techbro 0.0.0-stage → 0.5.0

package/src/kube-project.js

@@ -0,0 +1,468 @@
+// Project-level Kubernetes operations: manifest generation, in-cluster build, deploy.
+// Never reads secret values; secrets are referenced by name only. No YAML dependency.
+import { spawn } from "node:child_process";
+import { createReadStream } from "node:fs";
+import { link, lstat, mkdir, mkdtemp, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { kubeArgs, kubectl, validateName } from "./kube.js";
+
+const need = (ok, msg) => {
+  if (!ok) throw new Error(msg);
+};
+const IMAGE_RE =
+  /^[a-z0-9]([a-z0-9._-]*[a-z0-9])?(:[0-9]+)?(\/[a-z0-9]+([._-][a-z0-9]+)*)+(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}|@sha256:[a-f0-9]{64})$/;
+const REPO_RE = /^[a-z0-9]([a-z0-9._-]*[a-z0-9])?(:[0-9]+)?(\/[a-z0-9]+([._-][a-z0-9]+)*)+$/;
+const MIN_MI = 256;
+const MAX_MI = 1024;
+
+// Env name -> key in the profile's creds secret. Names only; values are never read.
+export const SECRET_ENV = Object.freeze([
+  ["DATABASE_URL", "DATABASE_URL_IN_CLUSTER"],
+  ["VALKEY_URL", "VALKEY_URL_IN_CLUSTER"],
+  ["S3_ENDPOINT", "S3_ENDPOINT_IN_CLUSTER"],
+  ["S3_BUCKET", "S3_BUCKET"],
+  ["S3_REGION", "S3_REGION"],
+  ["AWS_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"],
+  ["AWS_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"],
+]);
+
+export function toMi(mem) {
+  const m = /^([1-9][0-9]{0,5})(Mi|Gi)$/.exec(String(mem));
+  need(m, `invalid memory: ${mem} (use Mi or Gi)`);
+  return Number(m[1]) * (m[2] === "Gi" ? 1024 : 1);
+}
+
+export function validateImage(image) {
+  need(typeof image === "string" && IMAGE_RE.test(image), `image must be registry-qualified with a tag or digest: ${image}`);
+  need(!/:latest$/.test(image), "mutable tag 'latest' is not allowed");
+  return image;
+}
+
+// Secret names come only from the effective profile; no cluster-specific fallback.
+function secretNames(profile) {
+  const refs = profile.secretRefs ?? {};
+  return { creds: refs.creds, ca: refs.ca };
+}
+
+export function manifests({
+  profile,
+  app,
+  image,
+  port = 3000,
+  withCreds = false,
+  healthPath = "/health",
+  memory,
+  replicas = 1,
+  ingress,
+  ...rest
+} = {}) {
+  need(Object.keys(rest).length === 0, `unknown option: ${Object.keys(rest)[0]}`);
+  need(profile && typeof profile === "object", "profile required");
+  validateName(app, "app name");
+  validateName(profile.namespace, "namespace");
+  validateImage(image);
+  need(Number.isInteger(port) && port >= 1 && port <= 65535, "port must be 1-65535");
+  need(Number.isInteger(replicas) && replicas >= 1 && replicas <= 3, "replicas must be 1-3");
+  need(healthPath === null || (typeof healthPath === "string" && /^\/[A-Za-z0-9._~\/-]*$/.test(healthPath)), "invalid healthPath");
+  const mem = memory ?? profile.memory ?? "512Mi";
+  const mi = toMi(mem);
+  need(mi >= MIN_MI && mi <= MAX_MI, "memory limit must be between 256Mi and 1Gi");
+  const reqMem = `${Math.min(128, mi)}Mi`;
