hammerkit 1.26.0 → 1.27.0-next.10

package/dist/kubernetes/ensure-persistent-data.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensurePersistentData = exports.getPodForPersistence = void 0;
+exports.ensurePersistentData = exports.packSource = exports.clearClaim = exports.getPodForPersistence = void 0;
 const apply_1 = require("./apply");
 const path_1 = require("path");
-const tar_1 = require("tar");
+const tar_1 = require("../utils/tar");
 const resources_1 = require("./resources");
 const await_running_state_1 = require("./await-running-state");
 const sleep_1 = require("../utils/sleep");
@@ -11,6 +11,8 @@ const version_1 = require("../version");
 const log_1 = require("../log");
 const ensure_kubernetes_persistent_volume_claim_exists_1 = require("./ensure-kubernetes-persistent-volume-claim-exists");
 const stream_1 = require("stream");
+const job_placement_1 = require("./job-placement");
+const assert_item_paths_1 = require("../planner/utils/assert-item-paths");
 // A previous run that crashed between creating an upload/download pod and its
 // `finally` cleanup leaves a pod behind under the same deterministic name. apply()
 // would then patch that stale pod in place — and if it is stuck in a terminal
@@ -43,9 +45,12 @@ async function getPodForPersistence(instance, env, service, persistence, type, f
     if (persistence.volumes.length === 0) {
         return;
     }
+    // the claim of a sandbox is mounted by the pods of the work only: it holds no output
+    // and takes no upload
+    const own = persistence.mounts.filter((m) => !m.workspace);
     const mounts = type === 'read'
-        ? persistence.mounts.map((m) => m.mount)
-        : persistence.mounts.reduce((array, v) => {
+        ? own.map((m) => m.mount)
+        : own.reduce((array, v) => {
             if (!array.some((i) => i.name === v.mount.name)) {
                 array.push({
                     mountPath: v.uploadPath,
@@ -60,23 +65,29 @@ async function getPodForPersistence(instance, env, service, persistence, type, f
     // function directly, and a claim shared with another work item can be removed
     // concurrently — without this the pod would hang Pending on "pvc not found".
     for (const volume of persistence.volumes) {
-        await (0, ensure_kubernetes_persistent_volume_claim_exists_1.ensureKubernetesPersistentVolumeClaimExists)(instance, env, volume, service);
+        await (0, ensure_kubernetes_persistent_volume_claim_exists_1.ensureKubernetesPersistentVolumeClaimExists)(instance, env, volume, service, persistence.sizes[volume.name], persistence.kept.includes(volume.name));
     }
-    const name = (0, resources_1.getResourceName)(service, type === 'write' ? '-upload' : '-download');
+    const name = (0, resources_1.getResourceName)(service, env, type === 'write' ? '-upload' : '-download');
     const podSpec = {
         kind: 'Pod',
         apiVersion: 'v1',
         metadata: {
             namespace: env.namespace,
             name,
-            labels: {
-                'hammerkit.dev/id': service.id(),
-            },
+            labels: (0, resources_1.getItemLabels)(service, env),
             annotations: {
                 'hammerkit.dev/version': (0, version_1.getVersion)(),
             },
         },
         spec: {
+            // on a server the claims are bound where the pod of the task can go: the nodes
+            // of its pool
+            ...(env.server
+                ? {
+                    automountServiceAccountToken: false,
+                    ...(0, job_placement_1.getPodPlacement)(env.server, 'pool' in service.data ? service.data.pool : undefined),
+                }
+                : {}),
             containers: [
                 {
                     name: 'volume',
@@ -84,52 +95,92 @@ async function getPodForPersistence(instance, env, service, persistence, type, f
                     command: ['sh'],
                     tty: true,
                     volumeMounts: mounts,
+                    ...(0, job_placement_1.getContainerSecurity)(env),
                 },
             ],
             volumes: persistence.volumes,
         },
     };
-    service.status.console('stdout', `create pod ${name}`);
+    service.status.write('debug', `create pod ${name}`);
     await removeStalePod(instance, env.namespace, name);
     const pod = await (0, apply_1.apply)(instance, podSpec);
     if (pod.status?.phase !== 'Running') {
-        service.status.console('stdout', `await running state ${name}`);
+        service.status.write('debug', `await running state ${name}`);
         await (0, await_running_state_1.awaitRunningState)(instance, env, name, 'Running');
     }
     try {
         await fn(name);
     }
     finally {
-        service.status.console('stdout', `delete pod ${name}`);
+        service.status.write('debug', `delete pod ${name}`);
         await instance.coreApi.deleteNamespacedPod({ name, namespace: env.namespace });
     }
 }
 exports.getPodForPersistence = getPodForPersistence;
