hammerkit 1.25.0 → 1.27.0-next.1

package/dist/kubernetes/job-placement.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getContainerSecurity = exports.getRunLabels = exports.getRunLabelValue = exports.RUN_LABEL = exports.getPodPlacement = exports.placeOnPool = exports.getNodeArch = exports.runInToolImage = exports.getLocalTaskPool = void 0;
+const crypto_1 = require("crypto");
+/**
+ * The pool a local task runs on: the first that offers its platform. A pool says
+ * `linux` with `amd64` or `arm64`, so a task that names another platform has none.
+ */
+function getLocalTaskPool(server, name, platform) {
+    if (platform?.os === 'macos' || platform?.os === 'win') {
+        throw new Error(`task ${name}: runs on ${platform.os === 'win' ? 'Windows' : 'macOS'}, this server runs tasks on Linux nodes`);
+    }
+    if (platform?.arch === 'arm') {
+        throw new Error(`task ${name}: runs on arm, the pools of this server offer amd64 and arm64`);
+    }
+    const pools = server.pools.filter((pool) => !platform?.arch || pool.platform.arch === platform.arch);
+    const pool = pools.find((candidate) => candidate.toolImage);
+    if (!pool) {
+        throw new Error(`task ${name}: a local task runs in the toolImage of a pool, and no pool${platform?.arch ? ` for ${platform.arch}` : ''} of this server has one`);
+    }
+    return pool;
+}
+exports.getLocalTaskPool = getLocalTaskPool;
+/**
+ * A local task on a cluster: a container of the pool's tool image, which runs its
+ * commands in the same directories as a container task would.
+ */
+function runInToolImage(task, server, platform) {
+    const pool = getLocalTaskPool(server, task.name, platform);
+    return {
+        ...task,
+        type: 'container-task',
+        image: pool.toolImage,
+        user: null,
+        mounts: [],
+        volumeSize: null,
+        pool: pool.name,
+        arch: getNodeArch(pool),
+    };
+}
+exports.runInToolImage = runInToolImage;
+// The architecture of a pool's nodes as process.arch names it, so a cache entry made on
+// amd64 nodes is never restored on arm64 ones
+function getNodeArch(pool) {
+    return pool.platform.arch === 'amd64' ? 'x64' : pool.platform.arch;
+}
+exports.getNodeArch = getNodeArch;
+// A task on a server's cluster: a container task runs on the first pool
+function placeOnPool(task, server) {
+    return task.arch ? task : { ...task, arch: getNodeArch(server.pools[0]) };
+}
+exports.placeOnPool = placeOnPool;
+// Where the pod of a task goes: its pool's nodes, the first pool unless a local task
+// chose another.
+function getPodPlacement(server, pool) {
+    const chosen = server.pools.find((candidate) => candidate.name === pool) ?? server.pools[0];
+    return {
+        nodeSelector: {
+            'kubernetes.io/os': chosen.platform.os,
+            'kubernetes.io/arch': chosen.platform.arch,
+            ...chosen.nodeSelector,
+        },
+        tolerations: chosen.tolerations,
+    };
+}
+exports.getPodPlacement = getPodPlacement;
+// On a server everything made for a run carries its id, so the server removes all of
+// it when the run ends, and a NetworkPolicy can select the pods of a run.
+exports.RUN_LABEL = 'hammerkit.dev/run';
+/**
+ * The value of the run label. A run id is base64url and may end in `-` or `_`, which a
+ * label value can't, so the label carries a hex digest of it.
+ */
+function getRunLabelValue(run) {
+    return (0, crypto_1.createHash)('sha256').update(run).digest('hex').slice(0, 40);
+}
+exports.getRunLabelValue = getRunLabelValue;
+function getRunLabels(kubernetes) {
+    return kubernetes.server ? { [exports.RUN_LABEL]: getRunLabelValue(kubernetes.server.run) } : {};
+}
+exports.getRunLabels = getRunLabels;
+/**
+ * What a container of a run may do on a server, where it shares nodes with the pods of
+ * other callers: no privilege escalation (setuid binaries such as sudo), no raw sockets
+ * (spoofing on a bridge network) and the runtime's seccomp profile.
