hammerkit 1.26.0 → 1.27.0-next.10

package/dist/kubernetes/restore-kubernetes-data.js

@@ -1,21 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.restoreKubernetesData = void 0;
+exports.restoreKubernetesData = exports.getRestoreTarget = void 0;
 const event_cache_1 = require("../executer/event-cache");
 const log_1 = require("../log");
-const path_1 = require("path");
 const volumes_1 = require("./volumes");
 const ensure_persistent_data_1 = require("./ensure-persistent-data");
-async function restoreKubernetesData(work, kubernetes, instance, environment, path) {
-    const persistence = await (0, volumes_1.getKubernetesPersistence)(work);
+const claim_layout_1 = require("./claim-layout");
+// Where the upload pod (which mounts the work's claim at /dev/hammerkit/<id>) unpacks the
+// archive of an output: the output's place in the claim, which its mount reads
+function getRestoreTarget(work, path) {
+    return `/dev/hammerkit/${work.id()}/${(0, claim_layout_1.getClaimSubPath)(work, path)}`;
+}
+exports.getRestoreTarget = getRestoreTarget;
+async function restoreKubernetesData(work, kubernetes, instance, environment, path, 
+// the kept claim of the work holds what an earlier run left, which goes first
+options = {}) {
+    const persistence = await (0, volumes_1.getKubernetesPersistence)(work, kubernetes);
     await (0, ensure_persistent_data_1.getPodForPersistence)(instance, kubernetes, work, persistence, 'write', async (name) => {
+        if (options.reset) {
+            await (0, ensure_persistent_data_1.clearClaim)(instance, kubernetes, work, name);
+        }
         for (const generatedArchive of (0, event_cache_1.getArchivePaths)(work.data, path)) {
             if (!(await environment.file.exists(generatedArchive.filename))) {
                 continue;
             }
-            const targetPath = `/dev/hammerkit/${work.id()}/${(0, path_1.basename)(generatedArchive.path)}`;
-            const res = await instance.exec.exec(kubernetes.namespace, name, 'volume', ['tar', 'xzf', '-', '-C', targetPath], process.stdout, process.stderr, environment.file.readStream(generatedArchive.filename), false, (status) => {
-                work.status.write('debug', `upload ${generatedArchive.filename} to ${name}: ${status}`);
+            const targetPath = getRestoreTarget(work, generatedArchive.path);
+            // a claim made for this run (a server removes the claims of a run when it
+            // ends) does not have the directory of the output yet
+            let failure = null;
+            const res = await instance.exec.exec(kubernetes.namespace, name, 'volume', ['sh', '-c', 'mkdir -p "$1" && tar xzf - -C "$1"', 'sh', targetPath], process.stdout, process.stderr, environment.file.readStream(generatedArchive.filename), false, (status) => {
+                work.status.write('debug', `upload ${generatedArchive.filename} to ${name}: ${status.status}`);
+                if (status.status !== 'Success') {
+                    failure = status.message ?? status.reason ?? 'unknown';
+                }
             });
             await new Promise((resolve, reject) => {
                 try {
@@ -27,6 +44,10 @@ async function restoreKubernetesData(work, kubernetes, instance, environment, pa
                         reject(err);
                     });
                     res.on('close', () => {
+                        if (failure) {
+                            reject(new Error(`unable to restore ${generatedArchive.path} into ${name}: ${failure}`));
+                            return;
+                        }
                         work.status.write('debug', `uploaded ${generatedArchive.filename} to ${name}:${targetPath}`);
                         resolve();
                     });

