Add managed registry provisioning, pruning, and readiness tracking
This commit is contained in:
@@ -0,0 +1,79 @@
|
||||
<?php
|
||||
|
||||
namespace App\Actions\Registries;
|
||||
|
||||
use App\Enums\BuildArtifactStatus;
|
||||
use App\Enums\OperationKind;
|
||||
use App\Enums\OperationStatus;
|
||||
use App\Models\BuildArtifact;
|
||||
use App\Models\Operation;
|
||||
use App\Models\Registry;
|
||||
use App\Models\Server;
|
||||
use App\Services\Registries\ManagedRegistryOperationScripts;
|
||||
use App\Services\Registries\ManagedRegistryRetention;
|
||||
use RuntimeException;
|
||||
|
||||
class CreateManagedRegistryMaintenanceOperation
|
||||
{
|
||||
public function __construct(
|
||||
private readonly ManagedRegistryRetention $retention,
|
||||
private readonly ManagedRegistryOperationScripts $scripts,
|
||||
) {}
|
||||
|
||||
public function execute(Registry $registry): Operation
|
||||
{
|
||||
$server = $registry->controlServer;
|
||||
|
||||
if (! $server instanceof Server) {
|
||||
throw new RuntimeException('A control/build server is required to prune the managed registry.');
|
||||
}
|
||||
|
||||
$activeBuilds = $registry->organisation->applications()
|
||||
->whereHas('environments.buildArtifacts', fn ($query) => $query
|
||||
->where('status', BuildArtifactStatus::BUILDING)
|
||||
->where('registry_ref', 'like', rtrim((string) $registry->url, '/').'/%'))
|
||||
->exists();
|
||||
|
||||
if ($activeBuilds) {
|
||||
throw new RuntimeException('Managed registry pruning cannot run while builds are active.');
|
||||
}
|
||||
|
||||
$this->retention->markPrunable($registry);
|
||||
$artifacts = $this->prunableArtifacts($registry);
|
||||
$maintenance = $this->scripts->maintenance($registry, $artifacts);
|
||||
|
||||
$operation = $server->operations()->create([
|
||||
'kind' => OperationKind::REGISTRY_MAINTENANCE,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'metadata' => [
|
||||
'registry_id' => $registry->id,
|
||||
'artifact_ids' => $artifacts->pluck('id')->values()->all(),
|
||||
],
|
||||
]);
|
||||
|
||||
$operation->steps()->create([
|
||||
'name' => 'Delete prunable manifests and run registry GC',
|
||||
'order' => 1,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'script' => $maintenance['script'],
|
||||
'secrets' => $maintenance['secrets'],
|
||||
]);
|
||||
|
||||
return $operation->refresh();
|
||||
}
|
||||
|
||||
/**
|
||||
* @return \Illuminate\Support\Collection<int, BuildArtifact>
|
||||
*/
|
||||
private function prunableArtifacts(Registry $registry): \Illuminate\Support\Collection
|
||||
{
|
||||
return $registry->organisation->applications()
|
||||
->with(['environments.buildArtifacts' => fn ($query) => $query
|
||||
->where('status', BuildArtifactStatus::PRUNABLE)
|
||||
->where('registry_ref', 'like', rtrim((string) $registry->url, '/').'/%')])
|
||||
->get()
|
||||
->flatMap(fn ($application) => $application->environments)
|
||||
->flatMap(fn ($environment) => $environment->buildArtifacts)
|
||||
->values();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
<?php
|
||||
|
||||
namespace App\Actions\Registries;
|
||||
|
||||
use App\Enums\OperationKind;
|
||||
use App\Enums\OperationStatus;
|
||||
use App\Models\Operation;
|
||||
use App\Models\Registry;
|
||||
use App\Models\Server;
|
||||
use App\Services\Registries\ManagedRegistryOperationScripts;
|
||||
use RuntimeException;
|
||||
|
||||
class CreateManagedRegistryProvisionOperation
|
||||
{
|
||||
public function __construct(
|
||||
private readonly ManagedRegistryOperationScripts $scripts,
|
||||
) {}
|
||||
|
||||
public function execute(Registry $registry): Operation
|
||||
{
|
||||
$server = $registry->controlServer;
|
||||
|
||||
if (! $server instanceof Server) {
|
||||
throw new RuntimeException('A control/build server is required to provision the managed registry.');
|
||||
}
|
||||
|
||||
$provision = $this->scripts->provision($registry);
|
||||
|
||||
$operation = $server->operations()->create([
|
||||
'kind' => OperationKind::REGISTRY_PROVISION,
|
||||
'status' => OperationStatus::PENDING,
|
||||
]);
|
||||
|
||||
$operation->steps()->create([
|
||||
'name' => 'Install managed Docker registry',
|
||||
'order' => 1,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'script' => $provision['script'],
|
||||
'secrets' => $provision['secrets'],
|
||||
]);
|
||||
|
||||
