App Deployments (4b/N): operator reconcile into Kubernetes#220
Merged
Conversation
Increment 4b of the App Deployments epic. The operator turns app_deployment rows for its cluster into namespaced k8s objects. - Pure, unit-tested object builders (13 tests): Namespace (restricted Pod Security), default-deny NetworkPolicy, PVC, ConfigMap/Secret for files, Deployment (locked-down securityContext: non-root, drop ALL caps, no privesc, read-only rootfs; PVC + file subPath read-only mounts), ClusterIP Service (named per compose service for intra-namespace DNS), and a cert-manager-TLS Ingress for the expose: ingress port. - reconcile_app_deployments(ctx): server-side apply per deployment, filtered by the operator's new app_cluster_id config. Resolves env+files via lnvps_compose against generated secrets (stored once in a namespace 'generated' Secret for stability) + customer config; writes back status/hostname; GCs namespaces for removed/deleted deployments. - Wired into the operator's initial + periodic reconcile loop. - ResourceQuota builder present but not yet applied (a limits.* quota needs container limits, which land with the capacity increment). Part of work/app-deployments.md.
… to 0 An expired (unpaid) app deployment now scales its workload to 0 replicas instead of being torn down: pods stop but the PVCs (customer data) are retained. Only a real deletion GCs the namespace and its volumes. PVCs use the cluster's default StorageClass. - reconcile_one resolves the deployment's subscription and treats an expired 'expires' as not-running (replicas 0), alongside desired_state/deleted. - Adds chrono to the operator for the expiry comparison.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Increment 4b of the managed App Deployments epic (see
work/app-deployments.md). Thelnvps_operatornow rendersapp_deploymentrows (for its configured cluster) into Kubernetes, using the sharedlnvps_composeparser (#218/#219).Object builders (pure, unit-tested — 13 tests)
Recreatestrategy; PVCs mounted read-write andfiles:mounted read-only via subPath.mariadb:3306refs).volumes:; ConfigMap (non-sensitive files) / Secret (generated secrets +sensitivefiles).expose: ingressport.Reconcile
reconcile_app_deployments(ctx)— gated on a new operatorapp_cluster_idconfig; for each deployment: server-side apply all objects, resolve${…}env+files against generated secrets (created once, stored in a namespacegeneratedSecret so values stay stable) + customer config, write backstatus/hostname, and GC namespaces for removed/deleted deployments. Wired into the operator's initial + periodic loop. Net effect: the customerAppDeployment.status/hostnamenow populate once provisioned.Deferred
The ResourceQuota builder is present but not applied yet — a
limits.*quota requires containers to carry resource limits, which arrive with the capacity increment (4c) along with per-serviceresources:, the app footprint, static per-cluster capacity, and anAppClusterCapacityServicefor order-time admission.Next
4c) capacity management · 3b) customer ordering (subscription + invoice) · 5) seed strfry/HAVEN/route96/Blossom.