+ */
+function getContainerSecurity(kubernetes) {
+    return kubernetes.server
+        ? {
+            securityContext: {
+                allowPrivilegeEscalation: false,
+                capabilities: { drop: ['NET_RAW'] },
+                seccompProfile: { type: 'RuntimeDefault' },
+            },
+        }
+        : {};
+}
+exports.getContainerSecurity = getContainerSecurity;
+//# sourceMappingURL=job-placement.js.map

package/dist/kubernetes/job-secrets.js

@@ -0,0 +1,306 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getJobSecretSpec = exports.removeJobCredentials = exports.assertJobAccounts = exports.ensureJobCredentials = exports.getCredentialsName = exports.assertSecretsReachable = exports.splitJobSecrets = exports.ACCOUNT_PATH = exports.SECRET_VALUES_PATH = void 0;
+const work_secret_1 = require("../planner/work-secret");
+const command_secret_provider_1 = require("../secrets/command-secret-provider");
+const version_1 = require("../version");
+const apply_1 = require("./apply");
+const resources_1 = require("./resources");
+const job_placement_1 = require("./job-placement");
+const work_network_1 = require("../planner/work-network");
+// Where the values are in the pod (an in-memory volume), and where the init container
+// of a secret finds the credential of its account
+exports.SECRET_VALUES_PATH = '/var/run/hammerkit/secrets';
+exports.ACCOUNT_PATH = '/var/run/hammerkit/account';
+const VALUES_VOLUME = 'hammerkit-secret-values';
+// a token is made for each Job right before it is created; it has to outlast the
+// time its pod waits for a node
+const TOKEN_SECONDS = 3600;
+/**
+ * Which secrets of a task the Job reads itself. On a server's cluster the secrets of
+ * a provider are read in the Job, by an init container per secret with only its
+ * account's credential, so the server holds no secret manager credential and sees no
+ * value. The others (`env:`, the server's own variables) are handed over in a Secret
+ * of the task, as without a server.
+ */
+function splitJobSecrets(secrets, server) {
+    if (!server) {
+        return { delivered: secrets, inJob: [] };
+    }
+    const delivered = [];
+    const inJob = [];
+    for (const secret of secrets) {
+        if (secret.source.type === 'provider') {
+            inJob.push({ index: inJob.length, secret, source: secret.source });
+        }
+        else {
+            delivered.push(secret);
+        }
+    }
+    return { delivered, inJob };
+}
+exports.splitJobSecrets = splitJobSecrets;
+/**
+ * The init containers that read secrets share the pod, and so the NetworkPolicy, of
+ * the task: under a limited network they could not reach the secret manager. Until
+ * they run in a pod of their own, a task that reads a provider's secret in its Job
+ * keeps an open network.
+ */
+function assertSecretsReachable(task, secrets, network = (0, work_network_1.getEffectiveNetwork)(task.data)) {
+    if (secrets.length === 0 || network.type === 'open') {
+        return;
+    }
+    const secret = secrets[0];
+    throw new Error(`task ${task.name}: secret ${(0, work_secret_1.getSecretName)(secret.secret)} is read from ${(0, work_secret_1.describeSecretSource)(secret.secret)} in the Job of the task, which network ${(0, work_network_1.formatNetwork)(network)} would cut off from it; ` +
+        'on this cluster a task that reads secrets of a provider keeps an open network');
+}
+exports.assertSecretsReachable = assertSecretsReachable;
+// The accounts of the secrets, in the order they are first read
+function accountsOf(secrets) {
+    return [...new Set(secrets.map((s) => s.source.account))];
+}
+function getCredentialsName(item) {
+    return (0, resources_1.getResourceName)(item, '-credentials');
+}
+exports.getCredentialsName = getCredentialsName;
+// The keys of the credentials Secret: `<account>.token` and `<account>.file.<key>`
+function tokenKey(account) {
+    return `${account}.token`;
+}
+function fileKey(account, key) {
+    return `${account}.file.${key}`;
+}
+/**
+ * The credentials the init containers need, in a Secret of the task that only they
+ * mount: per account, a short-lived token of its ServiceAccount and the files of its
+ * Secret, both from the server's namespace. Removed with the task's other Secret.