-async function ensurePersistentData(instance, env, environment, service, persistence) {
+// Empties the claim of `work` in an upload pod: a kept claim an earlier run left, before
+// the task runs on it or outputs are restored into it, so it holds what a new one would
+async function clearClaim(instance, env, work, pod) {
+    const targetPath = `/dev/hammerkit/${work.id()}`;
+    work.status.write('info', `clear what an earlier run left in ${targetPath}`);
+    let failure = null;
+    const res = await instance.exec.exec(env.namespace, pod, 'volume', ['find', targetPath, '-mindepth', '1', '-maxdepth', '1', '-exec', 'rm', '-rf', '{}', '+'], process.stdout, process.stderr, null, false, (status) => {
+        if (status.status !== 'Success') {
+            failure = status.message ?? status.reason ?? 'unknown';
+        }
+    });
+    await new Promise((resolve, reject) => {
+        res.on('error', reject);
+        res.on('close', () => failure ? reject(new Error(`unable to clear ${targetPath} in ${pod}: ${failure}`)) : resolve());
+    });
+}
+exports.clearClaim = clearClaim;
+// The archive that uploads a source into the claim: its file or directory, at its place in
+// the claim (see getClaimSubPath) instead of under its own name
+function packSource(source) {
+    const fileItem = (0, path_1.basename)(source.localPath);
+    return stream_1.Readable.from((0, tar_1.packArchive)({
+        cwd: (0, path_1.dirname)(source.localPath),
+        filter(path) {
+            return source.matcher(path, source.localPath);
+        },
+        onWriteEntry(entry) {
+            entry.path = source.subPath + entry.path.slice(fileItem.length);
+            // the second of two hard-linked files links to the first by its path in the archive
+            if (entry.type === 'Link' && entry.linkpath?.startsWith(fileItem)) {
+                entry.linkpath = source.subPath + entry.linkpath.slice(fileItem.length);
+            }
+        },
+    }, [fileItem]));
+}
+exports.packSource = packSource;
+async function ensurePersistentData(instance, env, environment, service, persistence, 
+// the kept claim of the work holds what an earlier run left, which goes first
+options = {}) {
+    // what a run of a server uploads comes from its checkout and nowhere else
+    if (environment.hosted) {
+        await (0, assert_item_paths_1.assertItemPathsWithinRoot)(service, environment.cwd);
+    }
     // Dedupe of already-uploaded state (skip the upload when the persisted state
     // key still matches) needs an in-cluster state marker per volume — deferred
     // post-1.6.0, tracked in FOLLOWUPS.md alongside the volumes.ts stateKey/matcher.
     for (const volume of persistence.volumes) {
-        await (0, ensure_kubernetes_persistent_volume_claim_exists_1.ensureKubernetesPersistentVolumeClaimExists)(instance, env, volume, service);
+        await (0, ensure_kubernetes_persistent_volume_claim_exists_1.ensureKubernetesPersistentVolumeClaimExists)(instance, env, volume, service, persistence.sizes[volume.name], persistence.kept.includes(volume.name));
     }
-    if (persistence.sources.length === 0) {
+    if (persistence.sources.length === 0 && !options.reset) {
         return;
     }
-    service.status.console('stdout', 'start upload container');
+    service.status.write('debug', 'start upload container');
     await getPodForPersistence(instance, env, service, persistence, 'write', async (name) => {
+        if (options.reset) {
+            await clearClaim(instance, env, service, name);
+        }
         for (const source of persistence.sources) {
             // skip sources that don't exist on disk — nothing to upload
             if (!(await environment.file.exists(source.localPath))) {
                 continue;
             }
-            const fileItem = (0, path_1.basename)(source.localPath);
-            const data = stream_1.Readable.from((0, tar_1.create)({
-                cwd: (0, path_1.dirname)(source.localPath),
-                filter(path) {
-                    return source.matcher(path, source.localPath);
-                },
-            }, [fileItem]));
-            service.status.console('stdout', `upload ${source.localPath}`);
+            const data = packSource(source);
+            service.status.write('info', `upload ${source.localPath}`);
             const targetPath = `/dev/hammerkit/${service.id()}`;
             const res = await instance.exec.exec(env.namespace, name, 'volume', ['tar', 'xf', '-', '-C', targetPath], process.stdout, process.stderr, data, false, (status) => {
                 service.status.write('debug', `upload ${source.localPath} to ${name}: ${status}`);

package/dist/kubernetes/get-service-ip.js

@@ -2,10 +2,24 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getServiceIp = void 0;
 const resources_1 = require("./resources");
+// The address a task reaches the service on: its clusterIP, or for a headless
+// Service (a service without ports) the address of its ready pod.
