hammerkit 1.27.0-next.3 → 1.27.0-next.31

package/dist/kubernetes/network-policy.js

@@ -17,12 +17,15 @@ const sleep_1 = require("../utils/sleep");
 const network_gate_1 = require("./network-gate");
 const job_placement_1 = require("./job-placement");
 Object.defineProperty(exports, "RUN_LABEL", { enumerable: true, get: function () { return job_placement_1.RUN_LABEL; } });
-const ID_LABEL = 'hammerkit.dev/id';
+const resources_1 = require("./resources");
 const PROXY_LABEL = 'hammerkit.dev/proxy-for';
 const NETWORK_OF_LABEL = 'hammerkit.dev/network-of';
 // on the proxy of a task on a sandbox: the sandbox, whose pod of files it stays with
 const PROXY_OF_SANDBOX_LABEL = 'hammerkit.dev/proxy-of-sandbox';
 const PROXY_READY_TIMEOUT_MS = 60000;
+// the token of the endpoints of secret providers, in a Secret named like the proxy
+const SECRET_TOKEN_KEY = 'token';
+const SECRET_TOKEN_VARIABLE = 'HAMMERKIT_PROXY_TOKEN';
 // how long the pods of an item may take to end before their policy goes
 const POD_END_TIMEOUT_MS = 120000;
 const POD_END_POLL_MS = 500;
@@ -83,7 +86,7 @@ function getNetworkPolicyName(item, scope) {
 exports.getNetworkPolicyName = getNetworkPolicyName;
 // the pods of the item, of the run when the scope has one
 function getItemPodLabels(item, scope) {
-    return { [ID_LABEL]: item.id(), ...(scope.run ? { [job_placement_1.RUN_LABEL]: scope.run } : {}) };
+    return { [resources_1.ID_LABEL]: item.id(), ...(scope.run ? { [job_placement_1.RUN_LABEL]: scope.run } : {}) };
 }
 function toSelector(labels) {
     return Object.entries(labels)
@@ -104,15 +107,20 @@ function getIngress(env, item) {
     if (ids.length === 0) {
         return [];
     }
-    const from = { matchExpressions: [{ key: ID_LABEL, operator: 'In', values: ids }] };
+    // on a server, of this run: the runs of a caller share their namespace
+    const run = (0, job_placement_1.getRunLabels)(env);
+    const from = {
+        matchExpressions: [{ key: resources_1.ID_LABEL, operator: 'In', values: ids }],
+        ...(Object.keys(run).length > 0 ? { matchLabels: run } : {}),
+    };
     // the client's name for `from`, a reserved word
     return [{ _from: [{ podSelector: from }] }];
 }
 // The NetworkPolicy of a limited item: egress to the pods of the services it
-// needs and, under `allow`, to its proxy; nothing else, DNS included (needs
-// and the proxy are host aliases). Ingress only from what needs it. An open
-// item has none.
-function buildNetworkPolicy(env, item, network, scope, proxy = getRunProxy(item, scope)) {
+// needs and, under `allow` or with secrets read through it, to its proxy;
+// nothing else, DNS included (needs and the proxy are host aliases). Ingress
+// only from what needs it. An open item has none.
+function buildNetworkPolicy(env, item, network, scope, proxy = getRunProxy(item, scope), proxied = network.type === 'allow') {
     const needs = item.needs.filter((need) => (0, work_item_1.isContainerWorkServiceItem)(need.service));
     return {
         apiVersion: 'networking.k8s.io/v1',
@@ -121,7 +129,8 @@ function buildNetworkPolicy(env, item, network, scope, proxy = getRunProxy(item,
             namespace: env.namespace,
             name: getNetworkPolicyName(item, scope),
             annotations: { 'hammerkit.dev/version': (0, version_1.getVersion)() },
-            labels: { [NETWORK_OF_LABEL]: item.id(), ...(0, job_placement_1.getRunLabels)(env) },
+            labels: { [NETWORK_OF_LABEL]: item.id(), ...(scope.owners ? {} : (0, job_placement_1.getRunLabels)(env)) },
+            ...(scope.owners ? { ownerReferences: scope.owners } : {}),
         },
         spec: {
             podSelector: { matchLabels: getItemPodLabels(item, scope) },
@@ -129,9 +138,9 @@ function buildNetworkPolicy(env, item, network, scope, proxy = getRunProxy(item,
             ingress: getIngress(env, item),
             egress: [
                 ...(needs.length > 0
-                    ? [{ to: needs.map((need) => ({ podSelector: { matchLabels: { [ID_LABEL]: need.service.id() } } })) }]
+                    ? [{ to: needs.map((need) => ({ podSelector: { matchLabels: (0, resources_1.getItemLabels)(need.service, env) } })) }]
                     : []),
-                ...(network.type === 'allow'
+                ...(proxied
                     ? [
                         {
                             to: [{ podSelector: { matchLabels: { [PROXY_LABEL]: proxy.key } } }],
@@ -179,6 +188,9 @@ exports.buildProxyPolicy = buildProxyPolicy;
 // left goes.