+ */
+async function ensureJobCredentials(instance, kubernetes, item, secrets, admitted) {
+    const server = kubernetes.server;
+    const files = {};
+    if (!server || secrets.length === 0) {
+        return files;
+    }
+    assertJobAccounts(secrets, server, admitted);
+    const data = {};
+    for (const account of accountsOf(secrets)) {
+        const credentials = server.accounts[account];
+        files[account] = [];
+        if (credentials.serviceAccount) {
+            const response = await instance.coreApi.createNamespacedServiceAccountToken({
+                name: credentials.serviceAccount,
+                namespace: server.namespace,
+                body: {
+                    spec: {
+                        audiences: credentials.audience ? [credentials.audience] : [],
+                        expirationSeconds: TOKEN_SECONDS,
+                    },
+                },
+            });
+            const token = response.status?.token;
+            if (!token) {
+                throw new Error(`no token was issued for the ServiceAccount ${credentials.serviceAccount} of ${account}`);
+            }
+            data[tokenKey(account)] = Buffer.from(token, 'utf8').toString('base64');
+            files[account].push({ key: tokenKey(account), path: 'token' });
+        }
+        if (credentials.secret) {
+            let content;
+            try {
+                const secret = await instance.coreApi.readNamespacedSecret({
+                    name: credentials.secret,
+                    namespace: server.namespace,
+                });
+                content = secret.data ?? {};
+            }
+            catch (e) {
+                if ((0, apply_1.statusCodeOf)(e) === 404) {
+                    throw new Error(`the Secret ${credentials.secret} of ${account} is not in ${server.namespace}`);
+                }
+                throw e;
+            }
+            for (const [key, value] of Object.entries(content)) {
+                data[fileKey(account, key)] = value;
+                files[account].push({ key: fileKey(account, key), path: key });
+            }
+        }
+    }
+    const spec = {
+        kind: 'Secret',
+        apiVersion: 'v1',
+        metadata: {
+            namespace: kubernetes.namespace,
+            name: getCredentialsName(item),
+            annotations: { 'hammerkit.dev/version': (0, version_1.getVersion)() },
+            labels: { 'hammerkit.dev/id': item.id(), ...(0, job_placement_1.getRunLabels)(kubernetes) },
+        },
+        type: 'Opaque',
+        data,
+    };
+    await (0, apply_1.apply)(instance, spec);
+    return files;
+}
+exports.ensureJobCredentials = ensureJobCredentials;
+/**
+ * Refuses a secret of an account the run was not admitted for, or of one without a
+ * credential on the cluster: its command would run as whatever the node or the image
+ * of the provider is, which every account shares. Before anything is minted or copied.
+ */
+function assertJobAccounts(secrets, server, admitted) {
+    for (const { secret, source } of secrets) {
+        const label = `secret ${(0, work_secret_1.getSecretName)(secret)} (${(0, work_secret_1.describeSecretSource)(secret)})`;
+        if (admitted && !admitted.includes(source.account)) {
+            throw new Error(`${label}: the run was not admitted for the account ${source.account}`);
+        }
+        if (!server.accounts[source.account]) {
+            throw new Error(`${label}: the account ${source.account} has no credential on this cluster (accounts.${source.account}.kubernetes)`);
+        }
+    }
+}
+exports.assertJobAccounts = assertJobAccounts;
+async function removeJobCredentials(instance, kubernetes, item) {
+    if (!kubernetes.server) {
+        return;
+    }
+    try {
+        await instance.coreApi.deleteNamespacedSecret({ name: getCredentialsName(item), namespace: kubernetes.namespace });
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) !== 404) {
+            throw e;
+        }
+    }
+}
+exports.removeJobCredentials = removeJobCredentials;
+// A string as one word of a POSIX shell
+function quote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * What the pod of a task needs to read its secrets itself. Each secret gets an init
+ * container in the image of its provider, which runs the provider's command (no
+ * shell between the reference and the command) with the provider's and its
+ * account's variables and the account's credential under /var/run/hammerkit/account,
+ * and writes the value verbatim into a volume in memory. The task's container mounts
+ * that volume only: a `path` secret is the file itself, an `env` secret is exported
+ * from it, and the task's output is masked before it leaves the pod, since the
+ * server, which masks everything else, never sees these values.
