Files
kubesolo-os/update/cmd/opts.go
Adolfo Delorenzo 9fb894c5af
Some checks failed
ARM64 Build / Build generic ARM64 disk image (push) Failing after 4s
CI / Go Tests (push) Successful in 1m29s
CI / Shellcheck (push) Successful in 48s
CI / Build Go Binaries (amd64, linux, linux-amd64) (push) Successful in 1m12s
CI / Build Go Binaries (arm64, linux, linux-arm64) (push) Has been cancelled
feat(update): pre-flight gates + deeper healthcheck + auto-rollback
Phase 8 of v0.3. Tightens the update lifecycle on both ends.

Pre-flight (apply.go, before any download):
- Free-space check on the passive partition: image size + 10% headroom must
  be available. Uses statfs(2) via the new pkg/partition.FreeBytes /
  HasFreeSpaceFor helpers (tests cover happy path, tiny request, huge
  request, missing path). Catches corrupted-FS and shrunk-partition cases
  before we destroy the existing slot data.
- Node-block-label check: refuses if the local K8s node carries the
  updates.kubesolo.io/block=true label. New pkg/health.CheckNodeBlocked
  shells out to kubectl per the project's zero-deps stance. Silently bypassed
  when no kubeconfig is reachable (air-gap case). Skipped by --force.

Healthcheck (extended via new pkg/health/extended.go + preflight.go):
- CheckKubeSystemReady waits until every kube-system pod has held the Running
  phase for >= N seconds (default 30). Catches "started ok, will crash-loop"
  bugs that a single-shot phase check misses.
- CheckProbeURL fetches an operator-supplied URL; 200 = pass. Wired through
  update.conf as healthcheck_url= and cloud-init updates.healthcheck_url.
- CheckDiskWritable writes/fsyncs/reads a 1-KiB probe under /var/lib/kubesolo.
  Always runs in healthcheck so a wedged data partition fails fast.
- pkg/health.Status grows KubeSystemReady, ProbeURL, DiskWritable booleans.
  Optional checks default to true in RunAll() so they don't block when
  unconfigured. health_test.go updated to the new 6-field shape.

Auto-rollback (healthcheck.go):
- state.UpdateState gains HealthCheckFailures (consecutive post-Activated
  failures). Reset on a clean pass.
- --auto-rollback-after N (also auto_rollback_after= in update.conf) triggers
  env.ForceRollback() when the failure count reaches the threshold. State
  transitions to RolledBack with a descriptive LastError. The command still
  exits with the healthcheck error; the operator/init is expected to reboot.
- Only fires while Phase == Activated. Doesn't second-guess a long-stable
  system that happens to fail one healthcheck.

config / opts / cloud-init plumbing:
- update.conf gains healthcheck_url= and auto_rollback_after= keys.
- New CLI flags: --healthcheck-url, --auto-rollback-after, --kube-system-settle.
- cloud-init full-config.yaml documents the new updates: subfields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-14 19:08:30 -06:00

