underpost 3.2.80 → 3.2.90

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. package/CHANGELOG.md +182 -1
  2. package/CLI-HELP.md +37 -16
  3. package/README.md +2 -2
  4. package/bin/deploy.js +18 -16
  5. package/docker-compose.yml +1 -1
  6. package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml +1 -1
  7. package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml +1 -1
  8. package/manifests/deployment/dd-default-development/deployment.yaml +2 -2
  9. package/manifests/deployment/playwright/deployment.yaml +1 -1
  10. package/manifests/mongodb/kustomization.yaml +4 -1
  11. package/manifests/mongodb/statefulset.yaml +4 -0
  12. package/manifests/mongodb/storage-class.yaml +9 -2
  13. package/package.json +17 -17
  14. package/scripts/nat-iptables.sh +10 -4
  15. package/scripts/test-monitor.sh +4 -3
  16. package/src/cli/cluster.js +740 -55
  17. package/src/cli/db.js +2 -2
  18. package/src/cli/deploy.js +1679 -174
  19. package/src/cli/docker-compose.js +19 -178
  20. package/src/cli/image.js +15 -6
  21. package/src/cli/index.js +124 -35
  22. package/src/cli/ipfs.js +82 -11
  23. package/src/cli/monitor.js +1 -1
  24. package/src/cli/repository.js +1 -1
  25. package/src/cli/run.js +2161 -420
  26. package/src/cli/secrets.js +969 -0
  27. package/src/cli/ssh.js +8 -28
  28. package/src/client-builder/client-build.js +94 -11
  29. package/src/client-builder/ssr.js +27 -73
  30. package/src/db/mongo/MongoBootstrap.js +295 -54
  31. package/src/db/mongo/MongooseDB.js +47 -32
  32. package/src/index.js +1 -1
  33. package/src/server/conf.js +1208 -70
  34. package/src/server/cri.js +70 -0
  35. package/src/server/underpost-gateway.js +1073 -0
  36. package/src/server/underpost-ingress.js +364 -0
  37. package/test/cluster-instances.test.js +435 -0
  38. package/test/deploy-node-placement.test.js +45 -0
  39. package/test/instance-traffic-plan.test.js +710 -0
  40. package/test/sops-secret-store.test.js +612 -0
  41. package/test/underpost-gateway.test.js +469 -0
  42. package/test/underpost-ingress.test.js +253 -0
package/CHANGELOG.md CHANGED
@@ -1,6 +1,187 @@
1
1
  # Changelog
2
2
 
