alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/EKS/Addon.ts

@@ -2,6 +2,7 @@ import * as eks from "@distilled.cloud/aws/eks";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
 import type { Input } from "../../Input.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
@@ -179,72 +180,76 @@ export const AddonProvider = () =>
             return { action: "replace" } as const;
           }
         }),
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readAddon({
+        read: Effect.fn(function* ({ id, olds }) {
+          const state = yield* readAddon({
             clusterName: olds.clusterName as string,
             addonName: olds.addonName,
           });
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, session }) {
-          const tags = {
+        reconcile: Effect.fn(function* ({ id, news, session }) {
+          const clusterName = news.clusterName as string;
+          const addonName = news.addonName;
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
 
-          yield* eks
-            .createAddon({
-              clusterName: news.clusterName as string,
-              addonName: news.addonName,
-              addonVersion: news.addonVersion,
-              serviceAccountRoleArn: news.serviceAccountRoleArn as
-                | string
-                | undefined,
-              resolveConflicts: news.resolveConflicts,
-              configurationValues: news.configurationValues,
-              podIdentityAssociations: news.podIdentityAssociations,
-              namespaceConfig: news.namespaceConfig,
-              tags,
-              clientRequestToken: yield* toClientRequestToken(id, "create"),
-            })
-            .pipe(
-              Effect.catchTag("ResourceInUseException", () =>
-                readAddon({
-                  clusterName: news.clusterName as string,
-                  addonName: news.addonName,
-                }).pipe(
-                  Effect.flatMap((existing) =>
-                    existing && hasAlchemyTags(id, existing.tags)
-                      ? Effect.succeed(existing)
-                      : Effect.fail(
-                          new Error(
-                            `Addon '${news.clusterName as string}/${news.addonName}' already exists and is not managed by alchemy`,
-                          ),
-                        ),
-                  ),
-                  Effect.asVoid,
-                ),
-              ),
-            );
-
-          const addon = yield* waitForAddonActive({
-            clusterName: news.clusterName as string,
-            addonName: news.addonName,
+          // Observe — fetch live cloud state by (clusterName, addonName).
+          let state = yield* readAddon({
+            clusterName,
+            addonName,
           });
-          yield* session.note(addon.addonArn);
-          return addon;
-        }),
-        update: Effect.fn(function* ({ id, olds, news, output, session }) {
+
+          // Ensure — create if missing. Tolerate `ResourceInUseException`
+          // as a race with a peer reconciler: re-read and continue with
+          // sync.
+          if (!state) {
+            yield* eks
+              .createAddon({
+                clusterName,
+                addonName,
+                addonVersion: news.addonVersion,
+                serviceAccountRoleArn: news.serviceAccountRoleArn as
+                  | string
+                  | undefined,
+                resolveConflicts: news.resolveConflicts,
+                configurationValues: news.configurationValues,
+                podIdentityAssociations: news.podIdentityAssociations,
+                namespaceConfig: news.namespaceConfig,
+                tags: desiredTags,
+                clientRequestToken: yield* toClientRequestToken(id, "create"),
+              })
+              .pipe(
+                Effect.catchTag("ResourceInUseException", () => Effect.void),
+              );
+
+            state = yield* waitForAddonActive({
+              clusterName,
+              addonName,
+            });
+          }
+
+          // Sync addon version / config — diff observed against desired.
+          // updateAddon handles version, role, resolve conflicts, config
+          // values, and pod identity associations atomically.
+          const podIdentityChanged =
+            JSON.stringify(state.podIdentityAssociations ?? []) !==
+            JSON.stringify(news.podIdentityAssociations ?? []);
           if (
-            olds.addonVersion !== news.addonVersion ||
-            olds.serviceAccountRoleArn !== news.serviceAccountRoleArn ||
-            olds.resolveConflicts !== news.resolveConflicts ||
-            olds.configurationValues !== news.configurationValues ||
-            JSON.stringify(olds.podIdentityAssociations ?? []) !==
-              JSON.stringify(news.podIdentityAssociations ?? [])
+            (news.addonVersion !== undefined &&
+              state.addonVersion !== news.addonVersion) ||
+            state.serviceAccountRoleArn !==
+              (news.serviceAccountRoleArn as string | undefined) ||
+            state.configurationValues !== news.configurationValues ||
+            podIdentityChanged
           ) {
             yield* eks.updateAddon({
-              clusterName: output.clusterName,
-              addonName: output.addonName,
+              clusterName,
+              addonName,
               addonVersion: news.addonVersion,
               serviceAccountRoleArn: news.serviceAccountRoleArn as
                 | string
@@ -254,40 +259,31 @@ export const AddonProvider = () =>
               podIdentityAssociations: news.podIdentityAssociations,
               clientRequestToken: yield* toClientRequestToken(id, "update"),
             });
+            state = yield* waitForAddonActive({
+              clusterName,
+              addonName,
+            });
           }
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
-
+          // Sync tags — diff observed cloud tags against desired.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
           if (upsert.length > 0) {
             yield* eks.tagResource({
-              resourceArn: output.addonArn,
+              resourceArn: state.addonArn,
               tags: Object.fromEntries(
                 upsert.map((tag) => [tag.Key, tag.Value] as const),
               ),
             });
           }
-
           if (removed.length > 0) {
             yield* eks.untagResource({
-              resourceArn: output.addonArn,
+              resourceArn: state.addonArn,
               tagKeys: removed,
             });
           }
 
