hammerkit 1.26.0 → 1.27.0-next.10

package/build.schema.json

@@ -261,6 +261,37 @@
                     "additionalProperties": false,
                     "description": "cpu and memory requests and limits"
                   },
+                  "network": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "const": "open"
+                      },
+                      {
+                        "type": "string",
+                        "const": "none"
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "allow": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            }
+                          }
+                        },
+                        "required": [
+                          "allow"
+                        ],
+                        "additionalProperties": false
+                      }
+                    ],
+                    "description": "network the task or service reaches besides its needs: open (default), none or { allow: [hosts or host:port] }"
+                  },
+                  "args": {
+                    "type": "boolean"
+                  },
                   "runner": {
                     "type": "string",
                     "minLength": 1
@@ -273,6 +304,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "volumeSize": {
+                    "type": "string",
+                    "description": "size of its claim on Kubernetes, e.g. 10Gi"
                   }
                 },
                 "required": [
@@ -335,6 +370,12 @@
                   "resources": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/resources"
                   },
+                  "network": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/network"
+                  },
+                  "args": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/args"
+                  },
                   "runner": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
                   },
@@ -468,6 +509,17 @@
                   "resources": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/resources",
                     "description": "cpu and memory requests and limits"
+                  },
+                  "volumeSize": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/volumeSize",
+                    "description": "size of its claim on Kubernetes, e.g. 10Gi"
+                  },
+                  "network": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/network",
+                    "description": "network the task or service reaches besides its needs: open (default), none or { allow: [hosts or host:port] }"
+                  },
+                  "args": {
+                    "type": "boolean"
                   }
                 },
                 "required": [
@@ -630,6 +682,15 @@
                           "additionalProperties": false
                         }
                       },
+                      "networkPolicy": {
+                        "type": "string",
+                        "const": "enforced",
+                        "description": "the cluster enforces NetworkPolicy, which limited networks need"
+                      },
+                      "volumeSize": {
+                        "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/volumeSize",
+                        "description": "size of the claim of each task and service, 1Gi by default"
+                      },
                       "ingresses": {
                         "not": {}
                       }
@@ -750,7 +811,7 @@
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/timeout"
                   },
                   "maxSize": {
-                    "type": "string"
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/volumeSize"
                   },
                   "keepPerTask": {
                     "type": "integer",

package/dist/cache/backends/local-cache-backend.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createLocalCacheBackend = void 0;
+exports.createLocalCacheBackend = exports.getDefaultLocalCachePath = void 0;
 const path_1 = require("path");
 const os_1 = require("os");
 const promises_1 = require("fs/promises");
@@ -16,8 +16,16 @@ async function directories(path) {
         return [];
     }
 }
+// Below the home directory, or below `HAMMERKIT_DIR` when that is set: a server sets
+// it per source trust, so the runs of one repository share their cache and nobody
+// else's run finds it (a run's home directory is its own and goes with it).
+function getDefaultLocalCachePath() {
+    const directory = process.env.HAMMERKIT_DIR;
+    return directory ? (0, path_1.join)(directory, 'remote-cache') : (0, path_1.join)((0, os_1.homedir)(), '.hammerkit', 'remote-cache');
+}
+exports.getDefaultLocalCachePath = getDefaultLocalCachePath;
 function createLocalCacheBackend(spec) {
-    const root = spec.path ?? (0, path_1.join)((0, os_1.homedir)(), '.hammerkit', 'remote-cache');
+    const root = spec.path ?? getDefaultLocalCachePath();
     async function readEntry(taskId, stateKey) {
         const dir = (0, path_1.join)(root, taskId, stateKey);
         let created;

package/dist/cache/backends/registry-cache-backend.js

@@ -5,6 +5,7 @@ const crypto_1 = require("crypto");
 const os_1 = require("os");
 const path_1 = require("path");
 const tar_1 = require("tar");
+const tar_2 = require("../../utils/tar");
 const registry_reference_1 = require("./registry/registry-reference");
 const registry_client_1 = require("./registry/registry-client");
 const MAX_TAG_LENGTH = 128;
@@ -74,8 +75,7 @@ function createRegistryCacheBackend(spec) {
                 const layerFile = (0, path_1.join)(dir, 'layer.tar');
                 const files = (await environment.file.listFiles(from)).sort();
                 // portable + mtime-free so identical entries produce identical digests
-                // `noMtime` is supported by tar 6 but missing from its type definitions
-                await (0, tar_1.create)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
+                await (0, tar_2.packArchive)({ file: layerFile, cwd: from, portable: true, noMtime: true }, files);
                 const layer = await (0, registry_client_1.digestFile)(layerFile);
                 const config = Buffer.from(JSON.stringify({
                     architecture: 'amd64',

package/dist/cache/explain.js

@@ -121,6 +121,19 @@ async function explainTask(item, defaultCacheMethod, environment, memo = new Map
         return { taskId: item.id(), taskName: item.name, status: 'miss', causes: [{ kind: 'never-cached' }] };
     }
     visiting.add(item.id());
+    // Like the scheduler, a task whose cache is off is never looked up, so its
+    // sources aren't hashed for it.
+    if ((0, state_key_1.resolveEffective)(item, defaultCacheMethod).method === 'none') {
+        const explanation = {
+            taskId: item.id(),
+            taskName: item.name,
+            status: 'uncacheable',
+            causes: [{ kind: 'caching-disabled' }],
+        };
+        memo.set(item.id(), explanation);
+        visiting.delete(item.id());
+        return explanation;
+    }
     const { stateKey, stats, resolved, provable, unmatched } = await (0, state_key_1.computeStateKey)(item, defaultCacheMethod, environment);
     // Mirrors the scheduler: a task that cannot be proven up to date always runs
     // (see computeStateKey), whatever a cache holds for it.
@@ -144,17 +157,6 @@ async function explainTask(item, defaultCacheMethod, environment, memo = new Map
         visiting.delete(item.id());
         return explanation;
     }
-    if (resolved.method === 'none') {
-        const explanation = {
-            taskId: item.id(),
-            taskName: item.name,
-            status: 'uncacheable',
-            causes: [{ kind: 'caching-disabled' }],
-        };
-        memo.set(item.id(), explanation);
-        visiting.delete(item.id());
-        return explanation;
-    }
     const runtimeStateKey = await safeCurrentStateKey(item, environment);
     const hasEntry = await safeHas(item, stateKey, environment);
     const predictedHit = runtimeStateKey === stateKey || hasEntry;

package/dist/cli.js

@@ -23,6 +23,7 @@ const dry_run_1 = require("./executer/dry-run");
 const cache_sync_1 = require("./cache/cache-sync");
 const cache_inventory_1 = require("./cache/cache-inventory");
 const prefetch_secrets_1 = require("./secrets/prefetch-secrets");
+const work_network_1 = require("./planner/work-network");
 const isCliTask = (val) => val.type === 'task';
 exports.isCliTask = isCliTask;
 const isCliService = (val) => val.type === 'service';
@@ -50,6 +51,7 @@ class Cli {
         return {
             state: processWorkTree,
             start: async () => {
+                (0, work_network_1.applyNetworkCeiling)(workTree, type === 'down' ? null : options?.network ?? null);
                 if (type !== 'down') {
                     await this.prepareSecrets(true);
                 }
@@ -80,6 +82,7 @@ class Cli {
                         skipDeps: options?.skipDeps ?? true,
                         wait: options?.wait ?? 'ready',
                         resourceCheck: options?.resourceCheck ?? true,
+                        network: options?.network ?? null,
                     });
                 }
                 const result = (0, get_scheduler_execute_result_1.getSchedulerExecuteResult)(workTree);