3
- ## 2026-07-23
3
+ ## 2026-08-11
4
+
5
+ ### cli-run
6
+
7
+ - Add version parameter in cluster runner cmd lines ([bd909bc0](https://github.com/underpostnet/engine/commit/bd909bc046f77f5c36d601116d2f94291ca6aa0a))
8
+ - Handle multi-recipient keys in sops runners ([92ecdc15](https://github.com/underpostnet/engine/commit/92ecdc1518d645faa913d0897288a5f6e27e075d))
9
+ - Trim ipfs expose to core host ports ([dc473d4f](https://github.com/underpostnet/engine/commit/dc473d4faa1221f0102ce88ee6fff866941d0f3b))
10
+ - Add sops setup and status runners ([a29fd394](https://github.com/underpostnet/engine/commit/a29fd3947637ca64398040deaea30d0fab624263))
11
+ - Fix sub path handling probes in get-traffic runner ([b65d0fe4](https://github.com/underpostnet/engine/commit/b65d0fe4e73b370a627efbb8b2e23386deff7f74))
12
+ - Add restore mongo statefulset runner ([e9e1b224](https://github.com/underpostnet/engine/commit/e9e1b224b964a713f5d6aedbf05d11b41e15a98c))
13
+ - In get-traffic runner retains every configured host row matching the input ([a1654225](https://github.com/underpostnet/engine/commit/a16542254c92f9d1564a9a817b990ecbe061459d))
14
+ - Rework get-traffic runner with CURRENT and OPPOSITE color state deployment ([34e4a723](https://github.com/underpostnet/engine/commit/34e4a7234784dec5ac6af20bd785a830f9f238bf))
15
+ - Rework expose runner to port list options ([b6fe9cfe](https://github.com/underpostnet/engine/commit/b6fe9cfe46e07cf8776157e66d6006341902b616))
16
+ - Add status and expose runners ([0d383e7d](https://github.com/underpostnet/engine/commit/0d383e7d9a6bdbc062060635c279821e559a6473))
17
+ - Drop redundant rollout restart after node-move patch ([b5399b13](https://github.com/underpostnet/engine/commit/b5399b1342b6c3932b065eb4d6c6b01f7f361e10))
18
+ - Load project instance env builder by convention ([8b226d07](https://github.com/underpostnet/engine/commit/8b226d07367e1f5e7a93ffc3ced17c0ebd953f99))
19
+ - Route instances through stable traffic Service ([65c674e0](https://github.com/underpostnet/engine/commit/65c674e05c280bba50e6ab6c6bfdda0480e72d67))
20
+ - Refactor stop runner logic introduce stopPlanFactory method ([aa972f12](https://github.com/underpostnet/engine/commit/aa972f12008ceb49e3ee3cd053f47b525c344fbd))
21
+ - Remove direct ssh remote runners ([79ecee89](https://github.com/underpostnet/engine/commit/79ecee8926e4ccf63f1d8a8fc023e359e750072f))
22
+ - Integrate underpost gateway into run ([ce02c328](https://github.com/underpostnet/engine/commit/ce02c3282721f02d89e6af76380ace95a8bfa424))
23
+ - Add Gateway API HTTPRoute rules for instance runners ([c85c48e4](https://github.com/underpostnet/engine/commit/c85c48e434c65437bb9704a019c4945c1620e317))
24
+
25
+ ### test-secrets
26
+
27
+ - Fix rotate and apply manifest test workflow ([5f0be40c](https://github.com/underpostnet/engine/commit/5f0be40c51440bf6496a7da66a5d9edb78d6de0d))
28
+
29
+ ### hardhat
30
+
31
+ - Update transitive dependencies ([59f18f31](https://github.com/underpostnet/engine/commit/59f18f31bd2490904c4ead85ca8a0dd9d50d1459))
32
+
33
+ ### engine-cyberia
34
+
35
+ - Implement storageSlots capability workload in fallback world ([c6bceef0](https://github.com/underpostnet/engine/commit/c6bceef0b6d8c4d64e8f02f87ed2fb20abf3e287))
36
+ - Implement storageSlots capability workload in fallback world ([e5f4d1c9](https://github.com/underpostnet/engine/commit/e5f4d1c9a979f87d53cbc9c7ddef4dd2d6e747e3))
37
+ - Add assembler craft recipes to cyberia action system ([c5072452](https://github.com/underpostnet/engine/commit/c5072452309a51882283568650098eebf87620ff))
38
+ - Add vendor shop catalog to cyberia action system ([748533a0](https://github.com/underpostnet/engine/commit/748533a0c68e57c25f9f9c5844fc27f545c2cae6))
39
+ - Preserve variant base path through ingress ([3daa9a18](https://github.com/underpostnet/engine/commit/3daa9a18190f41bef20b9a590b04ae51f150a7fc))
40
+ - Normalize instance topology and dispatch env builders ([cd0309ae](https://github.com/underpostnet/engine/commit/cd0309ae425c59c957eed5357cabdbc27ad3ffe6))
41
+ - Refactor gateway static to underpost gateway ([9f35a007](https://github.com/underpostnet/engine/commit/9f35a007d5cf444f4d84c7eccf446d46b4208e0f))
42
+ - Fix minor besu genesis generator update ([6680d5a1](https://github.com/underpostnet/engine/commit/6680d5a16b9936c6995812b3b9f99415d72636c0))
43
+ - Fix sum stat response in fall back world static instance map endpoint ([84ea1e4c](https://github.com/underpostnet/engine/commit/84ea1e4ca39bf8046736703951857ba3f91b6965))
44
+ - Add seeded random source for deterministic fallback world generation ([74741187](https://github.com/underpostnet/engine/commit/7474118721a446a53077a2a4aa243eefc95abb96))
45
+
46
+ ### dependencies
47
+
48
+ - Update transitive dependencies ([9c12f8fd](https://github.com/underpostnet/engine/commit/9c12f8fde0739131fa9dc42ccf142e7351ab4295))
49
+
50
+ ### github-actions
51
+
52
+ - Set dd-cyberia env before build manifest ([3ec1c8e4](https://github.com/underpostnet/engine/commit/3ec1c8e46bca4d31097f7d80b62c7276ef5974bd))
53
+ - Update build and deployment manifests ([b8aad935](https://github.com/underpostnet/engine/commit/b8aad9359dafaf0c6aea08b6e9925e3b0425592f))
54
+ - Wait for underpost-gateway rollout ([57fc7c22](https://github.com/underpostnet/engine/commit/57fc7c22ff1bbc4f45f042e11d86d73348746915))
55
+ - Update engine-test CD deploy workflow ([712cc9e1](https://github.com/underpostnet/engine/commit/712cc9e17a581ed20a27923b169405824f05e759))
56