+  const wantIngress = ingress ?? Boolean(profile.domain);
+  need(!wantIngress || profile.domain, "ingress requires profile.domain");
+  const host = `${app}-${profile.namespace}.${profile.domain}`;
+  if (wantIngress) need(`${app}-${profile.namespace}`.length <= 63 && host.length <= 253, "ingress host too long");
+
+  const labels = { app, "app.kubernetes.io/managed-by": "techbro" };
+  const container = {
+    name: app,
+    image,
+    ports: [{ containerPort: port }],
+    env: [{ name: "PORT", value: String(port) }],
+    securityContext: { privileged: false, allowPrivilegeEscalation: false },
+    resources: { requests: { cpu: "100m", memory: reqMem }, limits: { memory: mem } },
+  };
+  if (healthPath !== null) container.readinessProbe = { httpGet: { path: healthPath, port }, periodSeconds: 10 };
+  const podSpec = { automountServiceAccountToken: false, containers: [container] };
+
+  if (withCreds) {
+    const { creds, ca } = secretNames(profile);
+    need(creds, "withCreds requires profile.secretRefs.creds (no secret references configured)");
+    validateName(creds, "secretRefs.creds");
+    for (const [name, key] of SECRET_ENV) {
+      container.env.push({ name, valueFrom: { secretKeyRef: { name: creds, key } } });
+    }
+    if (ca) {
+      validateName(ca, "secretRefs.ca");
+      const caFile = "/etc/techbro-ca/ca.crt";
+      container.env.push({ name: "NODE_EXTRA_CA_CERTS", value: caFile });
+      if (profile.caEnv) container.env.push({ name: profile.caEnv, value: caFile });
+      container.volumeMounts = [{ name: "ca", mountPath: "/etc/techbro-ca", readOnly: true }];
+      podSpec.volumes = [{ name: "ca", secret: { secretName: ca } }];
+    }
+  }
+
+  const items = [
+    {
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      metadata: { name: app, labels },
+      spec: { replicas, selector: { matchLabels: { app } }, template: { metadata: { labels }, spec: podSpec } },
+    },
+    {
+      apiVersion: "v1",
+      kind: "Service",
+      metadata: { name: app, labels },
+      spec: { selector: { app }, ports: [{ port: 80, targetPort: port }] },
+    },
+  ];
+  if (wantIngress) {
+    const metadata = { name: app, labels };
+    if (profile.tlsResolver) metadata.annotations = { "traefik.ingress.kubernetes.io/router.tls.certresolver": profile.tlsResolver };
+    items.push({
+      apiVersion: "networking.k8s.io/v1",
+      kind: "Ingress",
+      metadata,
+      spec: {
+        rules: [{ host, http: { paths: [{ path: "/", pathType: "Prefix", backend: { service: { name: app, port: { number: 80 } } } }] } }],
+        tls: [{ hosts: [host] }],
+      },
+    });
+  }
+  return { apiVersion: "v1", kind: "List", items };
+}
+
+const DANGEROUS_KEYS = new Set(["hostPath", "hostNetwork", "hostPID", "hostIPC", "hostPort", "hostAliases", "nodeName", "serviceAccountName"]);
+
+// Defensive allow-list check applied to anything about to be sent to the cluster.