package/dist/kubernetes/secrets.js

@@ -6,17 +6,17 @@ const apply_1 = require("./apply");
 const resources_1 = require("./resources");
 const version_1 = require("../version");
 const SECRET_VOLUME_NAME = 'hammerkit-secrets';
-function getSecretResourceName(item) {
-    return (0, resources_1.getResourceName)(item, '-secrets');
+function getSecretResourceName(item, kubernetes) {
+    return (0, resources_1.getResourceName)(item, kubernetes, '-secrets');
 }
 exports.getSecretResourceName = getSecretResourceName;
 // The values go into a Secret of the item; the pod only references it, so no
 // value is part of a Job or Deployment spec.
-function getKubernetesSecretRefs(item, secrets) {
+function getKubernetesSecretRefs(item, kubernetes, secrets) {
     if (secrets.length === 0) {
         return { env: [], mounts: [], volumes: [] };
     }
-    const secretName = getSecretResourceName(item);
+    const secretName = getSecretResourceName(item, kubernetes);
     const refs = {
         env: [],
         mounts: [],
@@ -49,13 +49,11 @@ async function ensureKubernetesSecret(instance, kubernetes, item, secrets, envir
         apiVersion: 'v1',
         metadata: {
             namespace: kubernetes.namespace,
-            name: getSecretResourceName(item),
+            name: getSecretResourceName(item, kubernetes),
             annotations: {
                 'hammerkit.dev/version': (0, version_1.getVersion)(),
             },
-            labels: {
-                'hammerkit.dev/id': item.id(),
-            },
+            labels: (0, resources_1.getItemLabels)(item, kubernetes),
         },
         type: 'Opaque',
         stringData,
@@ -66,7 +64,7 @@ exports.ensureKubernetesSecret = ensureKubernetesSecret;
 async function removeKubernetesSecret(instance, kubernetes, item) {
     try {
         await instance.coreApi.deleteNamespacedSecret({
-            name: getSecretResourceName(item),
+            name: getSecretResourceName(item, kubernetes),
             namespace: kubernetes.namespace,
         });
     }

package/dist/kubernetes/store-kubernetes-data.js

@@ -6,7 +6,7 @@ const event_cache_1 = require("../executer/event-cache");
 const volumes_1 = require("./volumes");
 const ensure_persistent_data_1 = require("./ensure-persistent-data");
 async function storeKubernetesData(work, kubernetes, instance, environment, path) {
-    const persistence = await (0, volumes_1.getKubernetesPersistence)(work);
+    const persistence = await (0, volumes_1.getKubernetesPersistence)(work, kubernetes);
     await (0, ensure_persistent_data_1.getPodForPersistence)(instance, kubernetes, work, persistence, 'read', async (name) => {
         for (const generatedArchive of (0, event_cache_1.getArchivePaths)(work.data, path)) {
             const writerStream = environment.file.createWriteStream(generatedArchive.filename);

