hammerkit 1.26.0 → 1.27.0-next.10

package/dist/index.js

@@ -1,41 +1,38 @@
 #!/usr/bin/env node
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const log_1 = require("./log");
-const get_file_context_1 = require("./file/get-file-context");
-const work_item_status_1 = require("./planner/work-item-status");
-const redact_1 = require("./utils/redact");
-const empty_writable_1 = require("./utils/empty-writable");
-const run_program_1 = require("./run-program");
-const abort_on_signals_1 = require("./utils/abort-on-signals");
-const abortCtrl = new AbortController();
-(0, abort_on_signals_1.abortOnSignals)(process, abortCtrl);
-let settled = false;
-// A run that never settles (a task waiting on something that can't happen)
-// lets the event loop drain, and Node then exits 0: CI would report success
-// for a build that never finished. Fail loudly instead.
-process.on('beforeExit', () => {
-    if (!settled) {
-        process.stderr.write('hammerkit stopped before the run finished\n');
-        process.exitCode = 1;
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
     }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
 });
-const secrets = (0, redact_1.createSecretRegistry)();
-(0, run_program_1.runProgram)({
-    cwd: process.cwd(),
-    abortCtrl,
-    processEnvs: process.env,
-    file: (0, get_file_context_1.getFileContext)(process.cwd()),
-    console: (0, log_1.consoleContext)(process.stdout),
-    status: (0, work_item_status_1.statusConsole)((0, empty_writable_1.emptyWritable)(), secrets),
-    secrets,
-    stdout: process.stdout,
-    stderr: process.stderr,
-    stdoutColumns: process.stdout.columns,
-}, process.argv, false).then(() => {
-    settled = true;
-}, () => {
-    settled = true;
-    process.exit(1);
-});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+// A server on a cluster runs `hammerkit server-sandbox <directory>` in the pod of a
+// sandbox's files for every request on them. It loads the code of sandboxes only: the
+// whole CLI takes most of a second to load, and more on a pod with little CPU.
+if (process.argv[2] === 'server-sandbox' && process.argv.length === 4) {
+    void Promise.resolve().then(() => __importStar(require('./server/sandbox-pod-command'))).then(({ runSandboxPodCommand }) => runSandboxPodCommand(process.argv[3], process.stdin, process.stdout).catch((e) => {
+        process.stderr.write(`${e instanceof Error ? e.message : String(e)}\n`);
+        process.exitCode = 1;
+    }));
+}
+else {
+    void Promise.resolve().then(() => __importStar(require('./main')));
+}
 //# sourceMappingURL=index.js.map

package/dist/kubernetes/apply.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.apply = exports.statusCodeOf = void 0;
+exports.replace = exports.apply = exports.statusCodeOf = void 0;
 // The client throws an ApiException carrying the HTTP status as `code`; watch
 // errors carry it as `statusCode`.
 function statusCodeOf(e) {
@@ -30,4 +30,45 @@ async function apply(instance, spec) {
     }
 }
 exports.apply = apply;
+/**
+ * Makes the object exactly as given: replaced as a whole when it exists, so what was
+ * dropped from it goes too, which a merge patch would keep (a key of a quota, a rule
+ * of a policy).
+ */
+async function replace(instance, spec) {
+    for (let attempt = 1;; attempt++) {
+        let current;
+        try {
+            current = await instance.objectApi.read(spec);
+        }
+        catch (e) {
+            if (statusCodeOf(e) !== 404) {
+                throw e;
+            }
+            try {
+                return await instance.objectApi.create(spec);
+            }
+            catch (createError) {
+                if (statusCodeOf(createError) !== 409) {
+                    throw createError;
+                }
+                current = await instance.objectApi.read(spec);
+            }
+        }
+        try {
+            return await instance.objectApi.replace({
+                ...spec,
+                metadata: { ...spec.metadata, resourceVersion: current.metadata?.resourceVersion },
+            });
+        }
+        catch (e) {
+            // replaced by someone else since it was read (the server sets up a caller's
+            // namespace for a run and for a sandbox at the same time): read it again
+            if (statusCodeOf(e) !== 409 || attempt >= 3) {
+                throw e;
+            }
+        }
+    }
+}
+exports.replace = replace;
 //# sourceMappingURL=apply.js.map