+export function validateManifests(list, { profile, app }) {
+  need(list?.kind === "List" && Array.isArray(list.items), "expected a Kubernetes List");
+  const kinds = new Set();
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.forEach(walk);
+    if (!v || typeof v !== "object") return;
+    for (const [k, x] of Object.entries(v)) {
+      need(!DANGEROUS_KEYS.has(k), `forbidden field: ${k}`);
+      need(!(k === "privileged" && x === true), "privileged containers are not allowed");
+      walk(x);
+    }
+  };
+  for (const it of list.items) {
+    need(["Deployment", "Service", "Ingress"].includes(it.kind), `resource kind not allowed: ${it.kind}`);
+    need(!kinds.has(it.kind), `duplicate ${it.kind}`);
+    kinds.add(it.kind);
+    need(it.metadata?.name === app, `${it.kind} name must be ${app}`);
+    need(it.metadata.namespace == null || it.metadata.namespace === profile.namespace, "resource namespace must match the target namespace");
+    walk(it);
+  }
+  need(kinds.has("Deployment") && kinds.has("Service"), "Deployment and Service are required");
+  return list;
+}
+
+export async function generateManifest({ root = process.cwd(), force = false, ...opts } = {}) {
+  const list = manifests(opts);
+  const name = opts.profile.name;
+  need(typeof name === "string", "profile.name required");
+  validateName(name, "profile name");
+  const dir = path.join(root, "k8s");
+  const file = path.join(dir, `${name}.json`);
+  const rel = path.join("k8s", `${name}.json`);
+  const info = async (p) => lstat(p).catch((e) => (e.code === "ENOENT" ? null : Promise.reject(e)));
+  const d = await info(dir);
+  if (d) need(!d.isSymbolicLink() && d.isDirectory(), "k8s must be a real directory, not a symlink");
+  else await mkdir(dir);
+  const t = await info(file);
+  if (t) {
+    need(!t.isSymbolicLink() && t.isFile(), `${rel} must be a regular file, not a symlink`);
+    need(force, `${rel} exists; use --force to overwrite`);
+  }
+  const tmp = path.join(dir, `.${name}.${randomBytes(6).toString("hex")}.tmp`);
+  await writeFile(tmp, `${JSON.stringify(list, null, 2)}\n`, { flag: "wx" });
+  try {
+    if (force) await rename(tmp, file);
+    else {
+      await link(tmp, file).catch((e) => {
+        throw e.code === "EEXIST" ? new Error(`${rel} exists; use --force to overwrite`) : e;
+      });
+      await unlink(tmp);
+    }
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
+  return { path: file, manifests: list };
+}
+
+// Safe subprocess runner: argv only, no shell, bounded output, timeout kill, optional stdin file.
+export function safeRun(file, args, { input, inputFile, timeout = 60000, signal } = {}) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) return resolve({ code: 130, stdout: "", stderr: "aborted" });
+    const cap = 4 * 1024 * 1024;
+    let out = "";
+    let err = "";
+    let done = false;
+    const child = spawn(file, args, { stdio: [input != null || inputFile ? "pipe" : "ignore", "pipe", "pipe"] });
+    const finish = (r) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      resolve(r);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      finish({ code: 124, stdout: out, stderr: `${err}\ntimed out after ${timeout}ms` });
+    }, timeout);
+    const onAbort = () => {
+      child.kill("SIGKILL");
+      finish({ code: 130, stdout: out, stderr: `${err}\naborted` });
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout.on("data", (d) => void (out = (out + d).slice(-cap)));
+    child.stderr.on("data", (d) => void (err = (err + d).slice(-cap)));
+    child.on("error", (e) => finish({ code: 127, stdout: out, stderr: e.message }));
+    child.on("close", (code) => finish({ code: code ?? 1, stdout: out, stderr: err }));
+    if (child.stdin) {