-          const addon = yield* waitForAddonActive({
-            clusterName: output.clusterName,
-            addonName: output.addonName,
-          });
-          yield* session.note(output.addonArn);
-          return addon;
+          yield* session.note(state.addonArn);
+          return state;
         }),
         delete: Effect.fn(function* ({ olds, output }) {
           yield* eks

package/src/AWS/EKS/Cluster.ts

@@ -2,6 +2,7 @@ import * as eks from "@distilled.cloud/aws/eks";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
+import { Unowned } from "../../AdoptPolicy.ts";
 import { isResolved } from "../../Diff.ts";
 import {
   deleteObjects,
@@ -312,28 +313,6 @@ export const ClusterProvider = () =>
         return mapClusterState(cluster, tags, kubernetesObjects ?? []);
       });
 
-      const resolveOwnedCluster = Effect.fn(function* (
-        id: string,
-        clusterName: string,
-      ) {
-        const state = yield* readCluster({
-          clusterName,
-        });
-        if (!state) {
-          return yield* Effect.fail(
-            new Error(`cluster '${clusterName}' exists but could not be read`),
-          );
-        }
-        if (!(yield* hasAlchemyTags(id, state.tags))) {
-          return yield* Effect.fail(
-            new Error(
-              `cluster '${clusterName}' already exists and is not managed by alchemy`,
-            ),
-          );
-        }
-        return state;
-      });
-
       const waitForClusterActive = (
         clusterName: string,
         kubernetesObjects: KubernetesObjectRef[] = [],
@@ -456,68 +435,88 @@ export const ClusterProvider = () =>
         read: Effect.fn(function* ({ id, olds, output }) {
           const clusterName =
             output?.clusterName ?? (yield* toClusterName(id, olds ?? {}));
-          return yield* readCluster({
+          const state = yield* readCluster({
             clusterName,
             kubernetesObjects: output?.kubernetesObjects,
           });
+          if (!state) return undefined;
+          return (yield* hasAlchemyTags(id, state.tags))
+            ? state
+            : Unowned(state);
         }),
-        create: Effect.fn(function* ({ id, news, bindings, session }) {
+        reconcile: Effect.fn(function* ({
+          id,
+          news,
+          output,
+          bindings,
+          session,
+        }) {
           yield* validateProps(news);
 
           const clusterName = yield* toClusterName(id, news);
           const desiredObjects = getDesiredKubernetesObjects(bindings);
-          const tags = {
+          const desiredTags = {
             ...(yield* createInternalTags(id)),
             ...news.tags,
           };
 