package/dist/kubernetes/volumes.js

@@ -1,37 +1,90 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.appendVolume = exports.getKubernetesPersistence = exports.getVolumeName = void 0;
+exports.getSandboxAffinity = exports.SANDBOX_LABEL = exports.getWorkspacePodSpec = exports.appendVolume = exports.getKubernetesPersistence = exports.getVolumeName = void 0;
 const path_1 = require("path");
-function getVolumeName(service) {
-    return 'hammerkit-' + service.id();
+const fs_1 = require("fs");
+const kept_claims_1 = require("./kept-claims");
+const claim_layout_1 = require("./claim-layout");
+function getVolumeName(service, kubernetes) {
+    return (0, kept_claims_1.getClaimName)(service, kubernetes);
 }
 exports.getVolumeName = getVolumeName;
-async function getKubernetesPersistence(work) {
-    const persistence = { volumes: [], sources: [], mounts: [], initCommands: [] };
+const WORKSPACE_VOLUME = 'hammerkit-sandbox';
+// The path of `path` below the root of a sandbox's files, or undefined when it is not
+// below it
+function workspacePath(workspace, path) {
+    const rel = (0, path_1.relative)(workspace.root, path);
+    if (rel.startsWith('..') || (0, path_1.isAbsolute)(rel)) {
+        return undefined;
+    }
+    return [workspace.subPath, ...rel.split(path_1.sep).filter((part) => part.length > 0)].join('/');
+}
+// A path of a sandbox is mounted from its claim, read and write as on a host's docker,
+// so what the task writes is in the sandbox afterwards. A path that is not in the
+// sandbox is left out: Kubernetes would make a directory of it in the claim.
+function appendWorkspaceMount(workspace, persistence, containerPath, localPath, isFile, readOnly) {
+    const subPath = workspacePath(workspace, localPath);
+    if (subPath === undefined) {
+        return false;
+    }
+    if (!(0, fs_1.existsSync)(localPath)) {
+        return true;
+    }
+    if (persistence.workspace.length === 0) {
+        persistence.workspace.push({ name: WORKSPACE_VOLUME, persistentVolumeClaim: { claimName: workspace.claim } });
+    }
+    persistence.mounts.push({
+        mount: { readOnly, mountPath: containerPath, name: WORKSPACE_VOLUME, subPath },
+        uploadPath: '',
+        cwd: isFile ? (0, path_1.dirname)(containerPath) : containerPath,
+        workspace: true,
+    });
+    return true;
+}
+async function getKubernetesPersistence(work, kubernetes) {
+    const persistence = {
+        volumes: [],
+        sizes: {},
+        kept: [],
+        workspace: [],
+        sources: [],
+        mounts: [],
+        initCommands: [],
+    };
+    const workspace = kubernetes.server?.workspace;
     for (const mount of work.data.mounts) {
-        appendVolume(work, persistence, mount.containerPath, mount.localPath, mount.isFile, true);
+        if (workspace &&
+            appendWorkspaceMount(workspace, persistence, mount.containerPath, mount.localPath, mount.isFile, mount.readOnly)) {
+            continue;
+        }
+        appendVolume(work, persistence, mount.containerPath, mount.localPath, mount.isFile, true, kubernetes);
     }
     for (const src of work.data.src) {
         if (src.inherited) {
             continue;
         }
-        appendVolume(work, persistence, src.absolutePath, src.absolutePath, src.isFile, true); // TODO matcher
+        if (workspace &&
+            appendWorkspaceMount(workspace, persistence, src.absolutePath, src.absolutePath, src.isFile, false)) {
+            continue;
+        }
+        appendVolume(work, persistence, src.absolutePath, src.absolutePath, src.isFile, true, kubernetes); // TODO matcher
     }
     if (work.data.type === 'container-task') {
         for (const generate of work.data.generates) {
-            appendVolume(generate.inherited ?? work, persistence, generate.path, null, false, !!generate.inherited);
+            appendVolume(generate.inherited ?? work, persistence, generate.path, null, false, !!generate.inherited, kubernetes);
         }
     }
     else {
         for (const volume of work.data.volumes) {
-            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited || volume.readOnly);
+            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited || volume.readOnly, kubernetes);
         }
     }
     return persistence;
 }
 exports.getKubernetesPersistence = getKubernetesPersistence;
-function appendVolume(sourceWork, persistence, containerPath, localPath, isFile, readOnly) {
-    const volumeName = getVolumeName(sourceWork);
+function appendVolume(sourceWork, persistence, containerPath, localPath, isFile, readOnly, kubernetes) {
+    const volumeName = getVolumeName(sourceWork, kubernetes);
+    const subPath = (0, claim_layout_1.getClaimSubPath)(sourceWork, containerPath);
     const existVolume = persistence.volumes.some((v) => v.name === volumeName);
     if (!existVolume) {
         persistence.volumes.push({
@@ -40,13 +93,17 @@ function appendVolume(sourceWork, persistence, containerPath, localPath, isFile,
                 claimName: volumeName,
             },
         });
+        persistence.sizes[volumeName] = 'volumeSize' in sourceWork.data ? sourceWork.data.volumeSize : null;
+        if ((0, kept_claims_1.isKeptClaim)(sourceWork, kubernetes)) {
+            persistence.kept.push(volumeName);
+        }
     }
     persistence.mounts.push({
         mount: {
             readOnly,
             mountPath: containerPath,
             name: volumeName,
-            subPath: (0, path_1.basename)(containerPath),
+            subPath,
         },
         uploadPath: `/dev/hammerkit/${sourceWork.id()}`,
         cwd: isFile ? (0, path_1.dirname)(containerPath) : containerPath,
@@ -56,9 +113,44 @@ function appendVolume(sourceWork, persistence, containerPath, localPath, isFile,
             localPath: localPath,
             matcher: () => true, // TODO
             containerPath,
+            subPath,
             stateKey: '', // TODO
         });
     }
 }
 exports.appendVolume = appendVolume;
+/**
+ * What a pod that mounts the claim of a sandbox needs: its label, and to go where the
+ * other pods that mount it run. A claim is usually `ReadWriteOnce`, which several pods
+ * share only on one node; the first pod (no other one runs) goes anywhere. The pod of the
+ * sandbox's files runs on the first pool while a run works, so a task on another pool
+ * would never start: it is refused.
+ */
+function getWorkspacePodSpec(kubernetes, persistence, task) {
+    const workspace = kubernetes.server?.workspace;
+    if (!workspace || persistence.workspace.length === 0) {
+        return { labels: {} };
+    }
+    const first = kubernetes.server?.pools[0]?.name;
+    if (task?.pool && first && task.pool !== first) {
+        throw new Error(`task ${task.name}: runs on the pool ${task.pool}, and the tasks of a run on a sandbox run on the first pool, ${first}, where its files are`);
+    }
+    return {
+        labels: { [exports.SANDBOX_LABEL]: workspace.label },
+        affinity: getSandboxAffinity(workspace.label),
+    };
+}
+exports.getWorkspacePodSpec = getWorkspacePodSpec;
+// the label of the pods that mount the claim of a sandbox
+exports.SANDBOX_LABEL = 'hammerkit.dev/sandbox';
+function getSandboxAffinity(label) {
+    return {
+        podAffinity: {
+            requiredDuringSchedulingIgnoredDuringExecution: [
+                { labelSelector: { matchLabels: { [exports.SANDBOX_LABEL]: label } }, topologyKey: 'kubernetes.io/hostname' },
+            ],
+        },
+    };
+}
+exports.getSandboxAffinity = getSandboxAffinity;
 //# sourceMappingURL=volumes.js.map