+      child.stdin.on("error", () => {});
+      if (inputFile) {
+        const rs = createReadStream(inputFile);
+        rs.on("error", () => child.kill("SIGKILL"));
+        child.on("close", () => rs.destroy());
+        rs.pipe(child.stdin);
+      }
+      else child.stdin.end(input);
+    }
+  });
+}
+
+export const SECRET_NAME = /(^|\/)(\.env(rc)?(\..*)?|.*\.(pem|key|p12|pfx|kdbx|jks|keystore|tfvars|env|db|sqlite3?)|.*\.tfstate(\..*)?|\.dockerconfigjson|id_(rsa|dsa|ecdsa|ed25519)(\..*)?|credentials(\..*)?|kubeconfig(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|service-account.*\.json)$/i;
+const ENV_TEMPLATE = /(^|\/)\.env\.(example|sample|template)$/i;
+const EXCLUDES = [".git", "node_modules", "target", "dist", ".venv", ".next"];
+
+export const isSecretPath = (p) => SECRET_NAME.test(p) && !ENV_TEMPLATE.test(p);
+
+export const BUILD_FILE_POLICY =
+  "committed source only (git archive HEAD); .dockerignore is NOT an upload filter; clean tree required; tracked secrets/symlinks/submodules rejected; node_modules, target, dist, .venv, .next excluded";
+
+const gitOut = async (run, root, args) => {
+  const r = await run("git", ["-C", root, ...args], { timeout: 60000 });
+  need(r.code === 0, `git ${args[0]} failed: ${String(r.stderr ?? "").trim() || `exit ${r.code}`}`);
+  return String(r.stdout ?? "");
+};
+
+export async function inspectContext({ root, dockerfile = "Dockerfile", maxBytes = Infinity, run = safeRun }) {
+  need(typeof dockerfile === "string" && dockerfile && !path.isAbsolute(dockerfile) && !dockerfile.split("/").includes("..") && !dockerfile.includes("\0") && !dockerfile.startsWith("-"),
+    "dockerfile must be a relative path inside the project");
+  const dirty = (await gitOut(run, root, ["status", "--porcelain", "-z", "--untracked-files=all"])).trim();
+  need(!dirty, "working tree is not clean; commit or stash changes (including untracked files) before building");
+  // Inspect the committed tree (HEAD), the same tree git archive packs.
+  const entries = (await gitOut(run, root, ["ls-tree", "-r", "-l", "-z", "HEAD"])).split("\0").filter(Boolean);
+  const files = [];
+  let total = 0;
+  for (const e of entries) {
+    const m = /^(\d+) (\w+) [0-9a-f]+ +(\d+|-)\t([\s\S]+)$/.exec(e);
+    need(m, "unexpected git ls-tree output");
+    need(m[1] !== "120000", `tracked symlink rejected: ${m[4]}`);
+    need(m[1] !== "160000", `tracked submodule/nested repo rejected: ${m[4]}`);
+    need(!isSecretPath(m[4]), `tracked secret-like file rejected: ${m[4]}`);
+    total += m[3] === "-" ? 0 : Number(m[3]);
+    files.push(m[4]);
+  }
+  need(total <= maxBytes, `build context too large before archiving: ${total} bytes (max ${maxBytes})`);
+  need(files.includes(dockerfile), `${dockerfile} is not a committed file in the project`);
+  return { files: files.length, dockerfile };
+}
+
+const stamp = (d) => d.toISOString().replace(/\D/g, "").slice(0, 14);
+
+// Aborts on external `signal` or SIGINT/SIGTERM (handlers are restored); never calls process.exit.
+// Failed cleanup is reported in `warnings` (and on the thrown error), never swallowed.
+export async function buildProject({
+  profile,
+  app,
+  root = process.cwd(),
+  dockerfile = "Dockerfile",
+  imageRepo,
+  yes = false,
+  dryRun = false,
+  run = safeRun,
+  signal,
+  timeoutMs = 15 * 60 * 1000,
+  maxBytes = 500 * 1024 * 1024,
+  now = () => new Date(),
+  random = () => randomBytes(4).toString("hex"),
+} = {}) {
+  validateName(app, "app name");
+  need(profile?.build?.image, "profile has no build configuration");
+  need(profile.platform == null || /^linux\/[a-z0-9/]+$/.test(profile.platform), "invalid platform");
+  const repo = imageRepo ?? (profile.registry ? `${profile.registry}/${profile.namespace}/${app}` : null);