 async function getServiceIp(instance, env, workService) {
-    const name = (0, resources_1.getResourceName)(workService);
+    const name = (0, resources_1.getResourceName)(workService, env);
     const svc = await instance.coreApi.readNamespacedService({ name, namespace: env.namespace });
-    return svc.spec?.clusterIP ?? null;
+    const clusterIP = svc.spec?.clusterIP ?? null;
+    if (clusterIP !== 'None') {
+        return clusterIP;
+    }
+    const pods = await instance.coreApi.listNamespacedPod({
+        namespace: env.namespace,
+        labelSelector: (0, resources_1.getItemSelector)(workService, env),
+    });
+    const ready = pods.items.find((pod) => !pod.metadata?.deletionTimestamp &&
+        pod.status?.podIP &&
+        pod.status.conditions?.some((c) => c.type === 'Ready' && c.status === 'True'));
+    const running = ready ?? pods.items.find((pod) => !pod.metadata?.deletionTimestamp && pod.status?.podIP);
+    return running?.status?.podIP ?? null;
 }
 exports.getServiceIp = getServiceIp;
 //# sourceMappingURL=get-service-ip.js.map

package/dist/kubernetes/job-placement.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getContainerSecurity = exports.getRunLabels = exports.getRunLabelValue = exports.RUN_LABEL = exports.getPodPlacement = exports.placeOnPool = exports.getNodeArch = exports.runInToolImage = exports.getLocalTaskPool = void 0;
+const crypto_1 = require("crypto");
+/**
+ * The pool a local task runs on: the first that offers its platform. A pool says
+ * `linux` with `amd64` or `arm64`, so a task that names another platform has none.
+ */
+function getLocalTaskPool(server, name, platform) {
+    if (platform?.os === 'macos' || platform?.os === 'win') {
+        throw new Error(`task ${name}: runs on ${platform.os === 'win' ? 'Windows' : 'macOS'}, this server runs tasks on Linux nodes`);
+    }
+    if (platform?.arch === 'arm') {
+        throw new Error(`task ${name}: runs on arm, the pools of this server offer amd64 and arm64`);
+    }
+    const pools = server.pools.filter((pool) => !platform?.arch || pool.platform.arch === platform.arch);
+    const pool = pools.find((candidate) => candidate.toolImage);
+    if (!pool) {
+        throw new Error(`task ${name}: a local task runs in the toolImage of a pool, and no pool${platform?.arch ? ` for ${platform.arch}` : ''} of this server has one`);
+    }
+    return pool;
+}
+exports.getLocalTaskPool = getLocalTaskPool;
+/**
+ * A local task on a cluster: a container of the pool's tool image, which runs its
+ * commands in the same directories as a container task would.
+ */
+function runInToolImage(task, server, platform) {
+    const pool = getLocalTaskPool(server, task.name, platform);
+    return {
+        ...task,
+        type: 'container-task',
+        image: pool.toolImage,
+        user: null,
+        mounts: [],
+        volumeSize: null,
+        pool: pool.name,
+        arch: getNodeArch(pool),
+    };
+}
+exports.runInToolImage = runInToolImage;
+// The architecture of a pool's nodes as process.arch names it, so a cache entry made on
+// amd64 nodes is never restored on arm64 ones
+function getNodeArch(pool) {
+    return pool.platform.arch === 'amd64' ? 'x64' : pool.platform.arch;
+}
+exports.getNodeArch = getNodeArch;
+// A task on a server's cluster: a container task runs on the first pool
+function placeOnPool(task, server) {
+    return task.arch ? task : { ...task, arch: getNodeArch(server.pools[0]) };
+}
+exports.placeOnPool = placeOnPool;
+// Where the pod of a task goes: its pool's nodes, the first pool unless a local task
+// chose another.