+ - Update build and deployment manifests ([14965333](https://github.com/underpostnet/engine/commit/149653332980e66ab8d49f9bc496f5b32f89c211))
57
+ - Update engine-cyberia docker-compose build and deployment manifests ([8dcb10ab](https://github.com/underpostnet/engine/commit/8dcb10ab22c7942d51fa6b94d5a1d09b62fc1930))
58
+ - Update engine-cyberia docker-compose build and deployment manifests ([1cf4f753](https://github.com/underpostnet/engine/commit/1cf4f753f899fa995b5b25aba74792f39da6055f))
59
+ - Update build and deployment manifests ([ba4f4a17](https://github.com/underpostnet/engine/commit/ba4f4a17321771873f04f2782ff43bce9811bd9e))
60
+ - Update build and deployment manifests ([9874b895](https://github.com/underpostnet/engine/commit/9874b895df5f4904b6b5ab6c016a6f8487e24ef9))
61
+ - Update build and deployment manifests ([c3a4ec9f](https://github.com/underpostnet/engine/commit/c3a4ec9f154be351d4fffec78d31f55b8119ba94))
62
+ - Update build and deployment manifests ([a8bdbf05](https://github.com/underpostnet/engine/commit/a8bdbf0503e437237750bb1257c50aca9b92bfe5))
63
+ - Update engine-cyberia CD add prebuild manifest workflow ([a1f4954f](https://github.com/underpostnet/engine/commit/a1f4954f7accfdcf354afcf2c602960bedeca1c5))
64
+ - Fix 404 page location in cyber ua-client docker image workflow ([b52bdf89](https://github.com/underpostnet/engine/commit/b52bdf89e50597bb03f325e6f1bec127005af406))
65
+ - Disable publish branch and sha docker images versions ([12a37a46](https://github.com/underpostnet/engine/commit/12a37a468a39083e07c13406d1882905eb3d05da))
66
+
67
+ ### test
68
+
69
+ - Cover store adoption and recipient registration ([e570d647](https://github.com/underpostnet/engine/commit/e570d6472c2f9e87613d109bc88ddabb2acefd38))
70
+ - Cover sops encrypted secret store ([7c41910b](https://github.com/underpostnet/engine/commit/7c41910bd48d4ddbee5ff1698fd678e9c03f0606))
71
+ - Cover expose and curl status chain ([c19471ae](https://github.com/underpostnet/engine/commit/c19471ae2dc3c38df89a911708679ed12cb13812))
72
+ - Add deployment node placement tests ([390e0aa7](https://github.com/underpostnet/engine/commit/390e0aa7d0b05e4410d7c62da2990bac3546bb29))
73
+ - Fix test/cluster-instances.test.js ([481740db](https://github.com/underpostnet/engine/commit/481740db8cd24108bc4a599180626d8e3f23c118))
74
+ - Remove buildCyberiaMmoInstanceEnv tests in test/cluster-instances.test.js ([46afd8ae](https://github.com/underpostnet/engine/commit/46afd8aed83a023cbc8e3153d7123aee748079e9))
75
+
76
+ ### docs
77
+
78
+ - Document joining a store created on another host ([25a85b6c](https://github.com/underpostnet/engine/commit/25a85b6cee4b04dec73016782f61ba9ab7d84e49))
79
+ - Document shop transaction flow in action system ([7091a506](https://github.com/underpostnet/engine/commit/7091a506a644f7c1a8c0a62526ced91ed568af0c))
80
+ - Document sops age secret management ([6b538a2f](https://github.com/underpostnet/engine/commit/6b538a2f6241f47a1ff2e039e8593bddc3328216))
81
+ - Document expose port list examples ([f9ba1808](https://github.com/underpostnet/engine/commit/f9ba18083ebd013fa83ef660e5150dbd9934ff03))
82
+ - Document run status and expose runners ([bf9a83b4](https://github.com/underpostnet/engine/commit/bf9a83b423834ed7647b5d84ff2bee53b55cd66e))
83
+ - Update node-move mechanics for template patch rollout ([fb8d36f8](https://github.com/underpostnet/engine/commit/fb8d36f8974c9f5079a3cce373e0634dbc3bf0e4))
84
+
85
+ ### cli-secret
86
+
87
+ - Add store adoption pre-flight and recipient registration ([2d634dbb](https://github.com/underpostnet/engine/commit/2d634dbbb503ec00db3df61a1925a888b8c83288))
88
+ - Add managed secrets and repair creation rules ([4661114a](https://github.com/underpostnet/engine/commit/4661114a03836074ab3cad51559b660a88a55290))
89
+ - Add sops age encrypted secret store ([8de77fdd](https://github.com/underpostnet/engine/commit/8de77fdd6b2e82fcbeabcedba9305bb15f881418))
90
+
91
+ ### server-conf
92
+
93
+ - Derive remote ports from host ports in expose plan ([45bec1ad](https://github.com/underpostnet/engine/commit/45bec1ad9735794ad57c672a43e76ac2fc9861d2))
94
+ - Add replica count and secure password factories ([83320d06](https://github.com/underpostnet/engine/commit/83320d061b192dc883ab8b6ccadd171989c9659e))
95
+ - Add expose port list and plan factories ([928ad835](https://github.com/underpostnet/engine/commit/928ad8350426a93d0d8c84f0eee7b8730a538d97))
96
+ - Add curl status chain factory ([dfeef123](https://github.com/underpostnet/engine/commit/dfeef123b33253205c70f0a437323179e590a229))
97
+ - Support idempotent hosts blocks in etcHostFactory ([aa45f40a](https://github.com/underpostnet/engine/commit/aa45f40ace07b6508e0f7a09f2de4ba8a82b3bb9))
98
+
99
+ ### ipfs
100
+
101
+ - Prefer sops store for cluster credentials ([62f40264](https://github.com/underpostnet/engine/commit/62f402649454e5fbb049dde070a3f392d55b1963))
102
+
103
+ ### engine
104
+
105
+ - Generate per-replica mongo volumes with static storage class ([703b8bba](https://github.com/underpostnet/engine/commit/703b8bbacc16c73d0fb96586ea71406d8c723afb))
106
+
107
+ ### cli-cluster
108
+
109
+ - Prefer sops store in cluster secret seeding ([7be50059](https://github.com/underpostnet/engine/commit/7be50059a724b5fad9cb600cf540e69141dd30da))
110
+ - Hot-reload shared ingress host table ([d6328a5e](https://github.com/underpostnet/engine/commit/d6328a5e06237232f492777eca680cf8afd839f7))
111