+  need(repo, "profile has no registry; pass an explicit image repository (imageRepo)");
+  need(REPO_RE.test(repo), `invalid image repository: ${repo}`);
+  need(dryRun || yes === true, "build uploads source and pushes an image; confirm with --yes");
+  const ctx = await inspectContext({ root, dockerfile, maxBytes, run });
+  const id = `${stamp(now())}-${random()}`;
+  need(/^[0-9]{14}-[0-9a-f]{8}$/.test(id), "invalid build id");
+  const image = `${repo}:${id}`;
+  const pod = `tb-build-${id}`;
+  const policy = {
+    context: profile.context,
+    namespace: profile.namespace,
+    image,
+    privileged: profile.build.privileged === true,
+    buildImage: profile.build.image,
+    files: ctx.files,
+    filePolicy: BUILD_FILE_POLICY,
+  };
+  if (dryRun) return { dryRun: true, ...policy };
+
+  const ac = new AbortController();
+  let exitCode = null;
+  const abort = (code) => {
+    exitCode ??= code;
+    ac.abort();
+  };
+  const onInt = () => abort(130);
+  const onTerm = () => abort(143);
+  const onExt = () => abort(130);
+  if (signal?.aborted) onExt();
+  signal?.addEventListener("abort", onExt, { once: true });
+  process.on("SIGINT", onInt);
+  process.on("SIGTERM", onTerm);
+
+  const warnings = [];
+  let dir = null;
+  let result;
+  let failure = null;
+  try {
+    dir = await mkdtemp(path.join(tmpdir(), "techbro-build-"));
+    const tar = path.join(dir, "context.tar");
+    need(!ac.signal.aborted, "build aborted");
+    const excl = EXCLUDES.map((e) => `:(exclude,glob)**/${e}/**`);
+    await gitOut(run, root, ["archive", "--format=tar", `--output=${tar}`, "HEAD", "--", ".", ...excl]);
+    const size = (await stat(tar)).size;
+    need(size <= maxBytes, `build context too large: ${size} bytes (max ${maxBytes})`);
+    const prefix = kubeArgs(profile, ["get", "pod", pod]).slice(0, -3);
+    const script =
+      'mkdir /ctx; tar xf - -C /ctx; buildctl-daemonless.sh build --progress plain --frontend dockerfile.v0 --local context=/ctx --local dockerfile=/ctx --opt filename="$2" ' +
+      (profile.platform ? '--opt platform="$3" ' : "") +
+      '--output "type=image,name=$1,push=true,registry.insecure=$4"';
+    const overrides = {
+      spec: {
+        automountServiceAccountToken: false,
+        containers: [
+          {
+            name: "build",
+            image: profile.build.image,
+            stdin: true,
+            stdinOnce: true,
+            securityContext: { privileged: profile.build.privileged === true },
+            command: ["sh", "-ec", script, "sh", image, dockerfile, profile.platform ?? "", String(profile.build.insecure === true)],
+            resources: { limits: { memory: profile.build.memory ?? "3Gi" } },
+          },
+        ],
+      },
+    };
+    const argv = [
+      ...prefix,
+      "run", pod, "-i", "--rm", "--restart=Never", "--quiet",
+      `--image=${profile.build.image}`,
+      `--labels=app.kubernetes.io/managed-by=techbro-build,techbro.io/build-id=${id}`,
+      `--overrides=${JSON.stringify(overrides)}`,
+    ];
+    const res = await run("kubectl", argv, { inputFile: tar, timeout: timeoutMs, signal: ac.signal });
+    if (ac.signal.aborted) throw new Error("build aborted");
+    need(res.code === 0, `build failed: ${String(res.stderr ?? "").trim().slice(-2000) || `exit ${res.code}`}`);
+    result = { dryRun: false, ...policy, output: String(res.stdout ?? "").slice(-4000) };
+  } catch (e) {
+    failure = e;
+    if (exitCode != null) e.exitCode = exitCode;
+  } finally {
+    // Signal handlers stay installed through cleanup so a repeated SIGINT/SIGTERM cannot kill it;
+    // cleanup runs are deliberately not given the (possibly aborted) build signal.