package/dist/kubernetes/await-running-state.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deleteJobAndWait = exports.awaitDeployRunningState = exports.deleteJob = exports.awaitJobCompletion = exports.awaitRunningState = void 0;
+exports.stopJob = exports.deleteJobAndWait = exports.awaitDeployRunningState = exports.deleteJob = exports.awaitJobCompletion = exports.awaitRunningState = void 0;
 const abort_1 = require("../executer/abort");
 const abort_event_1 = require("../utils/abort-event");
 const apply_1 = require("./apply");
@@ -126,4 +126,36 @@ async function deleteJobAndWait(instance, env, name, abort, pollInterval = 500)
     }
 }
 exports.deleteJobAndWait = deleteJobAndWait;
+// Stops a Job at once: its pods go without a grace period, and this returns once they
+// are gone, so what limited them (the item's NetworkPolicy) can go after them.
+async function stopJob(instance, env, name, timeout = 30000, pollInterval = 500) {
+    await deleteJob(instance, env, name);
+    const deadline = Date.now() + timeout;
+    for (;;) {
+        const pods = await instance.coreApi.listNamespacedPod({
+            namespace: env.namespace,
+            labelSelector: `job-name=${name}`,
+        });
+        if (pods.items.length === 0) {
+            return;
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`the pods of ${name} were still there after ${Math.round(timeout / 1000)}s`);
+        }
+        for (const pod of pods.items) {
+            // also one the Job's deletion already ends, with the default grace period
+            if (pod.metadata?.name) {
+                await instance.coreApi
+                    .deleteNamespacedPod({ name: pod.metadata.name, namespace: env.namespace, gracePeriodSeconds: 0 })
+                    .catch((e) => {
+                    if ((0, apply_1.statusCodeOf)(e) !== 404) {
+                        throw e;
+                    }
+                });
+            }
+        }
+        await (0, sleep_1.sleep)(pollInterval);
+    }
+}
+exports.stopJob = stopJob;
 //# sourceMappingURL=await-running-state.js.map