 // A task follows the proxy's log while its jobs run. A service outlives the
 // run on a cluster, so its refused hosts are in the proxy's own log.
+// `secretHosts` are the endpoints of the providers whose secrets the init
+// containers of a task on a server read: a limited task gets a proxy for them
+// (under `none` too), which passes them to those containers only.
 async function ensureKubernetesItemNetwork(instance, env, item, options) {
     const network = (0, work_network_1.getEffectiveNetwork)(item.data);
     if (network.type !== 'open' && !env.networkPolicyEnforced) {
@@ -191,22 +203,30 @@ async function ensureKubernetesItemNetwork(instance, env, item, options) {
             // without the rights to manage NetworkPolicies, hammerkit never made one
             await removeKubernetesItemNetwork(instance, env, item, { run: null }, { ignoreForbidden: true });
         }
-        return { env: [], hostAliases, initContainers: [], close() { } };
+        return { env: [], secretEnv: [], hostAliases, initContainers: [], close() { } };
+    }
+    const secretHosts = options.secretHosts ?? [];
+    if (secretHosts.length > 0 && options.sandbox) {
+        // a run on a sandbox uses no account, so it reads no secret of a provider
+        throw new Error(`${item.name}: a task on a sandbox reads no secret of a provider`);
     }
     const proxy = network.type === 'allow' && options.sandbox
         ? getSandboxProxy(env, item, network, hostAliases, options.sandbox)
         : getRunProxy(item, options);
-    await (0, apply_1.apply)(instance, buildNetworkPolicy(env, item, network, options, proxy));
+    const proxied = network.type === 'allow' || secretHosts.length > 0;
+    await (0, apply_1.apply)(instance, buildNetworkPolicy(env, item, network, options, proxy, proxied));
     const initContainers = [(0, network_gate_1.getNetworkGateContainer)()];
-    if (network.type === 'none') {
+    if (!proxied) {
         if (options.sandbox) {
             await removeSandboxProxies(instance, env.namespace, { sandbox: options.sandbox.label, item });
         }
         else {
             await removeProxy(instance, env.namespace, proxy.name, [404]);
         }
-        return { env: [], hostAliases, initContainers, close() { } };
+        return { env: [], secretEnv: [], hostAliases, initContainers, close() { } };
     }
+    // under `none`, a proxy for the secrets only: it allows the item no host
+    const proxyNetwork = network.type === 'allow' ? network : { type: 'allow', hosts: [] };
     let started;
     try {
         if (proxy.sandbox) {
@@ -214,7 +234,7 @@ async function ensureKubernetesItemNetwork(instance, env, item, options) {
             await removeSandboxProxies(instance, env.namespace, { sandbox: proxy.sandbox.label, item }, (deployment) => deployment.metadata?.labels?.[PROXY_LABEL] === proxy.key);
             proxy.owner = await getFilesPodOwner(instance, env, proxy.sandbox);
         }
-        started = await ensureProxy(instance, env, item, network, hostAliases, options, proxy);
+        started = await ensureProxy(instance, env, item, proxyNetwork, hostAliases, options, proxy, secretHosts);
     }
     catch (e) {
         await removeKubernetesItemNetwork(instance, env, item, options).catch(() => undefined);
@@ -223,11 +243,17 @@ async function ensureKubernetesItemNetwork(instance, env, item, options) {
     const follow = options.followLog
         ? await followProxyLog(instance, env, item, proxy, { tailLines: started.reused ? 0 : undefined })
         : null;
+    const needs = item.needs.map((need) => need.name);
+    const toEnv = (variables) => Object.entries(variables).map(([name, value]) => ({ name, value }));
     return {
-        env: Object.entries((0, egress_proxy_1.getProxyClientEnvironment)(item.needs.map((need) => need.name))).map(([name, value]) => ({
-            name,
-            value,
-        })),
+        env: network.type === 'allow' ? toEnv((0, egress_proxy_1.getProxyClientEnvironment)(needs)) : [],
+        // the token from the proxy's Secret, which the item's own container never mounts
+        secretEnv: secretHosts.length > 0
+            ? [
+                { name: SECRET_TOKEN_VARIABLE, valueFrom: { secretKeyRef: { name: proxy.name, key: SECRET_TOKEN_KEY } } },
+                ...toEnv((0, egress_proxy_1.getProxyClientEnvironment)(needs, `$(${SECRET_TOKEN_VARIABLE})`)),
