: NAMESPACE }],
+    };
+    return [role, binding];
+}
+/** The templates of `environment`'s harness pools, its session conversations' and, main's, its folder conversations'. */
+function harnessTemplates(config, environment) {
+    const sessions = HARNESS_NAMES.map((harness) => harnessTemplate(config, environment, { name: HARNESS_POOLS[harness], namespace: environment.namespace }, false));
+    const folders = environment.branch === null && foldersRun(config)
+        ? HARNESS_NAMES.map((harness) => harnessTemplate(config, environment, { name: FOLDER_HARNESS_POOLS[harness], namespace: environment.namespace }, true))
+        : [];
+    return [...sessions, ...folders];
+}
+/** The pools of `environment`'s session conversations, by harness, in its own namespace. */
+const harnessPoolsOf = (environment) => Object.fromEntries(HARNESS_NAMES.map((harness) => [harness, { name: HARNESS_POOLS[harness], namespace: environment.namespace }]));
+/** The harness pools of `environment`, main's or a branch environment's, in its own namespace, as the module says; and, main's, its folder conversations'. */
+export function harnessPoolObjects(config, environment) {
+    const pools = harnessPoolsOf(environment);
+    const folder = environment.branch === null && foldersRun(config);
+    const folderPools = folder ? HARNESS_NAMES.map((harness) => ({ name: FOLDER_HARNESS_POOLS[harness], namespace: environment.namespace })) : [];
+    return [
+        ...gatewayRole(environment.namespace, [...Object.values(HARNESS_POOLS), ...folderPools.map(({ name }) => name)]),
+        ...HARNESS_NAMES.flatMap((harness) => poolObjects(config, environment, pools[harness], false)),
+        ...folderPools.flatMap((pool) => poolObjects(config, environment, pool, true)),
+        boundBudget(environment.namespace),
+        // What the gateway does to the pods of every environment's namespace held to its pools' alone, as RBAC cannot:
+        // the cluster's, made with main's.
+        ...(environment.branch === null ? harnessPodPolicy(GATEWAY_USER, [...Object.values(HARNESS_POOLS), ...Object.values(FOLDER_HARNESS_POOLS)]) : []),
+        // Every pool's pod made in the environment's namespace held to its template, as this environment's
+        // configuration renders it: its folder conversations' to the operator's user, mounts and capabilities as
+        // the template has them, and no others. The environment's own, made and deleted with it.
+        ...harnessPoolPodPolicy({ namespace: environment.namespace, branch: environment.branch, templates: harnessTemplates(config, environment) }),
+    ];
+}
+/** What the gateway's configuration says of the harnesses' pools (src/gateway/names.ts GatewayConfig). */
+export function harnessesConfig(config) {
+    const { alasio, host } = config;
+    return {
+        namespace: NAMESPACE,
+        pools: { ...HARNESS_POOLS },
+        podPort: HARNESS_POD_PORT,
+        owner: { uid: alasio.runAsUser, gid: alasio.runAsGroup },
+        // A duration, as the configuration checks it.
+        releaseAfterSeconds: durationSeconds(config.harness.pools.releaseAfter) ?? 0,
+        drainSeconds: DRAIN_SECONDS,
+        folders: foldersRun(config) ? { pools: { ...FOLDER_HARNESS_POOLS }, owner: { uid: host.uid, gid: host.gid } } : null,
+    };
+}
+//# sourceMappingURL=harness-pools.js.map

package/dist/cli/src/manifests/harness-pools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-pools.js","sourceRoot":"","sources":["../../../../src/manifests/harness-pools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,UAAU,EAAa,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAsB,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACnH,OAAO,EAAE,aAAa,EAAoB,MAAM,+BAA+B,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,KAAK,EAEL,KAAK,EACL,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,MAAM,EACN,SAAS,EACT,OAAO,EACP,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAC3C,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,mJAAmJ;AACnJ,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,kKAAkK;AAClK,MAAM,CAAC,MAAM,aAAa,GAA0C,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AACzH,MAAM,CAAC,MAAM,oBAAoB,GAA0C,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;AAE9I,mMAAmM;AACnM,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,sIAAsI;AACtI,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,4EAA4E;AAC5E,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAG5C;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAqB,EAAE,WAAwB,EAAE,IAAU,EAAE,MAAe;IACnG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAClI,MAAM,GAAG,GAAe;QACtB,sIAAsI;QACtI,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;QACpB,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE;QAC7E,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAAE,EAAE;QACvF,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,WAAW,YAAY,EAAE,EAAE;QACzE,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE;QAChE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE;QAC9C,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;QAC7B,4HAA4H;QAC5H,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE;QACzC,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,0BAA0B,EAAE;QACvE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,uGAAuG;QACvG,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