package/dist/kubernetes/claim-layout.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasOutputsFlatteningAlike = exports.hasPathsEndingAlike = exports.byDepth = exports.getClaimSubPath = void 0;
+const crypto_1 = require("crypto");
+const path_1 = require("path");
+const portable_path_1 = require("../planner/utils/portable-path");
+// The paths a work item keeps in its claim. Its consumers mount its outputs by the same
+// paths, so they find the same folders.
+function getClaimPaths(work) {
+    const data = work.data;
+    const paths = [];
+    if ('mounts' in data) {
+        paths.push(...data.mounts.map((mount) => mount.containerPath));
+    }
+    if ('src' in data) {
+        paths.push(...data.src.filter((src) => !src.inherited).map((src) => src.absolutePath));
+    }
+    if ('generates' in data) {
+        paths.push(...data.generates.filter((generate) => !generate.inherited).map((generate) => generate.path));
+    }
+    if ('volumes' in data) {
+        paths.push(...data.volumes.filter((volume) => !volume.inherited).map((volume) => volume.containerPath));
+    }
+    return paths;
+}
+// Where `path` is in the claim of `work`, relative to its root. A path is named after its
+// last segment, so claims without two such paths are laid out as they always were (a
+// service's data among them). Of the paths with the same last segment, the least deep one
+// (then the first in sorted order) keeps the name, and the others also carry a hash of
+// their path. Both go by the path
+// relative to the project, as the task's id does, so a run in another checkout directory
+// (each run of a server has its own) or with its `generates` in another order finds the
+// same folders in a kept claim.
+function getClaimSubPath(work, path) {
+    const name = (0, path_1.basename)(path) || 'root';
+    const alike = getClaimPaths(work).filter((other) => other !== path && (0, path_1.basename)(other) === (0, path_1.basename)(path));
+    if (alike.length === 0) {
+        return name;
+    }
+    const own = (0, portable_path_1.portablePath)(work.data.projectRoot, path);
+    const first = [own, ...alike.map((other) => (0, portable_path_1.portablePath)(work.data.projectRoot, other))].sort(byDepth)[0];
+    if (first === own) {
+        return name;
+    }
+    return `${name}-${(0, crypto_1.createHash)('sha256').update(own).digest('hex').slice(0, 12)}`;
+}
+exports.getClaimSubPath = getClaimSubPath;
+function byDepth(a, b) {
+    return a.split('/').length - b.split('/').length || (a < b ? -1 : a > b ? 1 : 0);
+}
+exports.byDepth = byDepth;
+// Whether two different paths of the claim of `work` end alike. Before getClaimSubPath
+// named them apart, they shared one folder, and outputs made then are mixed.
+function hasPathsEndingAlike(work) {
+    const paths = new Set(getClaimPaths(work));
+    return new Set([...paths].map((path) => (0, path_1.basename)(path))).size < paths.size;
+}
+exports.hasPathsEndingAlike = hasPathsEndingAlike;
+// Whether two outputs of `work` flatten to the same name of a cache archive (`a-b` and
+// `a/b`, see getArchivePaths). Before they were named apart, one archive held both.
+function hasOutputsFlatteningAlike(work) {
+    const data = work.data;
+    if (!('generates' in data) || !('cwd' in data)) {
+        return false;
+    }
+    const paths = new Set(data.generates.filter((generate) => !generate.inherited).map((generate) => generate.path));
+    const names = new Set([...paths].map((path) => (0, path_1.relative)(data.cwd, path).split(path_1.sep).join('-')));
+    return names.size < paths.size;
+}
+exports.hasOutputsFlatteningAlike = hasOutputsFlatteningAlike;
+//# sourceMappingURL=claim-layout.js.map

package/dist/kubernetes/ensure-http-route.js

@@ -36,7 +36,7 @@ async function ensureHttpRoute(instance, env, route, service) {
                     ],
                     backendRefs: [
                         {
-                            name: (0, resources_1.getResourceName)(service),
+                            name: (0, resources_1.getResourceName)(service, env),
                             port: route.servicePort ?? service.data.ports[0].containerPort,
                         },
                     ],