+            ]
+            : [],
         // the item reaches each TCP forward under its host's name, at the proxy
         hostAliases: [
             ...hostAliases,
@@ -286,12 +312,14 @@ async function releaseKubernetesItemNetwork(instance, env, item, scope) {
 }
 exports.releaseKubernetesItemNetwork = releaseKubernetesItemNetwork;
 // Every policy and proxy of the item, of any run, once none of its pods runs:
-// what `down` and `clean` remove.
+// what `down` and `clean` remove. On a server, those of the server's run only: the
+// runs of a caller share their namespace, and the pods of another run of the same item
+// would run unlimited without their policy.
 async function removeAllKubernetesItemNetworks(instance, env, item) {
-    if (!(await awaitPodsEnded(instance, env, { [ID_LABEL]: item.id() }))) {
+    if (!(await awaitPodsEnded(instance, env, (0, resources_1.getItemLabels)(item, env)))) {
         throw new Error(`pods of ${item.name} are still running, so its network policy stays`);
     }
-    const labelSelector = `${NETWORK_OF_LABEL}=${item.id()}`;
+    const labelSelector = toSelector({ [NETWORK_OF_LABEL]: item.id(), ...(0, job_placement_1.getRunLabels)(env) });
     let policies;
     try {
         const list = await instance.objectApi.list('networking.k8s.io/v1', 'NetworkPolicy', env.namespace, undefined, undefined, undefined, undefined, labelSelector);
@@ -318,6 +346,7 @@ async function removeAllKubernetesItemNetworks(instance, env, item) {
         if (name) {
             await ignoreStatus(instance.appsApi.deleteNamespacedDeployment({ name, namespace: env.namespace }), [404]);
             await ignoreStatus(instance.coreApi.deleteNamespacedService({ name, namespace: env.namespace }), [404]);
+            await ignoreStatus(instance.coreApi.deleteNamespacedSecret({ name, namespace: env.namespace }), [404]);
         }
     }
 }
@@ -349,7 +378,7 @@ function getProxyReadinessScript(ports) {
         `.on('error', () => process.exit(1))`);
 }
 exports.getProxyReadinessScript = getProxyReadinessScript;
-async function ensureProxy(instance, env, item, network, hostAliases, scope, proxy) {
+async function ensureProxy(instance, env, item, network, hostAliases, scope, proxy, secretHosts = []) {
     const name = proxy.name;
     const labels = { [PROXY_LABEL]: proxy.key };
     const metadata = {
@@ -388,7 +417,17 @@ async function ensureProxy(instance, env, item, network, hostAliases, scope, pro
                             name: 'proxy',
                             image: egress_proxy_1.EGRESS_PROXY_IMAGE,
                             command: (0, egress_proxy_1.getEgressProxyCommand)(),
-                            env: Object.entries((0, egress_proxy_1.getItemProxyEnvironment)(item)).map(([key, value]) => ({ name: key, value })),
+                            env: [
+                                ...Object.entries({ ...(0, egress_proxy_1.getItemProxyEnvironment)(item), ...(0, egress_proxy_1.getSecretProxyEnvironment)(secretHosts) }).map(([key, value]) => ({ name: key, value })),
+                                ...(secretHosts.length > 0
+                                    ? [
+                                        {
+                                            name: 'HAMMERKIT_SECRET_TOKEN',
+                                            valueFrom: { secretKeyRef: { name, key: SECRET_TOKEN_KEY } },
+                                        },
+                                    ]
+                                    : []),
+                            ],
                             ports: (0, egress_proxy_1.getEgressProxyPorts)(network).map((port) => ({ containerPort: port })),
                             // in the pod, since its ingress policy may keep the kubelet out;
                             // ready once it listens on every port, its TCP forwards' too
@@ -422,6 +461,21 @@ async function ensureProxy(instance, env, item, network, hostAliases, scope, pro
         ? await instance.objectApi.read(deployment).then((current) => !current.metadata?.deletionTimestamp, (e) => ((0, apply_1.statusCodeOf)(e) === 404 ? false : Promise.reject(e)))
         : false;
     await (0, apply_1.apply)(instance, buildProxyPolicy(env, item, network, scope, proxy));
+    if (secretHosts.length > 0) {
+        // new with each run's proxy, and kept while it is there: its pod read it when it started.