+ - Add shared underpost ingress front for dual ingress stacks ([041debe9](https://github.com/underpostnet/engine/commit/041debe99e0082412798960ec0be3be3229144c2))
112
+ - Update Gateway API versions and integrate underpost gateway ([12eefb86](https://github.com/underpostnet/engine/commit/12eefb86e6434da8b55a16ffeb28ac267fe62d05))
113
+ - Add Gateway API control plane and CRI socket resolution ([97565eea](https://github.com/underpostnet/engine/commit/97565eea7d4bab91838321a3a96cd058d8496249))
114
+
115
+ ### underpost-gateway
116
+
117
+ - Fix path replicas handling in deploy pwa workfloads ([702f48e4](https://github.com/underpostnet/engine/commit/702f48e4b04c1a9b4458361ed0d33f0b72815c08))
118
+ - Validate and rollback gateway config on reload failure ([4f7ce879](https://github.com/underpostnet/engine/commit/4f7ce8795ef2a46a47bd6d0f49fd0a941cadcca8))
119
+
120
+ ### cli-deploy
121
+
122
+ - Add resolveSchedulableNode method ([c62ee86d](https://github.com/underpostnet/engine/commit/c62ee86d024e9797f279396d647431a97a399f50))
123
+ - Fix merged Gateway listener isolation ([a34f0b93](https://github.com/underpostnet/engine/commit/a34f0b9363a7b16f7d1bf704f27617f7411f2087))
124
+ - Remove expose and status options ([e55227eb](https://github.com/underpostnet/engine/commit/e55227eb0ce75fd308cd72a0f3331a62a08ae0ab))
125
+ - Add node placement to deployment manifest ([9487ad16](https://github.com/underpostnet/engine/commit/9487ad169e79c1ed4c2d1eb05b1e36ff46defe8d))
126
+ - Add stable traffic Service for blue/green routing ([838d1ec0](https://github.com/underpostnet/engine/commit/838d1ec0c1d9d2d9ff35c529180593efcf341203))
127
+ - Fall back to other ingress stack for traffic colour ([3115cc84](https://github.com/underpostnet/engine/commit/3115cc84b02aa091927b25ae09de41879bf012d3))
128
+ - Fix deploy status workflow logic ([35e1af02](https://github.com/underpostnet/engine/commit/35e1af02484e9d6abeb6f031b33589534fe77665))
129
+ - Integrate underpost gateway into deploy ([e95a46d6](https://github.com/underpostnet/engine/commit/e95a46d64897fc92ba2fbb3b5da07c51a0abb729))
130
+ - Add gateway.yaml and httproute.yaml to build manifest mirror ([afb7bcf9](https://github.com/underpostnet/engine/commit/afb7bcf9d8a902d744d6030c72c07d1814f45940))
131
+ - Add Gateway API deploy manifests and gateway static utility ([073231ca](https://github.com/underpostnet/engine/commit/073231ca5a44b860420373035628ad22cc0435d8))
132
+
133
+ ### scripts
134
+
135
+ - Use run expose in test monitor ([b19c4931](https://github.com/underpostnet/engine/commit/b19c49318728b92a8fcf6f7e50e90b5b0e808b0d))
136
+ - Add firewall UDP range for QUIC/HTTP3 to nat-iptables ([3bdacec3](https://github.com/underpostnet/engine/commit/3bdacec350caa1776b418ac44dd3b1e95e259196))
137
+
138
+ ### cli
139
+
140
+ - Update run and deploy option flags ([0dfb9ce6](https://github.com/underpostnet/engine/commit/0dfb9ce6cbfef8f5d990a6fa8287902de20500f2))
141
+
142
+ ### underpost-ingress
143
+
144
+ - Add multi node work load handling ([3dccb3de](https://github.com/underpostnet/engine/commit/3dccb3de3c9a795096613adcca56389c71291c8b))
145
+
146
+ ### cli-cyberia
147
+
148
+ - Add testPaths in dev-env runner ([b087f4af](https://github.com/underpostnet/engine/commit/b087f4afd226a2fefd0cb344a60ac3b945073a40))
149
+ - Install Docker host aliases in compose workflows ([a9fb7507](https://github.com/underpostnet/engine/commit/a9fb750709a4e94f9dd299ff7b62784bb728ad2a))
150
+
151
+ ### docker-compose
152
+
153
+ - Implement project-agnostic docker-compose workflow ([e0d07689](https://github.com/underpostnet/engine/commit/e0d07689ceb9cf34a930c5f4120d8d5ab05f6ae8))
154
+ - Update subpath handling logic ([69fb72fc](https://github.com/underpostnet/engine/commit/69fb72fcb7f7ac87f67f71314d0580ec6a8052f8))
155
+
156
+ ### bin-deploy
157
+
158
+ - Fix add --ignore-not-found in 'pw-conf' runner ([2f14d2ab](https://github.com/underpostnet/engine/commit/2f14d2ab66357eb032266487e2dee5b614d1b697))
159
+
160
+ ### cyberia-docs
161
+
162
+ - Update docs for gateway and CLI changes ([c064f82a](https://github.com/underpostnet/engine/commit/c064f82ad3c315fec5ad7cbdd322d577bc311abf))
163
+ - Document edge tier architecture and CLI updates ([72760e40](https://github.com/underpostnet/engine/commit/72760e40eb9ea96999b94b5c7d916a21c04ac8ef))
164
+
165
+ ### cyberia-cli
166
+
167
+ - Refactor SSH port wait to shared utility ([cdf4c4f9](https://github.com/underpostnet/engine/commit/cdf4c4f922ee7980cf43111db1ef1c81578ad2a3))
168
+ - Add status page build and instance project resolution ([b1b0a840](https://github.com/underpostnet/engine/commit/b1b0a840e5cd7f7edf084bf86323dfdee7d56fd7))
169
+ - Fix SSR html views locations path ([1bf2843c](https://github.com/underpostnet/engine/commit/1bf2843c87607e5b9648f8ec98b35efca5d79b4a))
170
+ - Remove redundant logs ([3adba85f](https://github.com/underpostnet/engine/commit/3adba85fe5199972a8a0cd49f6be005c989f2145))
171
+
172
+ ### cli-image
173
+
174
+ - Implement crictlCommandFactory in image build ([69d24d66](https://github.com/underpostnet/engine/commit/69d24d66848fc27a2503193f82a31ef84435252f))
175
+
176
+ ### db
177
+
178
+ - Fix MongoDB replica set orphan recovery and improve bootstrap ([71b5f1a3](https://github.com/underpostnet/engine/commit/71b5f1a3e032f34c29a9a6b9251aac328c951872))
179
+
180
+ ### cyberia-client
181
+
182
+ - Fix instance selection play URL for default instance code ([efec4a34](https://github.com/underpostnet/engine/commit/efec4a34edbfb3aae780a42b02ad64d4d93791a1))
183
+
184
+ ## New release v:3.2.80 (2026-07-23)
4
185
 
