2 Commits

Author	SHA1	Message	Date
Adolfo Delorenzo	9fb894c5af	feat(update): pre-flight gates + deeper healthcheck + auto-rollback ... Phase 8 of v0.3. Tightens the update lifecycle on both ends. Pre-flight (apply.go, before any download): - Free-space check on the passive partition: image size + 10% headroom must be available. Uses statfs(2) via the new pkg/partition.FreeBytes / HasFreeSpaceFor helpers (tests cover happy path, tiny request, huge request, missing path). Catches corrupted-FS and shrunk-partition cases before we destroy the existing slot data. - Node-block-label check: refuses if the local K8s node carries the updates.kubesolo.io/block=true label. New pkg/health.CheckNodeBlocked shells out to kubectl per the project's zero-deps stance. Silently bypassed when no kubeconfig is reachable (air-gap case). Skipped by --force. Healthcheck (extended via new pkg/health/extended.go + preflight.go): - CheckKubeSystemReady waits until every kube-system pod has held the Running phase for >= N seconds (default 30). Catches "started ok, will crash-loop" bugs that a single-shot phase check misses. - CheckProbeURL fetches an operator-supplied URL; 200 = pass. Wired through update.conf as healthcheck_url= and cloud-init updates.healthcheck_url. - CheckDiskWritable writes/fsyncs/reads a 1-KiB probe under /var/lib/kubesolo. Always runs in healthcheck so a wedged data partition fails fast. - pkg/health.Status grows KubeSystemReady, ProbeURL, DiskWritable booleans. Optional checks default to true in RunAll() so they don't block when unconfigured. health_test.go updated to the new 6-field shape. Auto-rollback (healthcheck.go): - state.UpdateState gains HealthCheckFailures (consecutive post-Activated failures). Reset on a clean pass. - --auto-rollback-after N (also auto_rollback_after= in update.conf) triggers env.ForceRollback() when the failure count reaches the threshold. State transitions to RolledBack with a descriptive LastError. The command still exits with the healthcheck error; the operator/init is expected to reboot. - Only fires while Phase == Activated. Doesn't second-guess a long-stable system that happens to fail one healthcheck. config / opts / cloud-init plumbing: - update.conf gains healthcheck_url= and auto_rollback_after= keys. - New CLI flags: --healthcheck-url, --auto-rollback-after, --kube-system-settle. - cloud-init full-config.yaml documents the new updates: subfields. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-14 19:08:30 -06:00
Adolfo Delorenzo	dfed6ddba8	feat(update): channels, maintenance windows, min-version gate ... Phase 6 of v0.3. The update agent now refuses to apply artifacts whose channel doesn't match local policy, whose architecture differs from the running host, or whose min_compatible_version is above the current version. It also refuses to apply outside a configured maintenance window unless --force is given. New package update/pkg/config: - config.Load parses /etc/kubesolo/update.conf (key=value, # comments, unknown keys ignored). Missing file is fine — fresh systems before cloud-init has run. - ParseWindow handles "HH:MM-HH:MM" plus the wrapping midnight case (e.g. "23:00-01:00"). Empty input -> AlwaysOpen (no constraint). Degenerate zero-length windows never match. - CompareVersions does a simple 3-component semver compare with the 'v' prefix optional and pre-release suffix ignored. - 14 unit tests total. update/pkg/image/image.UpdateMetadata gains three optional fields: - channel ("stable", "beta", ...) - min_compatible_version (refuse upgrade if current < this) - architecture ("amd64", "arm64", ...) update/cmd/opts.go reads update.conf and merges it into opts; explicit --server / --channel / --pubkey / --maintenance-window CLI flags override the file. New --force, --conf, --channel, --maintenance-window flags. Precedence: CLI > config file > package defaults. update/cmd/apply.go gains four gates in order: 1. Maintenance window — checked locally before any HTTP work; skipped with --force. 2. Channel — refused if metadata.channel doesn't match opts.Channel. 3. Architecture — refused if metadata.architecture != runtime.GOARCH. 4. Min compatible version — refused if FromVersion < min_compatible. All gate failures transition state to Failed with a clear LastError. cloud-init gains a top-level updates: block (Server, Channel, MaintenanceWindow, PubKey). cloud-init.ApplyUpdates writes /etc/kubesolo/update.conf from those fields on first boot. Empty block leaves any existing file alone (so hand-edited update.conf survives a reboot without cloud-init re-applying). 4 new tests cover empty / all / partial / parent-dir-creation cases. full-config.yaml example updated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-14 18:21:46 -06:00