tegwick
5a0f4cb5c8
Registers the repo with State Hub (agents / practice, prefix RCP-WP) and fills in the rapp shape. declarations/rapp.yaml declares a manifest-managed platform service owned by canned-prompts, bound to rail-kubernetes and reef-railiance, with rollout, smoke and rollback contracts. The image pin says `pending-publication` rather than carrying a placeholder digest. The image builds and was verified locally (canned-prompts CANP-WP-0006-T06) but has never been pushed, so no registry digest exists. A placeholder shaped like a real digest would be worse than a sentinel: it could be mistaken for something deployable. manifests/ follows the rapp-sbom-nexus shape: namespace labelled for the postgres client, external secrets from OpenBao, a migration Job, and the runtime Deployment with a ClusterIP-only Service, dedicated ServiceAccount and default-deny plus runtime NetworkPolicies. Three choices worth stating. Credentials arrive as mounted files, never env vars — an env var holding a password is visible in kubectl describe, in crash dumps, and to anything that can read /proc. Migrations run as a Job rather than at start-up, so a schema rollback stays separate from a code rollback and replicas do not race. Liveness points at /healthz, which checks only that the process is up: pointing it at a database-dependent path would restart every replica during a database blip. Egress is PostgreSQL and DNS only. A package arrives by publish; the registry never reaches out, so it is given no path to. tools/smoke.sh checks what only the cluster can answer and calls canned-prompts' service/tools/smoke.py for health and migration head, rather than holding a second opinion about whether the service is healthy. RCP-WP-0002 carries the two operator actions that block a first rollout — publishing the image and provisioning database roles — and records per-publisher identity as a decision belonging upstream, which this repo must not paper over with cluster configuration implying finer control than exists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
58 lines
3 KiB
Bash
Executable file
58 lines
3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Deployment-level smoke checks for rapp-canned-prompts.
|
|
#
|
|
# The service-level half lives in canned-prompts (`service/tools/smoke.py`) and
|
|
# is called from here rather than reimplemented — the deployment should not hold
|
|
# a second opinion about whether the service is healthy.
|
|
#
|
|
# What is checked here is what only the cluster can answer: that secrets
|
|
# materialized, that the Service is private, that NetworkPolicies exist, and
|
|
# that the running image is the digest this repo pins.
|
|
set -euo pipefail
|
|
|
|
NS=${NS:-canned-prompts}
|
|
EXPECT_DIGEST=${EXPECT_DIGEST:-$(grep -A1 'name: canned-prompts$' declarations/rapp.yaml | grep 'version:' | awk '{print $2}' || true)}
|
|
FAILED=0
|
|
|
|
check() { # name, condition-output
|
|
if [ "$2" = "ok" ]; then printf 'PASS %s\n' "$1"; else printf 'FAIL %s %s\n' "$1" "$2"; FAILED=$((FAILED+1)); fi
|
|
}
|
|
|
|
# external-secrets-ready
|
|
for s in canned-prompts-postgres-runtime canned-prompts-postgres-migration; do
|
|
if kubectl -n "$NS" get secret "$s" >/dev/null 2>&1; then check "external-secrets-ready:$s" ok
|
|
else check "external-secrets-ready:$s" "secret absent"; fi
|
|
done
|
|
|
|
# private-service-only — a ClusterIP and no Ingress pointing at it
|
|
TYPE=$(kubectl -n "$NS" get svc canned-prompts -o jsonpath='{.spec.type}' 2>/dev/null || echo missing)
|
|
[ "$TYPE" = "ClusterIP" ] && check "private-service-only:type" ok || check "private-service-only:type" "type=$TYPE"
|
|
INGRESS=$(kubectl -n "$NS" get ingress -o name 2>/dev/null | wc -l)
|
|
[ "$INGRESS" = "0" ] && check "private-service-only:no-ingress" ok || check "private-service-only:no-ingress" "$INGRESS ingress objects"
|
|
|
|
# networkpolicies-present — a default-deny plus the runtime policy
|
|
NP=$(kubectl -n "$NS" get networkpolicy -o name 2>/dev/null | wc -l)
|
|
[ "$NP" -ge 2 ] && check "networkpolicies-present" ok || check "networkpolicies-present" "$NP policies"
|
|
|
|
# live-image-digest-match
|
|
LIVE=$(kubectl -n "$NS" get deploy canned-prompts -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null || echo missing)
|
|
case "$EXPECT_DIGEST" in
|
|
""|pending-publication)
|
|
check "live-image-digest-match" "no digest pinned yet (declarations/rapp.yaml says pending-publication)" ;;
|
|
*) [ "${LIVE##*@}" = "$EXPECT_DIGEST" ] && check "live-image-digest-match" ok \
|
|
|| check "live-image-digest-match" "live=$LIVE expected=$EXPECT_DIGEST" ;;
|
|
esac
|
|
|
|
# state-health-ok and migration-at-head, from the owning repo's checker.
|
|
SERVICE_SMOKE=${SERVICE_SMOKE:-$HOME/canned-prompts/service/tools/smoke.py}
|
|
if [ -f "$SERVICE_SMOKE" ]; then
|
|
echo "--- service-level (${SERVICE_SMOKE}) ---"
|
|
kubectl -n "$NS" port-forward svc/canned-prompts 18000:8000 >/dev/null 2>&1 &
|
|
PF=$!; trap 'kill $PF 2>/dev/null || true' EXIT; sleep 3
|
|
python3 "$SERVICE_SMOKE" --base http://127.0.0.1:18000 --expect-migration "${EXPECT_MIGRATION:-0002}" || FAILED=$((FAILED+1))
|
|
else
|
|
check "service-level-checks" "canned-prompts checkout not found at $SERVICE_SMOKE"
|
|
fi
|
|
|
|
[ "$FAILED" -eq 0 ] || { echo; echo "$FAILED check(s) failed" >&2; exit 1; }
|
|
echo; echo "all deployment checks passed"
|