urun-cli 0.7.6__tar.gz → 0.7.8__tar.gz

{urun_cli-0.7.6 → urun_cli-0.7.8}/CHANGELOG.md

@@ -1,5 +1,30 @@
 ## Unreleased
 
+- `urun release promote <release_id> [--environment main]` — make an existing
+  release current again (clean rollback, no marker commits). Server side it
+  takes the same path as a same-content `urun deploy`: the control plane
+  re-registers the release and republishes the release pointer.
+- Deploy deps collector: `@app.function(deps=...)` may now reference a
+  module-level `Dependencies(...)` constant imported from a file shipped with
+  the app (`from sense_deploy import SENSE_DEPS`) — resolved statically by the
+  same side-effect-free evaluator, including re-export chains and the
+  `import mod` + `mod.SYM` attribute form. An attached `deps=` that cannot be
+  statically resolved now FAILS THE DEPLOY LOUDLY naming `file:line`, the
+  import it came through, and the fix — previously it silently shipped an
+  EMPTY manifest (no python pins, no files) and the app's boot self-test died
+  with `No module named ...` after fleet rollout (sense, 2026-10-27/28).
+- `kubectl urun` — a kubectl plugin (`kubectl-urun`, installed alongside
+  `urun`) with four verbs over the `gpu.urun.sh/v1alpha1` GPUWorker surface:
+  `logs` (the `logs.urun.sh/v1` log subresource, with `-f` follow
+  passthrough, `--since`, `--tail`, `-s <service>`), `cordon`/`uncordon`
+  (`spec.unschedulable`), `drain` (cordon, then wait for the `Draining`
+  condition to reach `False`/`Drained`, nonzero on `--timeout`), and
+  `describe` (node block, services, conditions, events, liveness lease,
+  claim summary). Claim-owned workers are cordoned through their OWNING
+  GPUWorkerClaim (resolved via `spec.claimRef`) because the claim
+  reconciler re-renders the worker's spec; the patched object is printed.
+  All verbs ride a bounded `kubectl proxy --port=0` child, so
+  `--kubeconfig`/`--context`/`-n` resolve exactly as kubectl resolves them.
 - Security (ENG-570 / pentest urun-cli-01, mirrored in urun-python
   `urun/core/store/repo.py`): `store.repo(...)` specs parsed from untrusted
   app source are validated before any git call. The `@<ref>` pin must be a

{urun_cli-0.7.6 → urun_cli-0.7.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: urun-cli
-Version: 0.7.6
+Version: 0.7.8
 Summary: End-user CLI for deploying apps to urun
 Project-URL: Homepage, https://urun.sh
 Project-URL: Repository, https://github.com/urun-sh/urun-cli
@@ -534,6 +534,33 @@ What it does:
   sooner. `--no-logs` skips streaming the occupant's log after creation
   (Ctrl-C also detaches without tearing the occupant down).
 
+## Operator: GPUWorker nodes (`kubectl urun`)
+
+Installing `urun-cli` also installs the `kubectl-urun` binary; with it on
+`PATH`, kubectl dispatches `kubectl urun` to it as a standard kubectl plugin.
+These verbs are the operator surface over the `gpu.urun.sh/v1alpha1`
+GPUWorker custom resources (the cluster must have the urun controller
+installed); they resolve kubeconfig/context through kubectl itself, so
+`--kubeconfig`, `--context`, and `-n` behave like any other kubectl command:
+
+```bash
+kubectl urun logs <worker> -n urun                       # one-shot aggregated log
+kubectl urun logs <worker> -n urun -s vineyard --tail 200 --since 30m
+kubectl urun logs <worker> -n urun -f                    # follow; Ctrl-C detaches
+kubectl urun cordon <worker> -n urun                     # mark unschedulable
+kubectl urun uncordon <worker> -n urun
+kubectl urun drain <worker> -n urun --timeout 300        # cordon + wait for Drained
+kubectl urun describe <worker> -n urun                   # node/services/conditions/events/lease
+```
+
+`cordon` sets `spec.unschedulable`. Claim-owned workers (workers with a
+`spec.claimRef`) are re-rendered from their claim by the claim reconciler, so
+`cordon`/`uncordon`/`drain` patch the OWNING CLAIM's `spec.unschedulable`
+instead and print which object they patched; workers without a claim are
+patched directly. `drain` cordons and then watches the worker's `Draining`
+condition until it flips to `False`/`Drained` (no sessions left), exiting
+nonzero on `--timeout` (default 300s).
+
 ## What gets deployed
 