,UAAU,OAAO,IAAI,SAAS,sBAAsB,YAAY,EAAE,EAAE;QAChH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3K,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC;KAChC,CAAC;IACF,MAAM,YAAY,GAAoB;QACpC,gMAAgM;QAChM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE;QACrG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;QACvC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE;QACxC,qGAAqG;QACrG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE;KACxE,CAAC;IACF,MAAM,OAAO,GAAe;QAC1B,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE;QAC9E,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC/B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACjH,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;KACtH,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;QAC3E,IAAI,EAAE;YACJ,GAAG,QAAQ,CAAC,MAAM,CAAC;YACnB,eAAe,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;YACvF,4BAA4B,EAAE,KAAK;YACnC,kBAAkB,EAAE,KAAK;YACzB,GAAG,gBAAgB,CAAC,MAAM,CAAC;YAC3B,yFAAyF;YACzF,0FAA0F;YAC1F,0FAA0F;YAC1F,qFAAqF;YACrF,4DAA4D;YAC5D,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;YACtD,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClD,UAAU,EAAE,CAAC;oBACX,IAAI,EAAE,iBAAiB;oBACvB,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC3C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;oBACzC,IAAI,EAAE,CAAC,MAAM,EAAE,iCAAiC,CAAC;oBACjD,UAAU,EAAE,IAAI;oBAChB,GAAG;oBACH,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;oBAC1D,kDAAkD;oBAClD,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;oBACjF,eAAe,EAAE,mBAAmB,EAAE;oBACtC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;oBACtF,YAAY;iBACb,CAAC;YACF,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,MAAqB,EAAE,WAAwB,EAAE,IAAU,EAAE,MAAe;IAC/F,MAAM,UAAU,GAAiB;QAC/B,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,sGAAsG;QACtG,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,EAAE;QACnJ,IAAI,EAAE;YACJ,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE;YAClD,0EAA0E;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;YAC9B,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC;SAC7D;KACF,CAAC;IACF,sEAAsE;IACtE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,OAAO,IAAI,SAAS,sBAAsB,YAAY,WAAW,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE;KACxK,CAAC;IACF,mFAAmF;IACnF,OAAO,CAAC,UAAU,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,qBAAqB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9I,CAAC;AAED,qIAAqI;AACrI,SAAS,WAAW,CAAC,SAAiB,EAAE,KAAwB;IAC9D,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,2BAA2B,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACpH,MAAM,IAAI,GAAW;QACnB,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,MAAM;QACZ,QAAQ;QACR,KAAK,EAAE;YACL,+FAA+F;YAC/F,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YAC7F,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;YACrI,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE;SAC/F;KACF,CAAC;IACF,MAAM,OAAO,GAAkB;QAC7B,UAAU,EAAE,8BAA8B;QAC1C,IAAI,EAAE,aAAa;QACnB,QAAQ;QACR,OAAO,EAAE,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;QACrF,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;KAC5E,CAAC;IACF,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,yHAAyH;AACzH,SAAS,gBAAgB,CAAC,MAAqB,EAAE,WAAwB;IACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACjK,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC;QAC/D,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;QACvJ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,4FAA4F;AAC5F,MAAM,cAAc,GAAG,CAAC,WAAwB,EAA6B,EAAE,CAC7E,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAA8B,CAAC;AAEjK,8JAA8J;AAC9J,MAAM,UAAU,kBAAkB,CAAC,MAAqB,EAAE,WAAwB;IAChF,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9I,OAAO;QACL,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAChH,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9F,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9E,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC;QAClC,+GAA+G;QAC/G,mCAAmC;QACnC,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,mGAAmG;QACnG,yGAAyG;QACzG,yFAAyF;QACzF,GAAG,oBAAoB,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;KAC5I,CAAC;AACJ,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAChC,OAAO;QACL,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,EAAE,GAAG,aAAa,EAAE;QAC3B,OAAO,EAAE,gBAAgB;QACzB,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;QACxD,8CAA8C;QAC9C,mBAAmB,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;QAC5E,YAAY,EAAE,aAAa;QAC3B,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;KACrH,CAAC;AACJ,CAAC"}

package/dist/cli/src/manifests/image-holder.js

@@ -0,0 +1,61 @@
+import { imageReference } from "../images.js";
+import { componentName, given, imagePullSecrets, labels, lakeRuns, NAMESPACE, restrictedContainer, restrictedPod, selectorLabels } from "./common.js";
+import { priority } from "./priorities.js";
+/** The holder's component of alasio's image. */
+export const IMAGE_HOLDER_COMPONENT = "image";
+/** The holder's component of the lake's image. */
+export const LAKE_IMAGE_HOLDER_COMPONENT = "lake-image";
+/**
+ * What a holder runs where its image's entrypoint is no tini, as the lake's, node's image's, is
+ * not: a shell, PID 1, which the kernel sends no signal it has no handler for, so one that
+ * waits on nothing but a SIGTERM, which it traps and ends on, as its pod is stopped.