+function getPodPlacement(server, pool) {
+    const chosen = server.pools.find((candidate) => candidate.name === pool) ?? server.pools[0];
+    return {
+        nodeSelector: {
+            'kubernetes.io/os': chosen.platform.os,
+            'kubernetes.io/arch': chosen.platform.arch,
+            ...chosen.nodeSelector,
+        },
+        tolerations: chosen.tolerations,
+    };
+}
+exports.getPodPlacement = getPodPlacement;
+// On a server everything made for a run carries its id, so the server removes all of
+// it when the run ends, and a NetworkPolicy can select the pods of a run.
+exports.RUN_LABEL = 'hammerkit.dev/run';
+/**
+ * The value of the run label. A run id is base64url and may end in `-` or `_`, which a
+ * label value can't, so the label carries a hex digest of it.
+ */
+function getRunLabelValue(run) {
+    return (0, crypto_1.createHash)('sha256').update(run).digest('hex').slice(0, 40);
+}
+exports.getRunLabelValue = getRunLabelValue;
+function getRunLabels(kubernetes) {
+    return kubernetes.server ? { [exports.RUN_LABEL]: getRunLabelValue(kubernetes.server.run) } : {};
+}
+exports.getRunLabels = getRunLabels;
+/**
+ * What a container of a run may do on a server, where it shares nodes with the pods of
+ * other callers: no privilege escalation (setuid binaries such as sudo), no raw sockets
+ * (spoofing on a bridge network) and the runtime's seccomp profile.
+ */
+function getContainerSecurity(kubernetes) {
+    return kubernetes.server
+        ? {
+            securityContext: {
+                allowPrivilegeEscalation: false,
+                capabilities: { drop: ['NET_RAW'] },
+                seccompProfile: { type: 'RuntimeDefault' },
+            },
+        }
+        : {};
+}
+exports.getContainerSecurity = getContainerSecurity;
+//# sourceMappingURL=job-placement.js.map

package/dist/kubernetes/job-secrets.js

@@ -0,0 +1,320 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getJobSecretSpec = exports.removeJobCredentials = exports.assertJobAccounts = exports.ensureJobCredentials = exports.getCredentialsName = exports.getSecretHosts = exports.splitJobSecrets = exports.ACCOUNT_PATH = exports.SECRET_VALUES_PATH = void 0;
+const work_secret_1 = require("../planner/work-secret");
+const command_secret_provider_1 = require("../secrets/command-secret-provider");
+const task_arguments_1 = require("../planner/utils/task-arguments");
+const version_1 = require("../version");
+const apply_1 = require("./apply");
+const resources_1 = require("./resources");
+const job_placement_1 = require("./job-placement");
+const work_network_1 = require("../planner/work-network");
+// Where the values are in the pod (an in-memory volume), and where the init container
+// of a secret finds the credential of its account
+exports.SECRET_VALUES_PATH = '/var/run/hammerkit/secrets';
+exports.ACCOUNT_PATH = '/var/run/hammerkit/account';
+const VALUES_VOLUME = 'hammerkit-secret-values';
+// a token is made for each Job right before it is created; it has to outlast the
+// time its pod waits for a node
+const TOKEN_SECONDS = 3600;
+/**
+ * Which secrets of a task the Job reads itself. On a server's cluster the secrets of
+ * a provider are read in the Job, by an init container per secret with only its
+ * account's credential, so the server holds no secret manager credential and sees no
+ * value. The others (`env:`, the server's own variables) are handed over in a Secret
+ * of the task, as without a server.