-          yield* eks
-            .createCluster({
-              name: clusterName,
-              version: news.version,
-              roleArn: news.roleArn,
-              resourcesVpcConfig: news.resourcesVpcConfig,
-              kubernetesNetworkConfig: news.kubernetesNetworkConfig,
-              logging: news.logging,
-              accessConfig: news.accessConfig,
-              computeConfig: news.computeConfig,
-              storageConfig: news.storageConfig,
-              deletionProtection: news.deletionProtection,
-              upgradePolicy: news.upgradePolicy,
-              tags,
-              clientRequestToken: yield* toClientRequestToken(id, "create"),
-            })
-            .pipe(
-              Effect.catchTag("ResourceInUseException", () =>
-                resolveOwnedCluster(id, clusterName).pipe(Effect.asVoid),
-              ),
-            );
-
-          yield* session.note(`Creating EKS cluster ${clusterName}...`);
-          const cluster = yield* waitForClusterActive(clusterName);
-          const kubernetesObjects = yield* reconcileObjects({
-            connection: getKubernetesConnection(cluster),
-            previousObjects: [],
-            desiredObjects,
+          // Observe — fetch live cloud state. We always fetch fresh so
+          // adoption, drift, and partial-prior-runs all converge.
+          let state = yield* readCluster({
+            clusterName,
+            kubernetesObjects: output?.kubernetesObjects,
           });
-          return {
-            ...cluster,
-            kubernetesObjects,
-          };
-        }),
-        update: Effect.fn(function* ({
-          id,
-          news,
-          olds,
-          output,
-          bindings,
-          session,
-        }) {
-          yield* validateProps(news);
 
-          if (clusterConfigChanged(olds, news)) {
+          // Ensure — create cluster if missing. Tolerate
+          // `ResourceInUseException` as a race with a peer reconciler:
+          // re-read and continue with the sync path. The control plane
+          // takes 10+ minutes; we wait for ACTIVE before any sync work.
+          if (!state) {
+            yield* eks
+              .createCluster({
+                name: clusterName,
+                version: news.version,
+                roleArn: news.roleArn,
+                resourcesVpcConfig: news.resourcesVpcConfig,
+                kubernetesNetworkConfig: news.kubernetesNetworkConfig,
+                logging: news.logging,
+                accessConfig: news.accessConfig,
+                computeConfig: news.computeConfig,
+                storageConfig: news.storageConfig,
+                deletionProtection: news.deletionProtection,
+                upgradePolicy: news.upgradePolicy,
+                tags: desiredTags,
+                clientRequestToken: yield* toClientRequestToken(id, "create"),
+              })
+              .pipe(
+                Effect.catchTag("ResourceInUseException", () => Effect.void),
+              );
+
+            yield* session.note(`Creating EKS cluster ${clusterName}...`);
+            state = yield* waitForClusterActive(clusterName);
+          }
+
+          const clusterArn = state.clusterArn;
+
+          // Sync cluster config — diff observed against desired. Each
+          // mutable aspect (vpc, logging, access mode, compute, storage,
+          // upgrade policy, deletion protection) lives behind a single
+          // updateClusterConfig call. We synthesize a `ClusterProps`
+          // shape from observed attributes for the existing diff helper.
+          const observedAsProps: ClusterProps = {
+            roleArn: state.roleArn,
+            resourcesVpcConfig: state.resourcesVpcConfig,
+            accessConfig: state.accessConfig,
+            computeConfig: state.computeConfig,
+            storageConfig: state.storageConfig,
+            kubernetesNetworkConfig: state.kubernetesNetworkConfig,
+            logging: state.logging,
+            upgradePolicy: state.upgradePolicy,
+            deletionProtection: state.deletionProtection,
+          };
+          if (clusterConfigChanged(observedAsProps, news)) {
             const configUpdate = yield* eks.updateClusterConfig({
-              name: output.clusterName,
+              name: clusterName,
               resourcesVpcConfig: news.resourcesVpcConfig,
               logging: news.logging,
               accessConfig: news.accessConfig
@@ -534,47 +533,42 @@ export const ClusterProvider = () =>
             });
             if (configUpdate.update?.id) {
               yield* session.note(
-                `Updating EKS cluster config ${output.clusterName}...`,
-              );
-              yield* waitForUpdate(output.clusterName, configUpdate.update.id);
-              yield* waitForClusterActive(
-                output.clusterName,
-                output.kubernetesObjects ?? [],
+                `Updating EKS cluster config ${clusterName}...`,
               );
+              yield* waitForUpdate(clusterName, configUpdate.update.id);
+              state =
+                (yield* waitForClusterActive(
+                  clusterName,
+                  output?.kubernetesObjects ?? [],
+                )) ?? state;
             }
           }
 