package/dist/kubernetes/ensure-kubernetes-deployment-exists.js

@@ -1,45 +1,42 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureKubernetesDeploymentExists = void 0;
-const work_item_1 = require("../planner/work-item");
+exports.ensureKubernetesDeploymentExists = exports.DEFINITION_LABEL = void 0;
+const service_definition_1 = require("../planner/service-definition");
 const work_service_1 = require("../planner/work-service");
+const volumes_1 = require("./volumes");
 const service_hostname_1 = require("../planner/utils/service-hostname");
 const apply_1 = require("./apply");
-const get_service_ip_1 = require("./get-service-ip");
 const version_1 = require("../version");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const await_running_state_1 = require("./await-running-state");
 const resources_1 = require("./resources");
 const work_healthcheck_1 = require("../planner/work-healthcheck");
 const container_resources_1 = require("./container-resources");
-async function ensureKubernetesDeploymentExists(instance, env, service, persistence, secrets, stateKey) {
-    const hostAliases = [];
-    for (const need of service.needs) {
-        if (!(0, work_item_1.isContainerWorkServiceItem)(need.service)) {
-            continue;
-        }
-        const ip = await (0, get_service_ip_1.getServiceIp)(instance, env, need.service);
-        if (!ip) {
-            throw new Error(`unable to get service ip for ${need.name}`);
-        }
-        hostAliases.push({
-            ip,
-            hostnames: [need.name],
-        });
-    }
+const job_placement_1 = require("./job-placement");
+const network_policy_1 = require("./network-policy");
+const egress_proxy_1 = require("../network/egress-proxy");
+// what the service was created from, to tell a changed one
+exports.DEFINITION_LABEL = 'hammerkit.dev/definition';
+async function ensureKubernetesDeploymentExists(instance, env, service, persistence, secrets, stateKey, 
+// the needed services by name, and the proxy of a limited network
+network) {
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(service.data.envs);
-    const name = (0, resources_1.getResourceName)(service);
+    const name = (0, resources_1.getResourceName)(service, env);
     const healthcheckCommand = (0, work_service_1.getHealthcheckCommand)(service.data);
     const serviceCommand = (0, work_service_1.getServiceCommand)(service.data, { kubernetes: true });
     const probe = healthcheckCommand
         ? {
             exec: {
-                command: healthcheckCommand,
+                // the service itself, not through the proxy (see getProxylessEnvironment)
+                command: withoutProxy(healthcheckCommand, network.env),
             },
             periodSeconds: 5,
             failureThreshold: 3,
         }
         : undefined;
+    const server = env.server;
+    const placement = server ? (0, job_placement_1.getPodPlacement)(server, undefined) : null;
+    const workspace = (0, volumes_1.getWorkspacePodSpec)(env, persistence);
     const deployment = {
         kind: 'Deployment',
         apiVersion: 'apps/v1',
@@ -50,28 +47,40 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                 'hammerkit.dev/version': (0, version_1.getVersion)(),
             },
             labels: {
-                'hammerkit.dev/id': service.id(),
+                ...(0, resources_1.getItemLabels)(service, env),
                 'hammerkit.dev/state': stateKey,
+                [exports.DEFINITION_LABEL]: (0, service_definition_1.getServiceDefinitionHash)(service),
             },
         },
         spec: {
             selector: {
-                matchLabels: {
-                    'hammerkit.dev/id': service.id(),
-                },
+                matchLabels: (0, resources_1.getItemLabels)(service, env),
             },
             replicas: 1,
             template: {
                 metadata: {
                     labels: {
-                        'hammerkit.dev/id': service.id(),
+                        ...(0, resources_1.getItemLabels)(service, env),
                         'hammerkit.dev/state': stateKey,
+                        ...workspace.labels,
+                        ...(0, network_policy_1.getNetworkLabels)(env, service),
                     },
                 },
                 spec: {
+                    ...(workspace.affinity ? { affinity: workspace.affinity } : {}),
                     // the pod resolves its own service name, as with Docker's Hostname
                     hostname: (0, service_hostname_1.getServiceHostname)(service.name),
-                    hostAliases: hostAliases,
+                    hostAliases: network.hostAliases,
+                    initContainers: network.initContainers,
+                    // on a server the pod is the build's: no token of the namespace, and the
+                    // nodes of the first pool
+                    ...(placement
+                        ? {
+                            automountServiceAccountToken: false,
+                            nodeSelector: placement.nodeSelector,
+                            tolerations: placement.tolerations,
+                        }
+                        : {}),
                     containers: [
                         {
                             name: service.name.replace(/:/, '-'),
@@ -83,6 +92,7 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                                     value: value,
                                 })),
                                 ...secrets.env,
+                                ...network.env,
                             ],
                             ...getKubernetesCommand(serviceCommand),
                             ports: service.data.ports.map((p) => ({
@@ -92,6 +102,7 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                             livenessProbe: probe,
                             ...(0, container_resources_1.getKubernetesResources)(service.data.resources),
                             volumeMounts: [...persistence.mounts.map((m) => m.mount), ...secrets.mounts],
+                            ...(0, job_placement_1.getContainerSecurity)(env),
                         },
                         {
                             name: 'debug',
@@ -99,9 +110,10 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                             command: ['sleep'],
                             args: ['3600'],
                             volumeMounts: persistence.mounts.map((m) => m.mount),
+                            ...(0, job_placement_1.getContainerSecurity)(env),
                         },
                     ],
-                    volumes: [...persistence.volumes, ...secrets.volumes],
+                    volumes: [...persistence.volumes, ...persistence.workspace, ...secrets.volumes],
                 },
             },
         },
@@ -111,7 +123,7 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
         return;
     }
     await (0, await_running_state_1.awaitDeployRunningState)(instance, env, name, {
-        podSelector: `hammerkit.dev/id=${service.id()}`,
+        podSelector: (0, resources_1.getItemSelector)(service, env),
         timeout: service.data.healthcheck?.timeout ?? null,
         timeoutMessage: service.data.healthcheck
             ? (0, work_healthcheck_1.getHealthcheckTimeoutMessage)(service.name, service.data.healthcheck)
@@ -131,4 +143,10 @@ function getKubernetesCommand(command) {
     }
     return {};
 }
+// A probe runs with the container's variables, so it empties the proxy ones
+// through `env`, as a Docker healthcheck does with the exec's own variables.
+function withoutProxy(command, env) {
+    const proxyless = (0, egress_proxy_1.getProxylessEnvironment)(Object.fromEntries(env.map((e) => [e.name, e.value ?? ''])));
+    return proxyless ? ['env', ...Object.keys(proxyless).map((key) => `${key}=`), ...command] : command;
+}
 //# sourceMappingURL=ensure-kubernetes-deployment-exists.js.map