204 lines
4.9 KiB
Go

package cmd
import (
"log/slog"
"github.com/portainer/kubesolo-os/update/pkg/bootenv"
"github.com/portainer/kubesolo-os/update/pkg/config"
"github.com/portainer/kubesolo-os/update/pkg/state"
)
// opts holds shared command-line options for all subcommands.
type opts struct {
ServerURL string
Registry string // OCI registry ref (e.g. ghcr.io/foo/kubesolo-os). Mutually exclusive with ServerURL.
Tag string // OCI tag to pull (default: equal to Channel, falling back to "stable")
GrubenvPath string
TimeoutSecs int
PubKeyPath string
BootEnvType string // "grub" or "rpi"
BootEnvPath string // path for RPi boot control dir
StatePath string // location of state.json (default: state.DefaultPath)
ConfPath string // location of update.conf (default: config.DefaultPath)
Channel string // update channel ("stable" by default)
MaintenanceWindow string // "HH:MM-HH:MM" or empty for always-allow
HealthcheckURL string // optional GET probe for healthcheck
AutoRollbackAfter int // healthcheck: rollback after N consecutive failures (0=off)
KubeSystemSettle int // healthcheck: kube-system pods must be Running for N seconds (0=disabled)
Force bool // bypass maintenance window
JSON bool // status: emit JSON instead of human-readable
}
// NewBootEnv creates a BootEnv from the parsed options.
func (o opts) NewBootEnv() bootenv.BootEnv {
switch o.BootEnvType {
case "rpi":
return bootenv.NewRPi(o.BootEnvPath)
default:
return bootenv.NewGRUB(o.GrubenvPath)
}
}
// parseOpts extracts command-line flags from args.
//
// Precedence: explicit CLI flags > /etc/kubesolo/update.conf > package
// defaults. The config file is loaded first so any CLI flag overrides it.
//
// Unknown flags are ignored (forward-compat).
func parseOpts(args []string) opts {
o := opts{
GrubenvPath: "/boot/grub/grubenv",
TimeoutSecs: 120,
BootEnvType: "grub",
StatePath: state.DefaultPath,
ConfPath: config.DefaultPath,
Channel: "stable",
}
// First pass: pick up --conf so it can point at a different file before
// we load. (Tests pass --conf <tempdir>/update.conf.)
for i := 0; i < len(args); i++ {
if args[i] == "--conf" && i+1 < len(args) {
o.ConfPath = args[i+1]
}
}
// Load config file. Missing file is fine (fresh system, no cloud-init yet).
if cfg, err := config.Load(o.ConfPath); err == nil && cfg != nil {
if cfg.Server != "" {
o.ServerURL = cfg.Server
}
if cfg.Channel != "" {
o.Channel = cfg.Channel
}
if cfg.MaintenanceWindow != "" {
o.MaintenanceWindow = cfg.MaintenanceWindow
}
if cfg.PubKey != "" {
o.PubKeyPath = cfg.PubKey
}
if cfg.HealthcheckURL != "" {
o.HealthcheckURL = cfg.HealthcheckURL
}
if cfg.AutoRollbackAfter > 0 {
o.AutoRollbackAfter = cfg.AutoRollbackAfter
}
} else if err != nil {
slog.Warn("could not load update.conf", "path", o.ConfPath, "error", err)
}
// Second pass: CLI overrides config file values.
for i := 0; i < len(args); i++ {
switch args[i] {
case "--conf":
i++ // already handled above
case "--state":
if i+1 < len(args) {
o.StatePath = args[i+1]
i++
}
case "--channel":
if i+1 < len(args) {
o.Channel = args[i+1]
i++
}
case "--maintenance-window":
if i+1 < len(args) {
o.MaintenanceWindow = args[i+1]
i++
}
case "--force":
o.Force = true
case "--healthcheck-url":
if i+1 < len(args) {
o.HealthcheckURL = args[i+1]
i++
}
case "--auto-rollback-after":
if i+1 < len(args) {
n := 0
for _, ch := range args[i+1] {
if ch >= '0' && ch <= '9' {
n = n*10 + int(ch-'0')
} else {
n = 0
break
}
}
if n > 0 {
o.AutoRollbackAfter = n
}
i++
}
case "--kube-system-settle":
if i+1 < len(args) {
n := 0
for _, ch := range args[i+1] {
if ch >= '0' && ch <= '9' {
n = n*10 + int(ch-'0')
} else {
n = 0
break
}
}
if n > 0 {
o.KubeSystemSettle = n
}
i++
}
case "--json":
o.JSON = true
case "--server":
if i+1 < len(args) {
o.ServerURL = args[i+1]
i++
}
case "--registry":
if i+1 < len(args) {
o.Registry = args[i+1]
i++
}
case "--tag":
if i+1 < len(args) {
o.Tag = args[i+1]
i++
}
case "--grubenv":
if i+1 < len(args) {
o.GrubenvPath = args[i+1]
i++
}
case "--timeout":
if i+1 < len(args) {
val := 0
for _, c := range args[i+1] {
if c >= '0' && c <= '9' {
val = val*10 + int(c-'0')
}
}
if val > 0 {
o.TimeoutSecs = val
}
i++
}
case "--pubkey":
if i+1 < len(args) {
o.PubKeyPath = args[i+1]
i++
}
case "--bootenv":
if i+1 < len(args) {
o.BootEnvType = args[i+1]
i++
}
case "--bootenv-path":
if i+1 < len(args) {
o.BootEnvPath = args[i+1]
i++
}
}
}
return o
}