fix(executor): real k8s dispatch — explicit-context safety + create-not-apply - #21
Merged
Conversation
…ot-apply
Hardening + a real defect caught before it reached a cluster.
Safety: the K8sAdapter no longer dispatches to whatever kube-context happens to be
current (which, on this box, is prod GKE). Applying now REQUIRES an explicit
SOURCEOS_KUBE_CONTEXT; without it, apply is refused (manifest still emitted). Target
namespace via SOURCEOS_KUBE_NAMESPACE (default sourceos-mesh), stamped into the manifest.
Defect fix: dispatch used `kubectl apply`, which rejects generateName ("cannot use
generate name with apply"). A Job is one-shot + immutable, so `kubectl create` is correct
— and it supports generateName (collision-free job names per dispatch). Verified the
emitted manifest with `kubectl create --dry-run=client` (client-side, no cluster/server
contact): "job.batch/<unknown> created (dry run)".
Tests: +2 (manifest carries namespace; apply refused without explicit context) = 92 green.
Full live-apply on an ephemeral kind cluster is one `docker`+`kind up` away; the mechanism
is proven and the prod-dispatch footgun is closed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Hardening the k8s execution adapter — plus a real defect caught by client-side validation before it ever reached a cluster.
Safety: never dispatch to the current context
The current kube-context on the dev box is prod GKE. The K8sAdapter no longer falls back to it — applying now requires an explicit
SOURCEOS_KUBE_CONTEXT; without it, apply is refused (the manifest is still emitted for inspection). Target namespace viaSOURCEOS_KUBE_NAMESPACE(defaultsourceos-mesh), stamped into the manifest.Defect fix:
create, notapplyDispatch used
kubectl apply, which rejectsgenerateName(cannot use generate name with apply). A Job is one-shot + immutable, sokubectl createis the correct verb — and it supportsgenerateName, giving collision-free job names per dispatch. Verified the emitted manifest withkubectl create --dry-run=client(client-side, no cluster/server contact):job.batch/<unknown> created (dry run).Tests
+2 (manifest carries the target namespace; apply refused without an explicit context) = 92 tools tests green;
validatepasses.Full live-apply on an ephemeral
kindcluster is onedocker+kindaway (docker daemon is down on this box right now); the dispatch mechanism is proven client-side and the prod-dispatch footgun is closed.