5
186
  ### engine-cyberia
6
187
 
package/CLI-HELP.md CHANGED
@@ -1,6 +1,6 @@
1
1
  ## Underpost CLI
2
2
 
3
- > underpost ci/cd cli v3.2.80
3
+ > underpost ci/cd cli v3.2.90
4
4
 
5
5
  **Usage:** `underpost [options] [command]`
6
6
 
@@ -411,7 +411,7 @@ Manages Kubernetes clusters, defaulting to Kind cluster initialization.
411
411
  | Option | Description |
412
412
  | --- | --- |
413
413
  | `--reset` | Deletes all clusters and prunes all related data and caches. |
414
- | `--reset-mongodb` | Performs a hard cleanup of only MongoDB-related resources (StatefulSet, PVCs/PVs, Secrets, ConfigMaps, caches) without restarting the whole node. |
414
+ | `--reset-mongodb` | Performs a hard cleanup of only MongoDB-related resources (StatefulSet, PVCs/PVs, Secrets, ConfigMaps, caches) without restarting the whole node. Combined with --mongodb it instead wipes the retained hostPath volumes as part of that deploy, so the replica set starts from empty data. |
415
415
  | `--mariadb` | Initializes the cluster with a MariaDB statefulset. |
416
416
  | `--mysql` | Initializes the cluster with a MySQL statefulset. |
417
417
  | `--mongodb` | Initializes the cluster with a MongoDB statefulset. |
@@ -421,6 +421,9 @@ Manages Kubernetes clusters, defaulting to Kind cluster initialization.
421
421
  | `--valkey` | Initializes the cluster with a Valkey service. |
422
422
  | `--ipfs` | Initializes the cluster with an ipfs-cluster statefulset. |
423
423
  | `--contour` | Initializes the cluster with Project Contour base HTTPProxy and Envoy. |
424
+ | `--gateway-api` | Initializes the cluster with the Gateway API control plane (CRDs, Envoy Gateway, GatewayClass) used by generated HTTPRoute + QUIC/HTTP3 manifests. With --dev the data plane binds the listener ports on the host network for direct browser access. |
425
+ | `--gateway-class <name>` | GatewayClass name to provision (default "eg"). |
426
+ | `--ingress-node <node-name>` | Dedicated node for underpost-ingress when both routing stacks coexist. Workload placement flags do not move it. |
424
427
  | `--node-port` | Exposes enabled ready services (e.g. MongoDB 4.4, Valkey) to the host/public network via their NodePort Service manifest. |
425
428
  | `--node-selector <k8s-node-name>` | Pins the just-deployed StatefulSet (MongoDB 4.4 / Valkey) to the given Kubernetes node once it is ready (via a kubernetes.io/hostname nodeSelector). |
426
429
  | `--cert-manager` | Initializes the cluster with a Let's Encrypt production ClusterIssuer. |
@@ -468,13 +471,14 @@ Manages application deployments, defaulting to deploying development pods.
468
471
  | `--remove` | Deletes specified deployments and their associated services. |
469
472
  | `--sync` | Synchronizes deployment environment variables, ports, and replica counts. |
470
473
  | `--info-router` | Displays the current router structure and configuration. |
471
- | `--expose` | Exposes services matching the provided deployment ID list. |
472
474
  | `--cert` | Resets TLS/SSL certificate secrets for deployments. |
473
475
  | `--cert-hosts <hosts>` | Resets TLS/SSL certificate secrets for specified hosts. |
474
476
  | `--self-signed` | Use a pre-created self-signed TLS secret (kubernetes.io/tls) instead of cert-manager. The secret must already exist in the namespace with the same name as the host. Enables TLS in the Contour HTTPProxy virtualhost without requiring a production ClusterIssuer. |
475
477
  | `--node <node>` | Sets optional node for deployment operations. |
478
+ | `--ingress-node <node-name>` | Explicitly relocates the shared host-network ingress; ordinary --node placement never moves it. |
476
479
  | `--ssh-key-path <path>` | Private key path for node SSH operations. Currently used when shipping a hostPath volume to a remote target node over SSH. Defaults to engine-private/deploy/id_rsa. |
477
480
  | `--build-manifest` | Builds Kubernetes YAML manifests, including deployments, services, proxies, and secrets. |
481
+ | `--sync-static` | Places the SSR status pages and intercepted contexts in the gateway static utility tree, so the edge serves them instead of the application pods. Prefers the running workload and falls back to this checkout, so it can seed the tree before the deployment exists and refresh it once the deployment is Ready. |
478
482
  | `--replicas <replicas>` | Sets a custom number of replicas for deployments. |
479
483
  | `--image <image>` | Sets a custom image for deployments. |
480
484
  | `--versions <deployment-versions>` | A comma-separated list of custom deployment versions. |
@@ -484,28 +488,25 @@ Manages application deployments, defaulting to deploying development pods.
484
488
  | `--retry-count <count>` | Sets HTTPProxy per-route retry count (e.g., 3). |
485
489
  | `--retry-per-try-timeout <duration>` | Sets HTTPProxy retry per-try timeout (e.g., "150ms"). |
486
490
  | `--disable-update-deployment` | Disables updates to deployments. |
487
- | `--disable-runtime-probes` | Omits the internal-status HTTP probes from generated deployment manifests. |
491
+ | `--disable-runtime-probes` | Deprecated compatibility flag; readiness probes remain mandatory. Use --tcp-probes for legacy workloads. |
488
492
  | `--tcp-probes` | Generates legacy TCP socket probes instead of HTTP internal-status probes (migration). |
489
493
  | `--disable-update-proxy` | Disables updates to proxies. |
490
494
  | `--disable-deployment-proxy` | Disables proxies of deployments. |
495
+ | `--gateway-api` | Routes through the Gateway API stack (Gateway + HTTPRoute) instead of the Contour HTTPProxy. Both manifest sets are always generated; this selects which one is applied. |
496
+ | `--gateway-class <name>` | GatewayClass name for generated Gateway manifests (default "eg"). |
497
+ | `--disable-http3` | Omits the QUIC/HTTP3 listener config and the Alt-Svc advertisement from Gateway API manifests. |
498
+ | `--quic-port <port>` | UDP port advertised for QUIC/HTTP3 in generated Gateway API manifests (default 443). |
491
499
  | `--disable-update-volume` | Disables updates to volume mounts during deployment. |
492
- | `--status` | Retrieves current network traffic data from resource deployments and the host machine network configuration. |
493
500
  | `--kubeadm` | Enables the kubeadm context for deployment operations. |
494
501
  | `--k3s` | Enables the k3s context for deployment operations. |
495
502
  | `--kind` | Enables the kind context for deployment operations. |
496
503
  | `--git-clean` | Runs git clean on volume mount paths before copying. |
497
504
  | `--disable-update-underpost-config` | Disables updates to Underpost configuration during deployment. |
498
505
  | `--namespace <namespace>` | Kubernetes namespace for deployment operations (defaults to "default"). |
499
- | `--kind-type <kind-type>` | Specifies the Kind cluster type for deployment operations. |
500
- | `--port <port>` | Sets up port forwarding from local to remote ports. |
501
- | `--expose-port <port>` | Sets the local:remote port to expose when --expose is active (overrides auto-detected service port). |
502
- | `--expose-local-port <port>` | Sets a different local port for --expose (e.g. 80) while keeping the remote service port. Useful for /etc/hosts local access without specifying a port in the browser. |
503
- | `--local-proxy` | Forward all service TCP ports locally and start the Node.js path-routing proxy. Enables full path-based routing (e.g. /wp alongside /) without needing --expose-local-port. Requires --expose. |
504
506
  | `--cmd <cmd>` | Custom initialization command for deployment (comma-separated commands). |
505
507
  | `--skip-full-build` | Skip client bundle rebuild; container will pull pre-built bundle via pull-bundle instead. |
506
508
  | `--pull-bundle` | Explicitly pull the pre-built client bundle from Cloudinary inside the container. Use together with --skip-full-build. |
507
509
  | `--image-pull-policy <policy>` | Override container imagePullPolicy in the generated deployment manifest (Always, IfNotPresent, Never). Defaults to Never for localhost/ images and IfNotPresent otherwise. |
508
- | `--tls` | Enables TLS for the local proxy started by --expose --local-proxy. The proxy will serve HTTPS on port 443 using self-signed certificates resolved from the local SSL store. Use together with --expose and --local-proxy. |
509
510
  | `-h, --help` | display help for command |
510
511
 
511
512
  ---
@@ -514,13 +515,13 @@ Manages application deployments, defaulting to deploying development pods.
514
515
 
515
516
  Manages secrets for various platforms.
516
517
 
517
- **Usage:** `underpost secret [options] <platform>`
518
+ **Usage:** `underpost secret [options] [platform]`
518
519
 
519
520
  #### Arguments
520
521
 
521
522
  | Argument | Description |
522
523
  | --- | --- |
523
- | `platform` | The secret management platform. Options: underpost, sanitizeSecretEnvFile, globalSecretClean. |
524
+ | `platform` | The secret management platform. Options: underpost, sops, sanitizeSecretEnvFile, globalSecretClean. Defaults to "sops". (default: "sops") |
524
525
 
525
526
  #### Options
526
527
 
@@ -531,6 +532,17 @@ Manages secrets for various platforms.
531
532
  | `--create-from-env` | Creates secrets from container environment variables (envFrom: secretRef). |
532
533
  | `--global-clean` | Removes all filesystem traces of secrets (engine-private, .env, conf cache). |
533
534
  | `--list` | Lists all available secrets for the platform. |
535
+ | `--encrypt <plaintext-path>` | Encrypts a plaintext Secret manifest into the Git-tracked SOPS store and shreds the source (sops platform). |
536
+ | `--apply` | Decrypts stored SOPS manifests and streams them into kubectl apply, without writing plaintext to disk (sops platform). |
537
+ | `--namespace <namespace>` | Kubernetes namespace for secret operations (defaults to "default"). |
538
+ | `--install-tools` | Installs the sops and age host binaries only, without running a full cluster host initialization. |
539
+ | `--rotate` | Re-keys every stored SOPS manifest onto --recipient. Secret values are unchanged, so no workload restart is needed. |
540
+ | `--recipient <age-public-key>` | Incoming Age public recipient for --rotate. |
541
+ | `--prune-recipients` | With --rotate, makes --recipient the only recipient, revoking every previous key (use after a key compromise). Requires --force, and revokes CI/CD keys too unless they are named in --keep-recipients. |
542
+ | `--keep-recipients <age-public-keys>` | Comma-separated recipients to retain while --prune-recipients revokes the rest (e.g. the CI/CD key). |
543
+ | `--purge <secret-name>` | Emergency removal: deletes the live Kubernetes Secret and takes its encrypted manifest out of the store. |
544
+ | `--force` | Confirms the irreversible variant: deletes the manifest instead of archiving it (--purge), revokes recipients (--rotate --prune-recipients), or replaces an existing manifest (--encrypt). |
545
+ | `--dry-run` | Reports what --apply, --rotate, or --purge would do without changing anything. |
534
546
  | `-h, --help` | display help for command |
535
547
 