package/dist/log.js

@@ -216,7 +216,7 @@ function writeWorkItemLogToConsole(env, log, maxNodeNameLength) {
 exports.writeWorkItemLogToConsole = writeWorkItemLogToConsole;
 function formatDate(date) {
     return colors_1.default.grey(`[${date.getFullYear()}-${(date.getMonth() + 1).toString().padStart(2, '0')}-${date
-        .getDay()
+        .getDate()
         .toString()
         .padStart(2, '0')} ${date.getHours().toString().padStart(2, '0')}:${date
         .getMinutes()

package/dist/main.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// The CLI: what `hammerkit` runs, for all but the command of a sandbox's pod (see index.ts).
+const log_1 = require("./log");
+const get_file_context_1 = require("./file/get-file-context");
+const work_item_status_1 = require("./planner/work-item-status");
+const redact_1 = require("./utils/redact");
+const empty_writable_1 = require("./utils/empty-writable");
+const run_program_1 = require("./run-program");
+const abort_on_signals_1 = require("./utils/abort-on-signals");
+const abortCtrl = new AbortController();
+(0, abort_on_signals_1.abortOnSignals)(process, abortCtrl);
+let settled = false;
+// A run that never settles (a task waiting on something that can't happen)
+// lets the event loop drain, and Node then exits 0: CI would report success
+// for a build that never finished. Fail loudly instead.
+process.on('beforeExit', () => {
+    if (!settled) {
+        process.stderr.write('hammerkit stopped before the run finished\n');
+        process.exitCode = 1;
+    }
+});
+const secrets = (0, redact_1.createSecretRegistry)();
+(0, run_program_1.runProgram)({
+    cwd: process.cwd(),
+    abortCtrl,
+    processEnvs: process.env,
+    file: (0, get_file_context_1.getFileContext)(process.cwd()),
+    console: (0, log_1.consoleContext)(process.stdout),
+    status: (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets),
+    secrets,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    stdoutColumns: process.stdout.columns,
+}, process.argv, false).then(() => {
+    settled = true;
+}, () => {
+    settled = true;
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map