 `urun deploy` creates a source manifest from your Python entrypoint:
@@ -579,6 +606,11 @@ def superres(): ...
 - `files=` is **purely additive**. With no `files=`, collection is exactly what
   it was before.
 - Entries are **individual files**, not directories or globs. List each file.
+- `deps=` may be a module-level `Dependencies(...)` constant imported from a
+  file shipped with the app (`from deps_mod import APP_DEPS`) — the deploy
+  collector resolves it statically. Anything it cannot resolve (an import
+  outside the app directory, a non-literal) **fails the deploy loudly**, naming
+  `file:line` and the fix — it never ships an empty manifest.
 - A declared path that does not exist, escapes the app directory (`..`, a
   symlink pointing outside), or is absolute **fails the deploy immediately**,
   naming the path and the directory it was looked up under. A declared file is

{urun_cli-0.7.6 → urun_cli-0.7.8}/README.md

@@ -509,6 +509,33 @@ What it does:
   sooner. `--no-logs` skips streaming the occupant's log after creation
   (Ctrl-C also detaches without tearing the occupant down).
 
+## Operator: GPUWorker nodes (`kubectl urun`)
+
+Installing `urun-cli` also installs the `kubectl-urun` binary; with it on
+`PATH`, kubectl dispatches `kubectl urun` to it as a standard kubectl plugin.
+These verbs are the operator surface over the `gpu.urun.sh/v1alpha1`
+GPUWorker custom resources (the cluster must have the urun controller
+installed); they resolve kubeconfig/context through kubectl itself, so
+`--kubeconfig`, `--context`, and `-n` behave like any other kubectl command:
+
+```bash
+kubectl urun logs <worker> -n urun                       # one-shot aggregated log
+kubectl urun logs <worker> -n urun -s vineyard --tail 200 --since 30m
+kubectl urun logs <worker> -n urun -f                    # follow; Ctrl-C detaches
+kubectl urun cordon <worker> -n urun                     # mark unschedulable
+kubectl urun uncordon <worker> -n urun
+kubectl urun drain <worker> -n urun --timeout 300        # cordon + wait for Drained
+kubectl urun describe <worker> -n urun                   # node/services/conditions/events/lease
+```
+
+`cordon` sets `spec.unschedulable`. Claim-owned workers (workers with a
+`spec.claimRef`) are re-rendered from their claim by the claim reconciler, so
+`cordon`/`uncordon`/`drain` patch the OWNING CLAIM's `spec.unschedulable`
+instead and print which object they patched; workers without a claim are
+patched directly. `drain` cordons and then watches the worker's `Draining`
+condition until it flips to `False`/`Drained` (no sessions left), exiting
+nonzero on `--timeout` (default 300s).
+
 ## What gets deployed
 
 `urun deploy` creates a source manifest from your Python entrypoint:
@@ -554,6 +581,11 @@ def superres(): ...
 - `files=` is **purely additive**. With no `files=`, collection is exactly what
   it was before.
 - Entries are **individual files**, not directories or globs. List each file.
+- `deps=` may be a module-level `Dependencies(...)` constant imported from a
+  file shipped with the app (`from deps_mod import APP_DEPS`) — the deploy
+  collector resolves it statically. Anything it cannot resolve (an import
+  outside the app directory, a non-literal) **fails the deploy loudly**, naming
+  `file:line` and the fix — it never ships an empty manifest.
 - A declared path that does not exist, escapes the app directory (`..`, a
   symlink pointing outside), or is absolute **fails the deploy immediately**,
   naming the path and the directory it was looked up under. A declared file is