package/dist/kubernetes/ensure-kubernetes-persistent-volume-claim-exists.js

@@ -1,9 +1,46 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureKubernetesPersistentVolumeClaimExists = void 0;
+exports.ensureKubernetesPersistentVolumeClaimExists = exports.getClaimSize = exports.DEFAULT_VOLUME_SIZE = void 0;
 const apply_1 = require("./apply");
 const version_1 = require("../version");
-async function ensureKubernetesPersistentVolumeClaimExists(instance, env, volume, service) {
+const job_placement_1 = require("./job-placement");
+const log_1 = require("../log");
+const units_1 = require("../utils/units");
+const sleep_1 = require("../utils/sleep");
+const kept_claims_1 = require("./kept-claims");
+// how long a claim that is being removed (a kept one that expired) gets to go before one
+// of its name is made again, and the kept claims of other sources when the quota is full
+const REMOVAL_TIMEOUT = 60000;
+// what the claim of a task or service requests when neither it nor the environment says
+exports.DEFAULT_VOLUME_SIZE = '1Gi';
+// The size of a claim: the work's `volumeSize`, else the environment's, at most what the
+// environment allows (a server's `maxVolumeSize`).
+function getClaimSize(env, size, name) {
+    const requested = size ?? env.volumeSize ?? exports.DEFAULT_VOLUME_SIZE;
+    if (env.maxVolumeSize && (0, units_1.parseSize)(requested) > (0, units_1.parseSize)(env.maxVolumeSize)) {
+        throw new Error(`${name} asks for a claim of ${requested}, the server allows at most ${env.maxVolumeSize}`);
+    }
+    return requested;
+}
+exports.getClaimSize = getClaimSize;
+// The size a claim requests, in bytes, as the cluster may write it back (`1Gi`, bytes)
+function getRequestedBytes(claim) {
+    const storage = claim.spec?.resources?.requests?.storage;
+    try {
+        return storage === undefined ? null : (0, units_1.parseSize)(String(storage));
+    }
+    catch {
+        return null;
+    }
+}
+// The claim of a work item, of `size` (see getClaimSize). One a run before made smaller
+// grows, where its storage class allows that; a larger one stays as it is, since a claim
+// never shrinks. A `kept` claim (see kept-claims) carries the scope of the run instead of
+// its label, and does not expire while the run mounts it.
+async function ensureKubernetesPersistentVolumeClaimExists(instance, env, volume, service, size, kept = false) {
+    const storage = getClaimSize(env, size, service.name);
+    const scope = kept ? env.server?.volumeScope : undefined;
+    const runLabel = env.server ? (0, job_placement_1.getRunLabelValue)(env.server.run) : undefined;
     const pvc = {
         kind: 'PersistentVolumeClaim',
         apiVersion: 'v1',
@@ -15,6 +52,7 @@ async function ensureKubernetesPersistentVolumeClaimExists(instance, env, volume
             },
             labels: {
                 'hammerkit.dev/id': service.id(),
+                ...(scope && runLabel ? { [kept_claims_1.VOLUME_SCOPE_LABEL]: scope, [kept_claims_1.KEPT_BY_LABEL]: runLabel } : (0, job_placement_1.getRunLabels)(env)),
             },
         },
         spec: {
@@ -22,19 +60,108 @@ async function ensureKubernetesPersistentVolumeClaimExists(instance, env, volume
             storageClassName: env.storageClass,
             resources: {
                 requests: {
-                    storage: '1Gi',
+                    storage,
                 },
             },
         },
     };
-    service.status.console('stdout', `ensure volume ${volume.name}`);
+    service.status.write('debug', `ensure volume ${volume.name}`);
     // Don't block on the PVC reaching "Bound". Storage classes with
     // volumeBindingMode WaitForFirstConsumer (docker-desktop's "standard",
     // k3d/k3s local-path, most cloud defaults) keep the claim Pending until a pod
     // mounts it — and hammerkit creates that pod (upload pod / deployment) only
     // after this call. Waiting here deadlocks until the test times out. k8s binds