536
548
  ---
@@ -825,7 +837,7 @@ Runs specified scripts using various runners.
825
837
 
826
838
  | Argument | Description |
827
839
  | --- | --- |
828
- | `runner-id` | The runner ID to run. Options: dev-cluster,etc-hosts,ipfs-expose,metadata,svc-ls,svc-rm,ssh-deploy-info,node-move,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,ssh-deploy-stop,ssh-deploy-db-rollback,ssh-deploy-db,ssh-deploy-db-status,tz,get-proxy,instance-promote,instance,deploy-key,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,deploy,disk-clean,disk-devices,disk-usage,dev,service,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,build-cluster-deployment-manifests,monitor-ui,shared-dir,shared-dir-add-user. |
840
+ | `runner-id` | The runner ID to run. Options: status,expose,dev-cluster,metadata,ipfs-expose,svc-ls,svc-rm,node-move,dev-hosts-expose,dev-hosts-restore,cluster-build,template-deploy,template-deploy-local,docker-image,clean,pull,release-deploy,ssh-deploy,ide,crypto-policy,sync,stop,tz,get-traffic,restore-mongo,ingress-refresh,instance-promote,instance,deploy-key,instance-build-manifest,ls-deployments,host-update,install-crio,dd-container,ip-info,db-client,git-conf,promote,metrics,cluster,gateway-status,deploy,disk-clean,disk-devices,disk-usage,dev,service,etc-hosts,sh,log,ps,pid-info,background,ports,deploy-test,tf-vae-test,spark-template,pull-rocky-image,rmi,kill,generate-pass,sops-setup,sops-status,secret,underpost-config,gpu-env,tf-gpu-test,deploy-job,push-bundle,pull-bundle,build-cluster-deployment-manifests,monitor-ui,shared-dir,shared-dir-add-user. |
829
841
  | `path` | The input value, identifier, or path for the operation. |
830
842
 
831
843
  #### Options
@@ -839,8 +851,12 @@ Runs specified scripts using various runners.
839
851
  | `--replicas <replicas>` | Sets a custom number of replicas for deployment. |
840
852
  | `--pod-name <pod-name>` | Optional: Specifies the pod name for execution. |
841
853
  | `--node-name <node-name>` | Optional: Specifies the node name for execution. |
854
+ | `--ingress-node <node-name>` | Dedicated node for the host-network underpost-ingress listener. Workload --node-name never relocates it. |
842
855
  | `--ssh-key-path <path>` | Optional: Private key path for node SSH operations, forwarded to volume shipping over SSH. Defaults to engine-private/deploy/id_rsa. |
843
856
  | `--port <port>` | Optional: Specifies the port for execution. |
857
+ | `--expose-container-ports <ports>` | Comma-separated Service/container ports; multiple matched resources consume values by resource index. |
858
+ | `--expose-host-ports <ports>` | Comma-separated host ports paired with container ports by resource/port index. |
859
+ | `--local-proxy` | Starts the development path proxy after the expose runner creates its port-forwards. |
844
860
  | `--etc-hosts` | Enables etc-hosts context for the runner execution. |
845
861
  | `--volume-host-path <volume-host-path>` | Optional: Specifies the volume host path for test execution. |
846
862
  | `--volume-mount-path <volume-mount-path>` | Optional: Specifies the volume mount path for test execution. |
@@ -867,7 +883,7 @@ Runs specified scripts using various runners.
867
883
  | `--limits-memory <limits-memory>` | Sets memory limit for the runner execution. |
868
884
  | `--limits-cpu <limits-cpu>` | Sets CPU limit for the runner execution. |
869
885
  | `--resource-template-id <resource-template-id >` | Specifies a resource template ID for the runner execution. |
870
- | `--expose` | Enables service exposure for the runner execution. |
886
+ | `--expose` | Enables exposure-only behavior in compatible runners; the expose runner itself does not require this flag. |
871
887
  | `--conf-server-path <conf-server-path>` | Sets a custom configuration server path. |
872
888
  | `--underpost-root <underpost-root>` | Sets a custom Underpost root path. |
873
889
  | `--cmd-cron-jobs <cmd-cron-jobs>` | Pre-script commands to run before cron job execution. |
@@ -876,7 +892,7 @@ Runs specified scripts using various runners.
876
892
  | `--kubeadm` | Sets the kubeadm cluster context for the runner execution. |
877
893
  | `--k3s` | Sets the k3s cluster context for the runner execution. |
878
894
  | `--kind` | Sets the kind cluster context for the runner execution. |
879
- | `--traffic <traffic>` | Blue/green traffic colour to bake into generated manifests (default: blue). |
895
+ | `--traffic <traffic>` | Blue/green traffic colour to bake into generated manifests (default: blue). `stop` accepts a comma list, e.g. blue,green. |
880
896
  | `--git-clean` | Runs git clean on volume mount paths before copying. |
881
897
  | `--deploy-id <deploy-id>` | Sets deploy id context for the runner execution. |
882
898
  | `--user <user>` | Sets user context for the runner execution. |
@@ -887,6 +903,11 @@ Runs specified scripts using various runners.
887
903
  | `--timeout-idle <duration>` | Sets HTTPProxy per-route idle timeout (e.g., "10s", "infinity"). |
888
904
  | `--retry-count <count>` | Sets HTTPProxy per-route retry count (e.g., 3). |
889
905
  | `--retry-per-try-timeout <duration>` | Sets HTTPProxy retry per-try timeout (e.g., "150ms"). |
906
+ | `--gateway-api` | Routes through the Gateway API stack (Gateway + HTTPRoute) instead of the Contour HTTPProxy. Both manifest sets are always generated; this selects which one is applied. |
907
+ | `--disable-gateway-api` | Falls back to the Contour HTTPProxy stack in runners where the Gateway API is the default (cluster). |
908
+ | `--gateway-class <name>` | GatewayClass name for generated Gateway manifests (default "eg"). |
909
+ | `--disable-http3` | Omits the QUIC/HTTP3 listener config and the Alt-Svc advertisement from Gateway API manifests. |
910
+ | `--quic-port <port>` | UDP port advertised for QUIC/HTTP3 in generated Gateway API manifests (default 443). |
890
911
  | `--disable-private-conf-update` | Disables updates to private configuration during execution. |
891
912
  | `--logs` | Streams logs during the runner execution. |
892
913
  | `--monitor-status <status>` | Sets the status to monitor for pod/resource (default: "Running"). |
package/README.md CHANGED
@@ -16,7 +16,7 @@
16
16
 