+ */
+function splitJobSecrets(secrets, server) {
+    if (!server) {
+        return { delivered: secrets, inJob: [] };
+    }
+    const delivered = [];
+    const inJob = [];
+    for (const secret of secrets) {
+        if (secret.source.type === 'provider') {
+            inJob.push({ index: inJob.length, secret, source: secret.source });
+        }
+        else {
+            delivered.push(secret);
+        }
+    }
+    return { delivered, inJob };
+}
+exports.splitJobSecrets = splitJobSecrets;
+/**
+ * The init containers that read secrets share the pod, and so the NetworkPolicy, of
+ * the task: under a limited network they reach the secret manager only through the
+ * task's egress proxy, which lets them reach the endpoints the server names for the
+ * provider (`backend.providers.<name>.allow`). A task that reads a secret of a provider
+ * without them keeps an open network. Answers the endpoints the proxy lets through.
+ */
+function getSecretHosts(task, secrets, server, network = (0, work_network_1.getEffectiveNetwork)(task.data)) {
+    if (!server || secrets.length === 0 || network.type === 'open') {
+        return [];
+    }
+    const unreachable = secrets.find((secret) => !server.providers[secret.source.provider]?.allow?.length);
+    if (unreachable) {
+        throw new Error(`task ${task.name}: secret ${(0, work_secret_1.getSecretName)(unreachable.secret)} is read from ${(0, work_secret_1.describeSecretSource)(unreachable.secret)} in the Job of the task, which network ${(0, work_network_1.formatNetwork)(network)} would cut off from it; ` +
+            `on this cluster a task that reads secrets of ${unreachable.source.provider} keeps an open network, ` +
+            `unless the server names its endpoints in backend.providers.${unreachable.source.provider}.allow`);
+    }
+    return [...new Set(secrets.flatMap((secret) => server.providers[secret.source.provider].allow ?? []))].sort();
+}
+exports.getSecretHosts = getSecretHosts;
+// The accounts of the secrets, in the order they are first read
+function accountsOf(secrets) {
+    return [...new Set(secrets.map((s) => s.source.account))];
+}
+function getCredentialsName(item, kubernetes) {
+    return (0, resources_1.getResourceName)(item, kubernetes, '-credentials');
+}
+exports.getCredentialsName = getCredentialsName;
+// The keys of the credentials Secret: `<account>.token` and `<account>.file.<key>`
+function tokenKey(account) {
+    return `${account}.token`;
+}
+function fileKey(account, key) {
+    return `${account}.file.${key}`;
+}
+/**
+ * The credentials the init containers need, in a Secret of the task that only they
+ * mount: per account, a short-lived token of its ServiceAccount and the files of its
+ * Secret, both from the server's namespace. Removed with the task's other Secret.
+ */
+async function ensureJobCredentials(instance, kubernetes, item, secrets, admitted) {
+    const server = kubernetes.server;
+    const files = {};
+    if (!server || secrets.length === 0) {
+        return files;
+    }
+    assertJobAccounts(secrets, server, admitted);
+    const data = {};
+    for (const account of accountsOf(secrets)) {
+        const credentials = server.accounts[account];
+        files[account] = [];
+        if (credentials.serviceAccount) {
+            const response = await instance.coreApi.createNamespacedServiceAccountToken({
+                name: credentials.serviceAccount,
+                namespace: server.namespace,
+                body: {
+                    spec: {
+                        audiences: credentials.audience ? [credentials.audience] : [],
+                        expirationSeconds: TOKEN_SECONDS,
+                    },
+                },
+            });
+            const token = response.status?.token;
+            if (!token) {
+                throw new Error(`no token was issued for the ServiceAccount ${credentials.serviceAccount} of ${account}`);
+            }
+            data[tokenKey(account)] = Buffer.from(token, 'utf8').toString('base64');
+            files[account].push({ key: tokenKey(account), path: 'token' });
+        }
+        if (credentials.secret) {
+            let content;
+            try {
+                const secret = await instance.coreApi.readNamespacedSecret({
+                    name: credentials.secret,
+                    namespace: server.namespace,
+                });
+                content = secret.data ?? {};
+            }
+            catch (e) {
+                if ((0, apply_1.statusCodeOf)(e) === 404) {
+                    throw new Error(`the Secret ${credentials.secret} of ${account} is not in ${server.namespace}`);
+                }
+                throw e;
+            }
+            for (const [key, value] of Object.entries(content)) {
+                data[fileKey(account, key)] = value;
+                files[account].push({ key: fileKey(account, key), path: key });
+            }
+        }
+    }
+    const spec = {
+        kind: 'Secret',
+        apiVersion: 'v1',
+        metadata: {
+            namespace: kubernetes.namespace,
+            name: getCredentialsName(item, kubernetes),
+            annotations: { 'hammerkit.dev/version': (0, version_1.getVersion)() },
+            labels: (0, resources_1.getItemLabels)(item, kubernetes),
+        },
+        type: 'Opaque',
+        data,
+    };
+    await (0, apply_1.apply)(instance, spec);
+    return files;
+}
+exports.ensureJobCredentials = ensureJobCredentials;
+/**
+ * Refuses a secret of an account the run was not admitted for, or of one without a
+ * credential on the cluster: its command would run as whatever the node or the image
+ * of the provider is, which every account shares. Before anything is minted or copied.