+ */
+function getJobSecretSpec(item, secrets, server, credentials, environment) {
+    if (!server || secrets.length === 0) {
+        return {
+            initContainers: [],
+            volumes: [],
+            mounts: [],
+            command: (shell, cmd) => ({ command: [shell, '-c'], args: [cmd], env: [] }),
+        };
+    }
+    const volumes = [{ name: VALUES_VOLUME, emptyDir: { medium: 'Memory' } }];
+    // a volume per account with only its keys, mounted by the init containers of its secrets
+    const accountVolume = new Map();
+    accountsOf(secrets).forEach((account, index) => {
+        const items = credentials[account] ?? [];
+        if (items.length === 0) {
+            return;
+        }
+        const name = `hammerkit-account-${index}`;
+        accountVolume.set(account, name);
+        volumes.push({ name, secret: { secretName: getCredentialsName(item), items, defaultMode: 0o444 } });
+    });
+    const initContainers = secrets.map(({ index, secret, source }) => {
+        const label = `secret ${(0, work_secret_1.getSecretName)(secret)} (${(0, work_secret_1.describeSecretSource)(secret)})`;
+        // what the run was admitted for, as when the server reads a secret itself
+        const allowed = environment.hosted?.accounts;
+        if (allowed && !allowed.includes(source.account)) {
+            throw new Error(`${label}: the run was not admitted for the account ${source.account}`);
+        }
+        const image = server.providers[source.provider]?.image;
+        if (!image) {
+            throw new Error(`${label}: this server names no image for the provider ${source.provider}`);
+        }
+        const { command, args, env } = (0, command_secret_provider_1.getProviderInvocation)(source.binding, source.ref, environment);
+        const volume = accountVolume.get(source.account);
+        return {
+            name: `secret-${index}`,
+            image,
+            // the value as the command prints it, written once it is complete
+            command: [
+                'sh',
+                '-c',
+                'umask 022 && "$@" > "$HAMMERKIT_VALUE.part" && mv "$HAMMERKIT_VALUE.part" "$HAMMERKIT_VALUE"',
+            ],
+            args: ['sh', command, ...args],
+            env: [
+                ...Object.entries(env).map(([name, value]) => ({ name, value })),
+                { name: 'HAMMERKIT_VALUE', value: `${exports.SECRET_VALUES_PATH}/secret-${index}` },
+            ],
+            volumeMounts: [
+                { name: VALUES_VOLUME, mountPath: exports.SECRET_VALUES_PATH },
+                ...(volume ? [{ name: volume, mountPath: exports.ACCOUNT_PATH, readOnly: true }] : []),
+            ],
+            ...(0, job_placement_1.getContainerSecurity)({ server }),
+        };
+    });
+    const mounts = [{ name: VALUES_VOLUME, mountPath: exports.SECRET_VALUES_PATH }];
+    const exportLines = [];
+    for (const { index, secret } of secrets) {
+        if (secret.target.type === 'file') {
+            mounts.push({ name: VALUES_VOLUME, mountPath: secret.target.path, subPath: `secret-${index}`, readOnly: true });
+        }
+        else {
+            // verbatim: the x keeps the trailing newlines command substitution would drop
+            const name = secret.target.name;
+            exportLines.push(`${name}="$(cat "$HAMMERKIT_SECRETS/secret-${index}"; printf x)" && ${name}="\${${name}%x}" && export ${name}`);
+        }
+    }
+    const script = [
+        ...exportLines,
+        `command -v awk >/dev/null 2>&1 || { echo 'hammerkit: the image has no awk, which masks the secrets of this task in its output' >&2; exit 127; }`,
+        `{ "$HAMMERKIT_SHELL" -c "$HAMMERKIT_CMD"; echo $? > "$HAMMERKIT_SECRETS/.status"; } 2>&1 | awk -v dir="$HAMMERKIT_SECRETS" -v count=${secrets.length} ${quote(MASK_PROGRAM)}`,
+        `exit "$(cat "$HAMMERKIT_SECRETS/.status" 2>/dev/null || echo 1)"`,
+    ].join('\n');
+    return {
+        initContainers,
+        volumes,
+        mounts,
+        command: (shell, cmd) => ({
+            command: [shell, '-c'],
+            args: [script],
+            env: [
+                { name: 'HAMMERKIT_SECRETS', value: exports.SECRET_VALUES_PATH },
+                { name: 'HAMMERKIT_SHELL', value: shell },
+                { name: 'HAMMERKIT_CMD', value: cmd },
+            ],
+        }),
+    };
+}
+exports.getJobSecretSpec = getJobSecretSpec;
+// Every line of every value (trimmed, 4 characters or more, like the server's own
+// masking) is replaced by *** in each line of output. index() and not a regular
+// expression, so a value is matched as written.