+    try {
+      try {
+        await cleanupBuildPod({ profile, pod, id, run });
+      } catch (e) {
+        warnings.push(
+          `cleanup failed for pod ${pod} (context ${profile.context}, namespace ${profile.namespace}): ${e.message}; remove manually with: kubectl ${profile.kubeconfig ? `--kubeconfig ${profile.kubeconfig} ` : ""}--context ${profile.context} --namespace ${profile.namespace} delete pod ${pod}`,
+        );
+      }
+      if (dir) {
+        try {
+          await rm(dir, { recursive: true, force: true });
+        } catch (e) {
+          warnings.push(`could not remove temp build directory ${dir}: ${e.message}`);
+        }
+      }
+    } finally {
+      process.off("SIGINT", onInt);
+      process.off("SIGTERM", onTerm);
+      signal?.removeEventListener("abort", onExt);
+    }
+  }
+  if (failure) {
+    if (warnings.length) {
+      failure.warnings = warnings;
+      failure.message += `\nwarnings:\n- ${warnings.join("\n- ")}`;
+    }
+    throw failure;
+  }
+  return { ...result, warnings };
+}
+
+// Deletes the build pod only if its labels prove techbro created it for this build id.
+export async function cleanupBuildPod({ profile, pod, id, run = safeRun }) {
+  const out = await kubectl(profile, ["get", "pod", pod, "-o", "json", "--ignore-not-found"], { run });
+  if (!out.trim()) return false;
+  const labels = JSON.parse(out)?.metadata?.labels ?? {};
+  if (labels["app.kubernetes.io/managed-by"] !== "techbro-build" || labels["techbro.io/build-id"] !== id) return false;
+  await kubectl(profile, ["delete", "pod", pod, "--wait=false"], { run });
+  return true;
+}
+
+export async function deployProject({
+  profile,
+  app,
+  yes = false,
+  dryRun = false,
+  serverValidate = false,
+  run = safeRun,
+  rolloutTimeout = "120s",
+  ...opts
+} = {}) {
+  const rt = /^([1-9][0-9]{0,3})([sm])$/.exec(rolloutTimeout);
+  need(rt, "invalid rollout timeout (use e.g. 120s or 10m)");
+  // Runner budget = kubectl's own rollout timeout + 30s margin so kubectl reports its timeout first.
+  const rolloutBudgetMs = Number(rt[1]) * (rt[2] === "m" ? 60000 : 1000) + 30000;
+  const list = validateManifests(manifests({ profile, app, ...opts }), { profile, app });
+  const input = JSON.stringify(list);
+  // The applied document is always regenerated from options above; no editable file is read.
+  const ensureManaged = async () => {
+    for (const item of list.items) {
+      const out = (await kubectl(profile, ["get", `${item.kind.toLowerCase()}/${app}`, "-o", "json", "--ignore-not-found"], { run })).trim();
+      if (!out) continue;
+      const managed = JSON.parse(out)?.metadata?.labels?.["app.kubernetes.io/managed-by"];
+      need(managed === "techbro", `existing ${item.kind} ${app} is not managed by techbro; refusing to adopt it`);
+    }
+  };
+  const applyArgs = ["apply", "-f", "-"];
+  const plan = [
+    `kubectl apply --dry-run=server (context ${profile.context}, namespace ${profile.namespace})`,
+    "kubectl apply",
+    `kubectl rollout status deployment/${app}`,
+  ];
+  if (dryRun) {
+    const result = { dryRun: true, kinds: list.items.map((i) => i.kind), plan };
+    if (serverValidate) await ensureManaged();
+    if (serverValidate) result.serverValidation = await kubectl(profile, [...applyArgs, "--dry-run=server"], { run, input });
+    return result;
+  }
+  need(yes === true, "deploy changes the cluster; confirm with --yes");
+  await ensureManaged();
+  const validation = await kubectl(profile, [...applyArgs, "--dry-run=server"], { run, input });
+  const applied = await kubectl(profile, applyArgs, { run, input });
+  const rollout = await kubectl(profile, ["rollout", "status", `deployment/${app}`, `--timeout=${rolloutTimeout}`], { run, timeoutMs: rolloutBudgetMs });
+  return { dryRun: false, kinds: list.items.map((i) => i.kind), plan, validation, applied, rollout };
+}