+ */
+function assertJobAccounts(secrets, server, admitted) {
+    for (const { secret, source } of secrets) {
+        const label = `secret ${(0, work_secret_1.getSecretName)(secret)} (${(0, work_secret_1.describeSecretSource)(secret)})`;
+        if (admitted && !admitted.includes(source.account)) {
+            throw new Error(`${label}: the run was not admitted for the account ${source.account}`);
+        }
+        if (!server.accounts[source.account]) {
+            throw new Error(`${label}: the account ${source.account} has no credential on this cluster (accounts.${source.account}.kubernetes)`);
+        }
+    }
+}
+exports.assertJobAccounts = assertJobAccounts;
+async function removeJobCredentials(instance, kubernetes, item) {
+    if (!kubernetes.server) {
+        return;
+    }
+    try {
+        await instance.coreApi.deleteNamespacedSecret({
+            name: getCredentialsName(item, kubernetes),
+            namespace: kubernetes.namespace,
+        });
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) !== 404) {
+            throw e;
+        }
+    }
+}
+exports.removeJobCredentials = removeJobCredentials;
+// A string as one word of a POSIX shell
+function quote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * What the pod of a task needs to read its secrets itself. Each secret gets an init
+ * container in the image of its provider, which runs the provider's command (no
+ * shell between the reference and the command) with the provider's and its
+ * account's variables and the account's credential under /var/run/hammerkit/account,
+ * and writes the value verbatim into a volume in memory. The task's container mounts
+ * that volume only: a `path` secret is the file itself, an `env` secret is exported
+ * from it, and the task's output is masked before it leaves the pod, since the
+ * server, which masks everything else, never sees these values.
+ */
+function getJobSecretSpec(item, secrets, server, credentials, environment, 
+// under a limited network, what sends their requests through the egress proxy
+proxyEnv = []) {
+    if (!server || secrets.length === 0) {
+        return {
+            initContainers: [],
+            volumes: [],
+            mounts: [],
+            command: (shell, cmd) => ({ command: [shell, '-c'], args: [cmd], env: [] }),
+        };
+    }
+    const volumes = [{ name: VALUES_VOLUME, emptyDir: { medium: 'Memory' } }];
+    // a volume per account with only its keys, mounted by the init containers of its secrets
+    const accountVolume = new Map();
+    accountsOf(secrets).forEach((account, index) => {
+        const items = credentials[account] ?? [];
+        if (items.length === 0) {
+            return;
+        }
+        const name = `hammerkit-account-${index}`;
+        accountVolume.set(account, name);
+        volumes.push({ name, secret: { secretName: getCredentialsName(item, { server }), items, defaultMode: 0o444 } });
+    });
+    const initContainers = secrets.map(({ index, secret, source }) => {
+        const label = `secret ${(0, work_secret_1.getSecretName)(secret)} (${(0, work_secret_1.describeSecretSource)(secret)})`;
+        // what the run was admitted for, as when the server reads a secret itself
+        const allowed = environment.hosted?.accounts;
+        if (allowed && !allowed.includes(source.account)) {
+            throw new Error(`${label}: the run was not admitted for the account ${source.account}`);
+        }
+        const image = server.providers[source.provider]?.image;
+        if (!image) {
+            throw new Error(`${label}: this server names no image for the provider ${source.provider}`);
+        }
+        const { command, args, env } = (0, command_secret_provider_1.getProviderInvocation)(source.binding, source.ref, environment);
+        const volume = accountVolume.get(source.account);