     // the claim when the consuming pod is scheduled, so applying it is enough.
-    return await (0, apply_1.apply)(instance, pvc);
+    let existing = await readClaim(instance, pvc);
+    if (existing?.metadata?.deletionTimestamp) {
+        // a kept claim that expired: one of the same name is made once it is gone
+        existing = await untilRemoved(instance, pvc);
+    }
+    if (!existing) {
+        return await createClaim(instance, env, pvc);
+    }
+    if (scope) {
+        if (existing.metadata?.labels?.[kept_claims_1.VOLUME_SCOPE_LABEL] !== scope) {
+            throw new Error(`the claim ${volume.name} is not one this run may mount, it was made for another source`);
+        }
+        if (existing.metadata?.labels?.[kept_claims_1.KEPT_BY_LABEL] !== runLabel ||
+            existing.metadata?.annotations?.[kept_claims_1.EXPIRES_ANNOTATION]) {
+            // mounted by this run now: it expires at the run's end
+            existing = await instance.objectApi.patch({
+                apiVersion: pvc.apiVersion,
+                kind: pvc.kind,
+                metadata: {
+                    name: pvc.metadata.name,
+                    namespace: pvc.metadata.namespace,
+                    labels: { [kept_claims_1.KEPT_BY_LABEL]: runLabel },
+                    // null removes it
+                    annotations: { [kept_claims_1.EXPIRES_ANNOTATION]: null },
+                },
+            });
+        }
+    }
+    const current = getRequestedBytes(existing);
+    if (current === null || current >= (0, units_1.parseSize)(storage)) {
+        return existing;
+    }
+    try {
+        // the requested size is all of a bound claim's spec that may change
+        return await instance.objectApi.patch({
+            ...pvc,
+            spec: { resources: { requests: { storage } } },
+        });
+    }
+    catch (e) {
+        throw new Error(`the claim ${volume.name} has ${(0, units_1.formatSize)(current)} and ${service.name} needs ${storage}, ` +
+            `which its storage class could not grow it to (${(0, log_1.getErrorMessage)(e)}): ` +
+            'remove it with hammerkit clean and run again');
+    }
 }
 exports.ensureKubernetesPersistentVolumeClaimExists = ensureKubernetesPersistentVolumeClaimExists;
+async function createClaim(instance, env, pvc) {
+    for (let evicted = false;; evicted = true) {
+        try {
+            return await instance.objectApi.create(pvc);
+        }
+        catch (e) {
+            // Two work items can make the same claim concurrently (e.g. a volume
+            // shared between a task and a service that inherits its generates)
+            if ((0, apply_1.statusCodeOf)(e) === 409) {
+                return await instance.objectApi.read(pvc);
+            }
+            // the claims a server keeps for other sources make way under the quota
+            if (evicted || (0, apply_1.statusCodeOf)(e) !== 403 || !/exceeded quota/i.test((0, log_1.getErrorMessage)(e))) {
+                throw e;
+            }
+            const removed = await (0, kept_claims_1.evictKeptClaims)(instance, env, REMOVAL_TIMEOUT);
+            if (removed.length === 0) {
+                throw e;
+            }
+        }
+    }
+}
+async function untilRemoved(instance, pvc) {
+    const deadline = Date.now() + REMOVAL_TIMEOUT;
+    for (;;) {
+        const claim = await readClaim(instance, pvc);
+        if (!claim) {
+            return null;
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`the claim ${pvc.metadata.name} is being removed and still there after ${REMOVAL_TIMEOUT / 1000}s`);
+        }
+        await (0, sleep_1.sleep)(1000);
+    }
+}
+async function readClaim(instance, pvc) {
+    try {
+        return await instance.objectApi.read(pvc);
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) === 404) {
+            return null;
+        }
+        throw e;
+    }
+}
 //# sourceMappingURL=ensure-kubernetes-persistent-volume-claim-exists.js.map