+const MASK_PROGRAM = `
+function mask(s, v,   out, i) {
+  out = ""
+  while ((i = index(s, v)) > 0) { out = out substr(s, 1, i - 1) "***"; s = substr(s, i + length(v)) }
+  return out s
+}
+BEGIN {
+  n = 0
+  for (k = 0; k < count; k++) {
+    f = dir "/secret-" k
+    while ((getline line < f) > 0) {
+      gsub(/^[ \\t\\r]+|[ \\t\\r]+$/, "", line)
+      if (length(line) >= 4) values[n++] = line
+    }
+    close(f)
+  }
+  # longest first, so a value that holds another is masked as a whole
+  for (a = 0; a < n; a++) for (b = a + 1; b < n; b++) if (length(values[b]) > length(values[a])) { t = values[a]; values[a] = values[b]; values[b] = t }
+}
+{
+  out = $0
+  for (k = 0; k < n; k++) out = mask(out, values[k])
+  print out
+  fflush()
+}`;
+//# sourceMappingURL=job-secrets.js.map

package/dist/kubernetes/kept-claims.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evictKeptClaims = exports.sweepKeptClaims = exports.expireKeptClaims = exports.recordClaimState = exports.forgetClaimState = exports.useClaimState = exports.isKeptClaim = exports.getClaimName = exports.EXPIRES_ANNOTATION = exports.STATE_ANNOTATION = exports.KEPT_BY_LABEL = exports.VOLUME_SCOPE_LABEL = void 0;
+const crypto_1 = require("crypto");
+const apply_1 = require("./apply");
+const sleep_1 = require("../utils/sleep");
+const job_placement_1 = require("./job-placement");
+// On a server with `backend.keepVolumes`, the claim of a task stays after the run, so the
+// next run of the same source finds the outputs in it and mounts them without restoring
+// them from the cache. A kept claim has no run label (the end of the run removes what has
+// one), but these:
+// the trust of the source of the runs that may mount it (see getVolumeScope)
+exports.VOLUME_SCOPE_LABEL = 'hammerkit.dev/volume-scope';
+// the run label of the run that mounted it last; while it runs, the claim does not expire
+exports.KEPT_BY_LABEL = 'hammerkit.dev/kept-by';
+// the state key of the outputs in it, set once the task completed or they were restored
+exports.STATE_ANNOTATION = 'hammerkit.dev/state';
+// when it goes, set by the end of the run that mounted it last
+exports.EXPIRES_ANNOTATION = 'hammerkit.dev/expires';
+// The claim of a work item: a task's on a server that keeps them carries the scope, so a
+// run of another source never mounts it. 63 characters at most, a pod's volume name.