+        return {
+            name: `secret-${index}`,
+            image,
+            // the value as the command prints it, written once it is complete
+            command: [
+                'sh',
+                '-c',
+                'umask 022 && "$@" > "$HAMMERKIT_VALUE.part" && mv "$HAMMERKIT_VALUE.part" "$HAMMERKIT_VALUE"',
+            ],
+            // Kubernetes would expand a `$(NAME)` of the container's env in them, the proxy's token
+            // among them: the reference is text, as on any other backend
+            args: ['sh', command, ...args].map(task_arguments_1.escapeKubernetesText),
+            env: [
+                ...proxyEnv,
+                ...Object.entries(env).map(([name, value]) => ({ name, value })),
+                { name: 'HAMMERKIT_VALUE', value: `${exports.SECRET_VALUES_PATH}/secret-${index}` },
+            ],
+            volumeMounts: [
+                { name: VALUES_VOLUME, mountPath: exports.SECRET_VALUES_PATH },
+                ...(volume ? [{ name: volume, mountPath: exports.ACCOUNT_PATH, readOnly: true }] : []),
+            ],
+            ...(0, job_placement_1.getContainerSecurity)({ server }),
+        };
+    });
+    const mounts = [{ name: VALUES_VOLUME, mountPath: exports.SECRET_VALUES_PATH }];
+    const exportLines = [];
+    for (const { index, secret } of secrets) {
+        if (secret.target.type === 'file') {
+            mounts.push({ name: VALUES_VOLUME, mountPath: secret.target.path, subPath: `secret-${index}`, readOnly: true });
+        }
+        else {
+            // verbatim: the x keeps the trailing newlines command substitution would drop
+            const name = secret.target.name;
+            exportLines.push(`${name}="$(cat "$HAMMERKIT_SECRETS/secret-${index}"; printf x)" && ${name}="\${${name}%x}" && export ${name}`);
+        }
+    }
+    const script = [
+        ...exportLines,
+        `command -v awk >/dev/null 2>&1 || { echo 'hammerkit: the image has no awk, which masks the secrets of this task in its output' >&2; exit 127; }`,
+        `{ "$HAMMERKIT_SHELL" -c "$HAMMERKIT_CMD"; echo $? > "$HAMMERKIT_SECRETS/.status"; } 2>&1 | awk -v dir="$HAMMERKIT_SECRETS" -v count=${secrets.length} ${quote(MASK_PROGRAM)}`,
+        `exit "$(cat "$HAMMERKIT_SECRETS/.status" 2>/dev/null || echo 1)"`,
+    ].join('\n');
+    return {
+        initContainers,
+        volumes,
+        mounts,
+        command: (shell, cmd) => ({
+            command: [shell, '-c'],
+            args: [script],
+            env: [
+                { name: 'HAMMERKIT_SECRETS', value: exports.SECRET_VALUES_PATH },
+                { name: 'HAMMERKIT_SHELL', value: shell },
+                { name: 'HAMMERKIT_CMD', value: cmd },
+            ],
+        }),
+    };
+}
+exports.getJobSecretSpec = getJobSecretSpec;
+// Every line of every value (trimmed, 4 characters or more, like the server's own
+// masking) is replaced by *** in each line of output. index() and not a regular
+// expression, so a value is matched as written.
+const MASK_PROGRAM = `
+function mask(s, v,   out, i) {
+  out = ""
+  while ((i = index(s, v)) > 0) { out = out substr(s, 1, i - 1) "***"; s = substr(s, i + length(v)) }
+  return out s
+}
+BEGIN {
+  n = 0
+  for (k = 0; k < count; k++) {
+    f = dir "/secret-" k
+    while ((getline line < f) > 0) {
+      gsub(/^[ \\t\\r]+|[ \\t\\r]+$/, "", line)
+      if (length(line) >= 4) values[n++] = line
+    }
+    close(f)
+  }
+  # longest first, so a value that holds another is masked as a whole
+  for (a = 0; a < n; a++) for (b = a + 1; b < n; b++) if (length(values[b]) > length(values[a])) { t = values[a]; values[a] = values[b]; values[b] = t }
+}
+{
+  out = $0
+  for (k = 0; k < n; k++) out = mask(out, values[k])
+  print out
+  fflush()
+}`;
+//# sourceMappingURL=job-secrets.js.map