+        // The init containers that read secrets get it, the task not.
+        const secret = {
+            apiVersion: 'v1',
+            kind: 'Secret',
+            metadata: { ...metadata, annotations: { 'hammerkit.dev/version': (0, version_1.getVersion)() } },
+            type: 'Opaque',
+            data: { [SECRET_TOKEN_KEY]: Buffer.from((0, crypto_1.randomBytes)(32).toString('hex')).toString('base64') },
+        };
+        const exists = await instance.objectApi.read(secret).then(() => true, (e) => ((0, apply_1.statusCodeOf)(e) === 404 ? false : Promise.reject(e)));
+        if (!exists) {
+            await instance.objectApi.create(secret);
+        }
+    }
     await (0, apply_1.apply)(instance, deployment);
     const created = await (0, apply_1.apply)(instance, service);
     await (0, await_running_state_1.awaitDeployRunningState)(instance, env, name, {
@@ -433,7 +487,7 @@ async function ensureProxy(instance, env, item, network, hostAliases, scope, pro
     if (!ip) {
         throw new Error(`the egress proxy of ${item.name} has no cluster ip`);
     }
-    item.status.write('debug', `${reused ? 'egress proxy of the sandbox' : 'egress proxy'} allows ${network.hosts.join(', ') || 'no host'}`);
+    item.status.write('debug', `${reused ? 'egress proxy of the sandbox' : 'egress proxy'} allows ${network.hosts.join(', ') || 'no host'}${secretHosts.length > 0 ? `, and ${secretHosts.join(', ')} to the reads of secrets` : ''}`);
     return { ip, reused };
 }
 // Refused hosts show up in the item's log, as on Docker; of a proxy from an
@@ -468,9 +522,13 @@ async function followProxyLog(instance, env, item, proxy, options) {
         return null;
     }
 }
-async function removeProxy(instance, namespace, name, ignored) {
+// The token of a proxy for secrets goes with it; a proxy of a sandbox has none.