{urun_cli-0.7.6 → urun_cli-0.7.8}/pyproject.toml

@@ -20,7 +20,7 @@ name = "urun-cli"
 # so every merge remains on the already-published version until this value is
 # advanced. Wiring semantic-release into CI remains separate work; this patch
 # bump is the minimal release unblock (post-v0.6.3 fixes + the Rust feature minor).
-version = "0.7.6"
+version = "0.7.8"
 description = "End-user CLI for deploying apps to urun"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -48,6 +48,7 @@ Issues = "https://github.com/urun-sh/urun-cli/issues"
 [project.scripts]
 urun = "urun.cli:main"
 urun-cli = "urun.cli:main"
+kubectl-urun = "urun.kubectl_plugin:main"
 
 [project.optional-dependencies]
 # Rust app discovery (urun/rust.py) parses with the pinned native

{urun_cli-0.7.6 → urun_cli-0.7.8}/src/urun/api.py

@@ -461,6 +461,18 @@ class ApiClient:
     def get_release(self, release_id: str) -> dict[str, Any]:
         return self._get(f"/cli/releases/{urllib.parse.quote(release_id, safe='')}")
 
+    def promote_release(self, release_id: str, environment: str) -> dict[str, Any]:
+        """Make an EXISTING release current for ``environment`` (rollback).
+
+        ``POST /cli/releases/<id>/promote`` re-fires the release's deploy event —
+        the same path a same-content ``urun deploy`` takes — so the control plane
+        re-registers it and republishes the release pointer.
+        """
+        return self._post(
+            f"/cli/releases/{urllib.parse.quote(release_id, safe='')}/promote",
+            {"environment": environment},
+        )
+
     def query_logs(self, params: dict[str, Any] | None = None) -> dict[str, Any]:
         return self._get("/cli/logs", params)
 

{urun_cli-0.7.6 → urun_cli-0.7.8}/src/urun/catalog.py

@@ -120,7 +120,7 @@ ENGINE_DEPS: dict[str, list[str]] = {
         "nvidia-cuda-crt==13.0.88",
         "nvidia-cuda-cccl==13.0.85",
         "nvidia-nvvm==13.0.88",
-        "nvidia-cuda-runtime==13.0.96",
+        "nvidia-cuda-runtime==13.0.*",
         "numpy<2",
         "pillow>=10.0.0",
         "orjson",
@@ -162,7 +162,7 @@ ENGINE_DEPS: dict[str, list[str]] = {
         "nvidia-cuda-crt==13.0.88",
         "nvidia-cuda-cccl==13.0.85",
         "nvidia-nvvm==13.0.88",
-        "nvidia-cuda-runtime==13.0.96",
+        "nvidia-cuda-runtime==13.0.*",
         "numpy<2",
         "pillow>=10.0.0",
         "orjson",
@@ -368,7 +368,7 @@ ENGINE_DEPS: dict[str, list[str]] = {
         "nvidia-cuda-crt==13.0.88",
         "nvidia-cuda-cccl==13.0.85",
         "nvidia-nvvm==13.0.88",
-        "nvidia-cuda-runtime==13.0.96",
+        "nvidia-cuda-runtime==13.0.*",
         "numpy<2",
         "pillow>=10.0.0",
         "orjson",
@@ -446,7 +446,7 @@ ENGINE_DEPS: dict[str, list[str]] = {
         "nvidia-cuda-crt==13.0.88",
         "nvidia-cuda-cccl==13.0.85",
         "nvidia-nvvm==13.0.88",
-        "nvidia-cuda-runtime==13.0.96",
+        "nvidia-cuda-runtime==13.0.*",
         "ninja",
         "pip",
         "nvidia-cutlass-dsl>=4.6.0.dev0,<5",