package/dist/kubernetes/ensure-kubernetes-service-exists.js

@@ -4,8 +4,11 @@ exports.ensureKubernetesServiceExists = void 0;
 const apply_1 = require("./apply");
 const resources_1 = require("./resources");
 const version_1 = require("../version");
+// A service without ports gets a headless Service: a ClusterIP one needs a port,
+// and its tasks reach every port of the pod, as on docker.
 async function ensureKubernetesServiceExists(instance, env, service) {
-    const name = (0, resources_1.getResourceName)(service);
+    const name = (0, resources_1.getResourceName)(service, env);
+    const headless = service.data.ports.length === 0;
     const svc = {
         kind: 'Service',
         apiVersion: 'v1',
@@ -15,21 +18,34 @@ async function ensureKubernetesServiceExists(instance, env, service) {
             annotations: {
                 'hammerkit.dev/version': (0, version_1.getVersion)(),
             },
-            labels: {
-                'hammerkit.dev/id': service.id(),
-            },
+            labels: (0, resources_1.getItemLabels)(service, env),
         },
         spec: {
             type: 'ClusterIP',
-            selector: {
-                'hammerkit.dev/id': service.id(),
-            },
-            ports: service.data.ports.map((port) => ({
-                port: port.hostPort ?? port.containerPort,
-                targetPort: port.containerPort,
-            })),
+            ...(headless ? { clusterIP: 'None' } : {}),
+            // the pods of the service of this run, on a server where runs share the namespace
+            selector: (0, resources_1.getItemLabels)(service, env),
+            ...(headless
+                ? {}
+                : {
+                    ports: service.data.ports.map((port) => ({
+                        port: port.hostPort ?? port.containerPort,
+                        targetPort: port.containerPort,
+                    })),
+                }),
         },
     };
+    // the clusterIP of a Service is fixed, so one from before its ports changed goes first
+    const existing = await instance.coreApi
+        .readNamespacedService({ name, namespace: env.namespace })
+        .catch((e) => ((0, apply_1.statusCodeOf)(e) === 404 ? null : Promise.reject(e)));
+    if (existing && (existing.spec?.clusterIP === 'None') !== headless) {
+        await instance.coreApi.deleteNamespacedService({ name, namespace: env.namespace }).catch((e) => {
+            if ((0, apply_1.statusCodeOf)(e) !== 404) {
+                throw e;
+            }
+        });
+    }
     return await (0, apply_1.apply)(instance, svc);
 }
 exports.ensureKubernetesServiceExists = ensureKubernetesServiceExists;