+function getClaimName(work, kubernetes) {
+    const scope = kubernetes?.server?.volumeScope;
+    const name = 'hammerkit-' + work.id();
+    return scope && isTask(work) ? `${name}-${(0, crypto_1.createHash)('sha256').update(scope).digest('hex').slice(0, 12)}` : name;
+}
+exports.getClaimName = getClaimName;
+// whether the claim of the work item stays after the run
+function isKeptClaim(work, kubernetes) {
+    return !!kubernetes.server?.volumeScope && isTask(work);
+}
+exports.isKeptClaim = isKeptClaim;
+function isTask(work) {
+    return work.data.type === 'container-task';
+}
+async function readClaim(instance, namespace, name) {
+    try {
+        return await instance.coreApi.readNamespacedPersistentVolumeClaim({ name, namespace });
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) === 404) {
+            return null;
+        }
+        throw e;
+    }
+}
+// The state key of the outputs a kept claim holds, null when it holds none that are whole.
+// The claim is the run's from now: it does not expire or make way for another claim
+// before the run ended, so outputs the run found in it are still there when it mounts them.
+async function useClaimState(instance, kubernetes, name) {
+    let claim;
+    try {
+        claim = await instance.objectApi.patch({
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: {
+                name,
+                namespace: kubernetes.namespace,
+                labels: { [exports.KEPT_BY_LABEL]: (0, job_placement_1.getRunLabelValue)(kubernetes.server?.run ?? '') },
+                // null removes it
+                annotations: { [exports.EXPIRES_ANNOTATION]: null },
+            },
+        });
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) === 404) {
+            return null;
+        }
+        throw e;
+    }
+    // one being removed holds nothing to mount, nor one of another source (ensured anyway
+    // by the hash of the source in its name)
+    if (claim.metadata?.deletionTimestamp ||
+        claim.metadata?.labels?.[exports.VOLUME_SCOPE_LABEL] !== kubernetes.server?.volumeScope) {
+        return null;
+    }
+    return claim.metadata?.annotations?.[exports.STATE_ANNOTATION] ?? null;
+}
+exports.useClaimState = useClaimState;
+async function annotate(instance, namespace, name, annotations) {
+    try {
+        await instance.objectApi.patch({
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: { name, namespace, annotations: annotations },
+        });
+        return true;
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) === 404) {
+            return false;
+        }
+        throw e;
+    }
+}
+// Before a task writes to its kept claim: the outputs in it stop being those of a state.
+// Whether the claim was there, with what an earlier run left in it.
+function forgetClaimState(instance, kubernetes, name) {
+    return annotate(instance, kubernetes.namespace, name, { [exports.STATE_ANNOTATION]: null });
+}
+exports.forgetClaimState = forgetClaimState;
+// Once the outputs of `stateKey` are whole in the kept claim
+async function recordClaimState(instance, kubernetes, name, stateKey) {
+    await annotate(instance, kubernetes.namespace, name, { [exports.STATE_ANNOTATION]: stateKey });
+}
+exports.recordClaimState = recordClaimState;
+// The kept claims in a namespace
+async function listKeptClaims(instance, namespace, labelSelector = exports.VOLUME_SCOPE_LABEL) {
+    const claims = await instance.coreApi.listNamespacedPersistentVolumeClaim({ namespace, labelSelector });
+    return claims.items.filter((claim) => !claim.metadata?.deletionTimestamp);
+}
+async function removeClaims(instance, namespace, claims, timeout) {
+    const names = [];
+    for (const claim of claims) {
+        const name = claim.metadata?.name;
+        if (!name) {
+            continue;
+        }
+        try {
+            // only as it was listed: one a run took for itself since (useClaimState) stays
+            await instance.coreApi.deleteNamespacedPersistentVolumeClaim({
+                name,
+                namespace,
+                body: { preconditions: { resourceVersion: claim.metadata?.resourceVersion } },
+            });
+            names.push(name);
+        }
+        catch (e) {
+            if ((0, apply_1.statusCodeOf)(e) === 404) {
+                names.push(name);
+            }
+            else if ((0, apply_1.statusCodeOf)(e) !== 409) {
+                throw e;
+            }
+        }
+    }
+    // a run mounts a claim of the same name again
+    const deadline = Date.now() + timeout;
+    for (const name of names) {
+        while (await readClaim(instance, namespace, name)) {
+            if (Date.now() > deadline) {
+                throw new Error(`the claim ${name} is still there after ${Math.round(timeout / 1000)}s`);
+            }
+            await (0, sleep_1.sleep)(1000);
+        }
+    }
+    return names;
+}
+// At the end of a run: the claims it kept go `keep` milliseconds from now, unless a run
+// mounts them before
+async function expireKeptClaims(instance, namespace, runLabel, expires) {
+    for (const claim of await listKeptClaims(instance, namespace, `${exports.KEPT_BY_LABEL}=${runLabel}`)) {
+        if (claim.metadata?.name) {
+            await annotate(instance, namespace, claim.metadata.name, { [exports.EXPIRES_ANNOTATION]: expires.toISOString() });
+        }
+    }
+}
+exports.expireKeptClaims = expireKeptClaims;
+// While no run of the caller is in the namespace: the kept claims that expired, and those
+// a run left without an expiry because the server stopped before its end (all of them
+// when the server keeps none any more). The names of those removed, and when the next of
+// the others expires.