17
17
  <div align="center">
18
18
 
19
- [![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.80)](https://socket.dev/npm/package/underpost/overview/3.2.80) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
19
+ [![Node.js CI](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/docker-image.ci.yml) [![Test](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml/badge.svg?branch=master)](https://github.com/underpostnet/engine/actions/workflows/coverall.ci.yml) [![Downloads](https://img.shields.io/npm/dm/underpost.svg)](https://www.npmjs.com/package/underpost) [![](https://data.jsdelivr.com/v1/package/npm/underpost/badge)](https://www.jsdelivr.com/package/npm/underpost) [![Socket Badge](https://socket.dev/api/badge/npm/package/underpost/3.2.90)](https://socket.dev/npm/package/underpost/overview/3.2.90) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine/badge.svg?branch=master)](https://coveralls.io/github/underpostnet/engine?branch=master) [![Version](https://img.shields.io/npm/v/underpost.svg)](https://www.npmjs.org/package/underpost) [![License](https://img.shields.io/npm/l/underpost.svg)](https://www.npmjs.com/package/underpost)
20
20
 
21
21
  </div>
22
22
 
@@ -88,7 +88,7 @@ npm run dev
88
88
  <!-- cli-index-start -->
89
89
  ## Underpost CLI
90
90
 
91
- > underpost ci/cd cli v3.2.80
91
+ > underpost ci/cd cli v3.2.90
92
92
 
93
93
  **Usage:** `underpost [options] [command]`
94
94
 
package/bin/deploy.js CHANGED
@@ -223,21 +223,23 @@ try {
223
223
  .readFileSync(`./engine-private/deploy/dd.router`, 'utf8')
224
224
  .split(`,`)
225
225
  .concat(['dd-cron'])) {
226
- if (fs.existsSync(`./engine-private/conf/${deployId}/build/development/deployment.yaml`))
227
- fs.copySync(
228
- `./engine-private/conf/${deployId}/build/development/deployment.yaml`,
229
- `./manifests/deployment/${deployId}-development/deployment.yaml`,
230
- );
231
- if (fs.existsSync(`./engine-private/conf/${deployId}/build/development/proxy.yaml`))
232
- fs.copySync(
233
- `./engine-private/conf/${deployId}/build/development/proxy.yaml`,
234
- `./manifests/deployment/${deployId}-development/proxy.yaml`,
235
- );
236
- if (fs.existsSync(`./engine-private/conf/${deployId}/build/development/pv-pvc.yaml`))
237
- fs.copySync(
238
- `./engine-private/conf/${deployId}/build/development/pv-pvc.yaml`,
239
- `./manifests/deployment/${deployId}-development/pv-pvc.yaml`,
240
- );
226
+ // The same set `deploy --build-manifest` mirrors. Anything missing here
227
+ // is a manifest the project repo silently stops carrying while the
228
+ // private build dir still has it.
229
+ for (const file of [
230
+ 'deployment.yaml',
231
+ 'proxy.yaml',
232
+ 'gateway.yaml',
233
+ 'httproute.yaml',
234
+ 'pv-pvc.yaml',
235
+ 'traffic-service.yaml',
236
+ 'grpc-service.yaml',
237
+ ]) {
238
+ const source = `./engine-private/conf/${deployId}/build/development/${file}`;
239
+ const target = `./manifests/deployment/${deployId}-development/${file}`;
240
+ if (fs.existsSync(source)) fs.copySync(source, target);
241
+ else fs.removeSync(target);
242
+ }
241
243
  shellExec(`node bin new --dev --default-conf --deploy-id ${deployId}`);
242
244
  }
243
245
  break;
@@ -763,7 +765,7 @@ nvidia/gpu-operator \
763
765
 