-          if (olds.version !== news.version && news.version) {
+          // Sync version — observed ↔ desired.
+          if (news.version && state.version !== news.version) {
             const versionUpdate = yield* eks.updateClusterVersion({
-              name: output.clusterName,
+              name: clusterName,
               version: news.version,
               clientRequestToken: yield* toClientRequestToken(id, "version"),
             });
             if (versionUpdate.update?.id) {
               yield* session.note(
-                `Updating EKS cluster version ${output.clusterName}...`,
-              );
-              yield* waitForUpdate(output.clusterName, versionUpdate.update.id);
-              yield* waitForClusterActive(
-                output.clusterName,
-                output.kubernetesObjects ?? [],
+                `Updating EKS cluster version ${clusterName}...`,
               );
+              yield* waitForUpdate(clusterName, versionUpdate.update.id);
+              state =
+                (yield* waitForClusterActive(
+                  clusterName,
+                  output?.kubernetesObjects ?? [],
+                )) ?? state;
             }
           }
 
-          const oldTags = {
-            ...(yield* createInternalTags(id)),
-            ...olds.tags,
-          };
-          const newTags = {
-            ...(yield* createInternalTags(id)),
-            ...news.tags,
-          };
-          const { removed, upsert } = diffTags(oldTags, newTags);
-
+          // Sync tags — diff observed cloud tags against desired.
+          const { removed, upsert } = diffTags(state.tags, desiredTags);
           if (upsert.length > 0) {
             yield* eks.tagResource({
-              resourceArn: output.clusterArn,
+              resourceArn: clusterArn,
               tags: Object.fromEntries(
                 upsert.map((tag) => [tag.Key, tag.Value] as const),
               ),
@@ -582,36 +576,35 @@ export const ClusterProvider = () =>
           }
           if (removed.length > 0) {
             yield* eks.untagResource({
-              resourceArn: output.clusterArn,
+              resourceArn: clusterArn,
               tagKeys: removed,
             });
           }
 
-          yield* session.note(output.clusterArn);
+          yield* session.note(clusterArn);
 
-          const state = yield* readCluster({
-            clusterName: output.clusterName,
-            kubernetesObjects: output.kubernetesObjects ?? [],
-          }).pipe(
-            Effect.flatMap((state) =>
-              state
-                ? Effect.succeed(state)
-                : Effect.fail(
-                    new Error(
-                      `EKS cluster '${output.clusterName}' could not be read after update`,
-                    ),
-                  ),
-            ),
-          );
+          // Re-read final state so returned attributes reflect the post-
+          // sync cloud state.
+          const final = yield* readCluster({
+            clusterName,
+            kubernetesObjects: output?.kubernetesObjects ?? [],
+          });
+          if (!final) {
+            return yield* Effect.fail(
+              new Error(
+                `EKS cluster '${clusterName}' could not be read after reconcile`,
+              ),
+            );
+          }
 
           const kubernetesObjects = yield* reconcileObjects({
-            connection: getKubernetesConnection(state),
-            previousObjects: output.kubernetesObjects ?? [],
-            desiredObjects: getDesiredKubernetesObjects(bindings),
+            connection: getKubernetesConnection(final),
+            previousObjects: output?.kubernetesObjects ?? [],
+            desiredObjects,
           });
 
           return {
-            ...state,
+            ...final,
             kubernetesObjects,
           };
         }),