+async function sweepKeptClaims(instance, namespace, options) {
+    const expired = [];
+    let next = null;
+    for (const claim of await listKeptClaims(instance, namespace)) {
+        const expires = Date.parse(claim.metadata?.annotations?.[exports.EXPIRES_ANNOTATION] ?? '');
+        if (!options.keep || !(expires > options.now.getTime())) {
+            expired.push(claim);
+        }
+        else if (next === null || expires < next) {
+            next = expires;
+        }
+    }
+    const removed = await removeClaims(instance, namespace, expired, options.timeout);
+    return { removed, next: next === null ? null : new Date(next) };
+}
+exports.sweepKeptClaims = sweepKeptClaims;
+// When a run needs room under the quota of its namespace: the kept claims it does not use
+// go, those of the other sources and those of its own a task of this run did not take (one
+// renamed or changed since). The names of those removed.
+async function evictKeptClaims(instance, kubernetes, timeout) {
+    const server = kubernetes.server;
+    if (!server?.volumeScope) {
+        return [];
+    }
+    const unused = await listKeptClaims(instance, kubernetes.namespace, `${exports.VOLUME_SCOPE_LABEL},${exports.KEPT_BY_LABEL}!=${(0, job_placement_1.getRunLabelValue)(server.run)}`);
+    return removeClaims(instance, kubernetes.namespace, unused, timeout);
+}
+exports.evictKeptClaims = evictKeptClaims;
+//# sourceMappingURL=kept-claims.js.map

package/dist/kubernetes/kubernetes-instance.js

@@ -12,23 +12,31 @@ function createKubernetesInstances(kubernetes) {
         else {
             kc.loadFromDefault();
         }
-        kc.setCurrentContext(kubernetes.context);
+        if (kubernetes.context) {
+            kc.setCurrentContext(kubernetes.context);
+        }
         const coreApi = kc.makeApiClient(client_node_1.CoreV1Api);
         const batchApi = kc.makeApiClient(client_node_1.BatchV1Api);
         const appsApi = kc.makeApiClient(client_node_1.AppsV1Api);
         const objectApi = kc.makeApiClient(client_node_1.KubernetesObjectApi);
+        const authApi = kc.makeApiClient(client_node_1.AuthenticationV1Api);
         const exec = new client_node_1.Exec(kc);
         return {
             objectApi,
+            log: new client_node_1.Log(kc),
             exec,
             appsApi,
             coreApi,
             batchApi,
+            authApi,
         };
     }
     catch (e) {
         if ((0, log_1.getErrorMessage)(e) === 'No active cluster!') {
-            if (kubernetes.kubeConfig) {
+            if (!kubernetes.context) {
+                throw new Error('No cluster found: no kubeconfig names a current context, and this is not a pod of a cluster');
+            }
+            else if (kubernetes.kubeConfig) {
                 throw new Error(`No cluster found for context ${kubernetes.context} in ${kubernetes.kubeConfig}`);
             }
             else {