764
766
  case 'pw-conf': {
765
767
  const scriptPath = process.argv[3];
766
- shellExec(`kubectl delete configmap playwright-script`);
768
+ shellExec(`kubectl delete configmap playwright-script --ignore-not-found`);
767
769
  shellExec(`kubectl create configmap playwright-script \
768
770
  --from-file=script.js=${scriptPath} \
769
771
  --dry-run=client -o yaml | kubectl apply -f -
package/docker-compose.yml CHANGED
@@ -81,7 +81,7 @@ services:
81
81
  # (dd-default-development-blue). Connection targets use Docker service
82
82
  # discovery instead of hardcoded localhost.
83
83
  app:
84
- image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.80}
84
+ image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.90}
85
85
  container_name: dd-app
86
86
  # The start command is supplied by the generated override docker/compose.app.yml
87
87
  # (see `underpost docker-compose --generate --deploy-id <id>`), keeping this
package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml CHANGED
@@ -23,7 +23,7 @@ spec:
23
23
  spec:
24
24
  containers:
25
25
  - name: dd-cron-backup
26
- image: underpost/underpost-engine:v3.2.80
26
+ image: underpost/underpost-engine:v3.2.90
27
27
  command:
28
28
  - /bin/sh
29
29
  - -c
package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml CHANGED
@@ -23,7 +23,7 @@ spec:
23
23
  spec:
24
24
  containers:
25
25
  - name: dd-cron-dns
26
- image: underpost/underpost-engine:v3.2.80
26
+ image: underpost/underpost-engine:v3.2.90
27
27
  command:
28
28
  - /bin/sh
29
29
  - -c
package/manifests/deployment/dd-default-development/deployment.yaml CHANGED
@@ -17,7 +17,7 @@ spec:
17
17
  spec:
18
18
  containers:
19
19
  - name: dd-default-development-blue
20
- image: underpost/underpost-engine:v3.2.80
20
+ image: underpost/underpost-engine:v3.2.90
21
21
  # resources:
22
22
  # requests:
23
23
  # memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
98
98
  spec:
99
99
  containers:
100
100
  - name: dd-default-development-green
101
- image: underpost/underpost-engine:v3.2.80
101
+ image: underpost/underpost-engine:v3.2.90
102
102
  # resources:
103
103
  # requests:
104
104
  # memory: "124Ki"
package/manifests/deployment/playwright/deployment.yaml CHANGED
@@ -14,7 +14,7 @@ spec:
14
14
  spec:
15
15
  containers:
16
16
  - name: playwright
17
- image: mcr.microsoft.com/playwright:v1.59.0-jammy
17
+ image: mcr.microsoft.com/playwright:v1.62.1-jammy
18
18
  command:
19
19
  - /bin/bash
20
20
  - -c
package/manifests/mongodb/kustomization.yaml CHANGED
@@ -3,7 +3,10 @@
3
3
  apiVersion: kustomize.config.k8s.io/v1beta1
4
4
  kind: Kustomization
5
5
  resources:
6
- - pv-pvc.yaml
6
+ # pv-pvc.yaml is intentionally absent: the PersistentVolume set is one-per-replica, so it is
7
+ # generated from the effective replica count by MongoBootstrap.applyReplicaVolumes() and applied
8
+ # just before this kustomization. A static file can only describe a fixed number of members, and
9
+ # any --replicas above it leaves the surplus claims unbindable.
7
10
  - headless-service.yaml
8
11
  - statefulset.yaml
9
12
  # - backup-pv-pvc.yaml
package/manifests/mongodb/statefulset.yaml CHANGED
@@ -105,6 +105,10 @@ spec:
105
105
  volumeClaimTemplates:
106
106
  - metadata:
107
107
  name: mongodb-storage
108
+ # Without this label `kubectl delete pvc -l app=mongodb` matches nothing, leaving stale
109
+ # claims bound to retained PVs across redeploys.
110
+ labels:
111
+ app: mongodb
108
112
  spec:
109
113
  accessModes: ['ReadWriteOnce']
110
114
  storageClassName: mongodb-storage-class
package/manifests/mongodb/storage-class.yaml CHANGED
@@ -3,7 +3,14 @@ kind: StorageClass
3
3
  metadata:
4
4
  name: mongodb-storage-class
5
5
  annotations:
6
- storageclass.kubernetes.io/is-default-class: "false"
7
- provisioner: rancher.io/local-path
6
+ storageclass.kubernetes.io/is-default-class: 'false'
7
+ # Static class: the replica volumes are hostPath PVs generated one per member by
8
+ # MongoBootstrap.applyReplicaVolumes(), each pinned to one member via `claimRef`. It must NOT name a dynamic provisioner — with
9
+ # `rancher.io/local-path` the local-path controller also provisions for these PVCs, racing the
10
+ # static binder, so which volume a member ends up on is not deterministic. Two members landing
11
+ # on one directory is fatal: mongod dies on `WiredTiger.lock: fcntl: Resource temporarily
12
+ # unavailable`, since kind bind-mounts /data/mongodb from the host into every node.
13
+ provisioner: kubernetes.io/no-provisioner
8
14
  reclaimPolicy: Retain
15
+ # Static hostPath PVs carry no nodeAffinity, so binding can safely wait for the scheduler.
9
16
  volumeBindingMode: WaitForFirstConsumer
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "type": "module",
3
3
  "main": "src/index.js",
4
4
  "name": "underpost",
5
- "version": "3.2.80",
5
+ "version": "3.2.90",
6
6
  "description": "Underpost Platform — end-to-end CI/CD and application-delivery toolchain CLI. Covers bare metal, Kubernetes, K3s, kubeadm, LXD, container/image orchestration, secrets, databases, cron jobs, monitoring, SSH, runners, PWA + Workbox delivery, and release orchestration. Extensible via downstream CLIs.",
7
7
  "scripts": {
8
8
  "start": "node --max-old-space-size=8192 src/server",
@@ -72,16 +72,16 @@
72
72
  "homepage": "https://github.com/underpostnet/pwa-microservices-template#readme",
73
73
  "dependencies": {
74
74
  "@fortawesome/fontawesome-free": "^7.3.1",
75
- "@fullcalendar/rrule": "^7.0.1",
75
+ "@fullcalendar/rrule": "^7.0.2",
76
76
  "@grpc/grpc-js": "^1.14.4",
77
77
  "@grpc/proto-loader": "^0.8.1",
78
78
  "@neodrag/vanilla": "^2.3.1",
79
79
  "adm-zip": "^0.6.0",
80
- "ag-grid-community": "^36.0.1",
81
- "axios": "^1.18.1",
82
- "bumpp": "^11.1.0",
80
+ "ag-grid-community": "^36.1.0",
81
+ "bumpp": "^12.2.0",
82
+ "axios": "^1.19.0",
83
83
  "chai": "^6.2.2",
84
- "clipboardy": "^5.3.1",
84
+ "clipboardy": "^5.3.2",
85
85
  "cloudinary": "^2.10.0",
86
86
  "colors": "^1.4.0",
87
87
  "commander": "^15.0.0",
@@ -96,25 +96,25 @@
96
96
  "escape-string-regexp": "^5.0.0",
97
97
  "express": "^5.2.1",
98
98
  "express-fileupload": "^1.4.3",
99
- "express-rate-limit": "^8.6.0",
99
+ "express-rate-limit": "^8.6.2",
100
100
  "express-slow-down": "^3.1.0",
101
101
  "fast-json-stable-stringify": "^2.1.0",
102
- "favicons": "^7.3.0",
103
- "fs-extra": "^11.3.6",
104
- "fullcalendar": "^7.0.1",
102
+ "favicons": "^7.3.1",
103
+ "fs-extra": "^11.4.0",
104
+ "fullcalendar": "^7.0.2",
105
105
  "helmet": "^8.3.0",
106
106
  "html-minifier-terser": "^7.2.0",
107
107
  "http-proxy-middleware": "^4.2.0",
108
108
  "ignore-walk": "^9.0.0",
109
- "iovalkey": "^0.3.3",
109
+ "iovalkey": "^0.4.0",
110
110
  "json-colorizer": "^3.0.1",
111
111
  "jsonwebtoken": "^9.0.3",
112
112
  "mariadb": "^3.5.3",
113
- "marked": "^18.0.6",
114
- "mocha": "^11.7.6",
115
- "mongoose": "^9.7.4",
113
+ "marked": "^18.0.9",
114
+ "mongoose": "^9.9.1",
115
+ "mocha": "^11.8.0",
116
116
  "morgan": "^1.11.0",
117
- "nodemailer": "^9.0.3",
117
+ "nodemailer": "^9.0.5",
118
118
  "nodemon": "^3.0.1",
119
119
  "peer": "^1.0.2",
120
120
  "peerjs": "^1.5.5",
@@ -129,9 +129,9 @@
129
129
  "swagger-autogen": "^2.23.7",
130
130
  "swagger-ui-express": "^5.0.0",
131
131
  "typedoc": "^0.28.20",
132
- "typescript": "^6.0.3",
132
+ "typescript": "6.0.3",
133
133
  "validator": "^13.15.35",
134
- "vanilla-jsoneditor": "^3.12.0",
134
+ "vanilla-jsoneditor": "^3.13.0",
135
135
  "winston": "^3.19.0",
136
136
  "workbox-background-sync": "^7.4.1",
137
137
  "workbox-cacheable-response": "^7.4.1",