+ */
+export const UNTIL_TERM = ["sh", "-c", "trap 'exit 0' TERM; while :; do sleep 86400 & wait $!; done"];
+/** The DaemonSet that holds `held`'s image on its workload's nodes, as the module says. */
+function holder(config, { component, image, args, runAsUser, runAsGroup, nodeSelector, tolerations, affinity }) {
+    return {
+        apiVersion: "apps/v1",
+        kind: "DaemonSet",
+        metadata: { name: componentName(component), namespace: NAMESPACE, labels: labels(component) },
+        spec: {
+            selector: { matchLabels: selectorLabels(component) },
+            // Every node's at once, as an upgrade's image is pulled on each before a wake asks for it there, and the holder serves nothing.
+            updateStrategy: { type: "RollingUpdate", rollingUpdate: { maxUnavailable: "100%", maxSurge: 0 } },
+            template: {
+                metadata: { labels: labels(component) },
+                spec: {
+                    ...priority("component"),
+                    automountServiceAccountToken: false,
+                    enableServiceLinks: false,
+                    terminationGracePeriodSeconds: 1,
+                    securityContext: restrictedPod(runAsUser, runAsGroup),
+                    ...imagePullSecrets(config),
+                    containers: [{
+                            name: "image",
+                            image: imageReference(image),
+                            imagePullPolicy: config.images.pullPolicy,
+                            // Its arguments, not its command, so it runs under the image's entrypoint, which it ends with as its pod is
+                            // stopped: alasio's, tini, passing the SIGTERM on to it; another's, its own (UNTIL_TERM).
+                            args: [...args],
+                            securityContext: { ...restrictedContainer(), readOnlyRootFilesystem: true },
+                            resources: { requests: { cpu: "1m", memory: "8Mi" }, limits: { memory: "16Mi" } },
+                        }],
+                    ...given("nodeSelector", { ...nodeSelector }),
+                    ...given("tolerations", [...tolerations]),
+                    // Of its workload's affinity, what says which nodes: its pods' affinities place none of a DaemonSet's.
+                    ...given("affinity", affinity?.nodeAffinity ? { nodeAffinity: affinity.nodeAffinity } : {}),
+                },
+            },
+        },
+    };
+}
+/** The objects that hold alasio's images that wake from none on their workloads' nodes, as the module says: alasio's, and the lake's where it runs. */
+export function imageHolderObjects(config) {
+    const { alasio, neon } = config;
+    return [
+        holder(config, { component: IMAGE_HOLDER_COMPONENT, image: config.images.alasio, args: ["sleep", "infinity"], runAsUser: alasio.runAsUser, runAsGroup: alasio.runAsGroup, nodeSelector: alasio.nodeSelector, tolerations: alasio.tolerations, affinity: alasio.affinity }),
+        // The lake's on the stack's nodes, as its loader and intake are placed (./common.ts stackPodSpec).
+        ...(lakeRuns(config) ? [holder(config, { component: LAKE_IMAGE_HOLDER_COMPONENT, image: config.images.lake, args: UNTIL_TERM, runAsUser: neon.runAsUser, runAsGroup: neon.runAsGroup, nodeSelector: neon.nodeSelector, tolerations: neon.tolerations })] : []),
+    ];
+}
+//# sourceMappingURL=image-holder.js.map

package/dist/cli/src/manifests/image-holder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-holder.js","sourceRoot":"","sources":["../../../../src/manifests/image-holder.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAiB,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEtJ,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAC9C,kDAAkD;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,6DAA6D,CAAU,CAAC;AAc/G,2FAA2F;AAC3F,SAAS,MAAM,CAAC,MAAqB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAQ;IACjI,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAC7F,IAAI,EAAE;YACJ,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;YACpD,gIAAgI;YAChI,cAAc,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE;YACjG,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;gBACvC,IAAI,EAAE;oBACJ,GAAG,QAAQ,CAAC,WAAW,CAAC;oBACxB,4BAA4B,EAAE,KAAK;oBACnC,kBAAkB,EAAE,KAAK;oBACzB,6BAA6B,EAAE,CAAC;oBAChC,eAAe,EAAE,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC;oBACrD,GAAG,gBAAgB,CAAC,MAAM,CAAC;oBAC3B,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;4BAC5B,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,4GAA4G;4BAC5G,0FAA0F;4BAC1F,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;4BACf,eAAe,EAAE,EAAE,GAAG,mBAAmB,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;4BAC3E,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;yBAClF,CAAC;oBACF,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,EAAE,CAAC;oBAC7C,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;oBACzC,uGAAuG;oBACvG,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5F;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,uJAAuJ;AACvJ,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAChC,OAAO;QACL,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1Q,mGAAmG;QACnG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/P,CAAC;AACJ,CAAC"}