+async function removeProxy(instance, namespace, name, ignored, options = { token: true }) {
     await ignoreStatus(instance.appsApi.deleteNamespacedDeployment({ name, namespace }), ignored);
     await ignoreStatus(instance.coreApi.deleteNamespacedService({ name, namespace }), ignored);
+    if (options.token) {
+        await ignoreStatus(instance.coreApi.deleteNamespacedSecret({ name, namespace }), ignored);
+    }
     await ignoreStatus(instance.objectApi.delete({
         apiVersion: 'networking.k8s.io/v1',
         kind: 'NetworkPolicy',
@@ -492,7 +550,7 @@ async function removeSandboxProxies(instance, namespace, of, keep = () => false)
     for (const deployment of deployments.items) {
         const name = deployment.metadata?.name;
         if (name && !keep(deployment)) {
-            await removeProxy(instance, namespace, name, [404]);
+            await removeProxy(instance, namespace, name, [404], { token: false });
         }
     }
 }

package/dist/kubernetes/remove-persistent-data.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removePersistentData = void 0;
+const resources_1 = require("./resources");
 async function removePersistentData(instance, kubernetes, task) {
-    const labelSelector = `hammerkit.dev/id=${task.id()}`;
+    // on a server, the run's: a claim it kept has no run label and goes once it expired
+    const labelSelector = (0, resources_1.getItemSelector)(task, kubernetes);
     const configmaps = await instance.coreApi.listNamespacedConfigMap({ namespace: kubernetes.namespace, labelSelector });
     for (const configMap of configmaps.items) {
         if (configMap.metadata?.name) {

package/dist/kubernetes/resources.js

@@ -1,12 +1,34 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.removeInvalidCharacters = exports.getResourceName = void 0;
+exports.removeInvalidCharacters = exports.getResourceName = exports.getItemSelector = exports.getItemLabels = exports.getItemKey = exports.ID_LABEL = void 0;
+const job_placement_1 = require("./job-placement");
 // An object name is a DNS label: lowercase letters, digits and `-`, at most 63
 // characters, starting and ending with a letter or digit. The id makes a name
 // unique; the item's name is there for people and is cut to fit.
 const MAX_NAME = 63;
-function getResourceName(item, suffix) {
-    const tail = `-${item.id()}${suffix ?? ''}`;
+exports.ID_LABEL = 'hammerkit.dev/id';
+// What tells the objects of an item apart in its namespace: its id, and on a server the
+// run's label too. The runs of a caller execute side by side in their namespace, and two
+// of them often run the same task (the same command on two sandboxes of a repository),
+// so each has objects of its own, which nothing of the other run finds or removes. The
+// first 8 digits of the run label tell runs apart, as they do for a run's proxies.
+function getItemKey(item, env) {
+    return env.server ? `${item.id().substring(0, 32)}-${(0, job_placement_1.getRunLabelValue)(env.server.run).substring(0, 8)}` : item.id();
+}
+exports.getItemKey = getItemKey;
+// The labels the objects of an item carry, by which they are found again
+function getItemLabels(item, env) {
+    return { [exports.ID_LABEL]: item.id(), ...(0, job_placement_1.getRunLabels)(env) };
+}
+exports.getItemLabels = getItemLabels;
+function getItemSelector(item, env) {
+    return Object.entries(getItemLabels(item, env))
+        .map(([key, value]) => `${key}=${value}`)
+        .join(',');
+}
+exports.getItemSelector = getItemSelector;
+function getResourceName(item, env, suffix) {
+    const tail = `-${getItemKey(item, env)}${suffix ?? ''}`;
     const name = removeInvalidCharacters(item.name)
         .slice(0, Math.max(0, MAX_NAME - tail.length))
         .replace(/-+$/, '');

package/dist/kubernetes/restore-kubernetes-data.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.restoreKubernetesData = void 0;
+exports.restoreKubernetesData = exports.getRestoreTarget = void 0;
 const event_cache_1 = require("../executer/event-cache");
 const log_1 = require("../log");
-const path_1 = require("path");
 const volumes_1 = require("./volumes");
 const ensure_persistent_data_1 = require("./ensure-persistent-data");
+const claim_layout_1 = require("./claim-layout");
+// Where the upload pod (which mounts the work's claim at /dev/hammerkit/<id>) unpacks the
+// archive of an output: the output's place in the claim, which its mount reads
+function getRestoreTarget(work, path) {
+    return `/dev/hammerkit/${work.id()}/${(0, claim_layout_1.getClaimSubPath)(work, path)}`;
+}
+exports.getRestoreTarget = getRestoreTarget;
 async function restoreKubernetesData(work, kubernetes, instance, environment, path, 
 // the kept claim of the work holds what an earlier run left, which goes first
 options = {}) {
@@ -18,7 +24,7 @@ options = {}) {
             if (!(await environment.file.exists(generatedArchive.filename))) {
                 continue;
             }
-            const targetPath = `/dev/hammerkit/${work.id()}/${(0, path_1.basename)(generatedArchive.path)}`;
+            const targetPath = getRestoreTarget(work, generatedArchive.path);
             // a claim made for this run (a server removes the claims of a run when it
             // ends) does not have the directory of the output yet
             let failure = null;