return $operation->refresh();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
<?php
|
||||
|
||||
namespace App\Actions\Registries;
|
||||
|
||||
use App\Enums\OperationKind;
|
||||
use App\Enums\OperationStatus;
|
||||
use App\Models\Operation;
|
||||
use App\Models\Registry;
|
||||
use App\Models\Server;
|
||||
use App\Services\Registries\ManagedRegistryOperationScripts;
|
||||
use RuntimeException;
|
||||
|
||||
class CreateManagedRegistrySmokeCheckOperation
|
||||
{
|
||||
public function __construct(
|
||||
private readonly ManagedRegistryOperationScripts $scripts,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* @param iterable<int, Server> $runtimeServers
|
||||
*/
|
||||
public function execute(Registry $registry, ?Server $buildServer = null, iterable $runtimeServers = []): Operation
|
||||
{
|
||||
$controlServer = $registry->controlServer;
|
||||
|
||||
if (! $controlServer instanceof Server) {
|
||||
throw new RuntimeException('A control/build server is required to check the managed registry.');
|
||||
}
|
||||
|
||||
$buildServer ??= $controlServer;
|
||||
$smokeRef = rtrim((string) $registry->url, '/').'/keystone/smoke/server-'.$buildServer->id.':latest';
|
||||
$checks = [
|
||||
'control_https' => 'pending',
|
||||
'build_push' => 'pending',
|
||||
];
|
||||
|
||||
foreach ($runtimeServers as $server) {
|
||||
$checks['runtime_pull_server_'.$server->id] = 'pending';
|
||||
}
|
||||
|
||||
$registry->forceFill([
|
||||
'readiness_checks' => $checks,
|
||||
'health_status' => 'pending',
|
||||
'ready_at' => null,
|
||||
])->save();
|
||||
|
||||
$operation = $controlServer->operations()->create([
|
||||
'kind' => OperationKind::REGISTRY_HEALTH_CHECK,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'metadata' => [
|
||||
'registry_id' => $registry->id,
|
||||
],
|
||||
]);
|
||||
|
||||
$build = $this->scripts->smokeCheck($registry, $buildServer, 'build', $smokeRef);
|
||||
$operation->steps()->create([
|
||||
'name' => 'Check registry HTTPS and build push',
|
||||
'order' => 1,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'script' => $build['script'],
|
||||
'secrets' => $build['secrets'],
|
||||
]);
|
||||
|
||||
$order = 2;
|
||||
foreach ($runtimeServers as $server) {
|
||||
$runtime = $this->scripts->smokeCheck($registry, $server, 'runtime', $smokeRef);
|
||||
$child = $server->operations()->create([
|
||||
'kind' => OperationKind::REGISTRY_HEALTH_CHECK,
|
||||
'parent_id' => $operation->id,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'metadata' => [
|
||||
'registry_id' => $registry->id,
|
||||
],
|
||||
]);
|
||||
$child->steps()->create([
|
||||
'name' => 'Check runtime registry pull on '.$server->name,
|
||||
'order' => $order++,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'script' => $runtime['script'],
|
||||
'secrets' => $runtime['secrets'],
|
||||
]);
|
||||
}
|
||||
|
||||
return $operation->refresh();
|
||||
}
|
||||
}
|
||||
42
app/Actions/Registries/CreateRegistryAuthOperation.php
Normal file
42
app/Actions/Registries/CreateRegistryAuthOperation.php
Normal file
@@ -0,0 +1,42 @@
|
||||
<?php
|
||||
|
||||
namespace App\Actions\Registries;
|
||||
|
||||
use App\Enums\OperationKind;
|
||||
use App\Enums\OperationStatus;
|
||||
use App\Models\Operation;
|
||||
use App\Models\Registry;
|
||||
use App\Models\Server;
|
||||
use App\Services\Registries\RegistryDockerAuthScript;
|
||||
use InvalidArgumentException;
|
||||
|
||||
class CreateRegistryAuthOperation
|
||||
{
|
||||
public function __construct(
|
||||
private readonly RegistryDockerAuthScript $registryDockerAuthScript,
|
||||
) {}
|
||||
|
||||
public function execute(Registry $registry, Server $server, string $scope): Operation
|
||||
{
|
||||
$auth = match ($scope) {
|
||||
'build' => $this->registryDockerAuthScript->forBuild($registry, 'root'),
|
||||
'runtime' => $this->registryDockerAuthScript->forRuntime($registry, 'root'),
|
||||
default => throw new InvalidArgumentException('Registry auth scope must be build or runtime.'),
|
||||
};
|
||||
|
||||
$operation = $server->operations()->create([
|
||||
'kind' => OperationKind::CREDENTIAL_ROTATION,
|
||||
'status' => OperationStatus::PENDING,
|
||||
]);
|
||||
|
||||
$operation->steps()->create([
|
||||
'name' => 'Configure '.$scope.' registry auth',
|
||||
'order' => 1,
|
||||
'status' => OperationStatus::PENDING,
|
||||
'script' => $auth['script'],
|
||||
'secrets' => $auth['secrets'],
|
||||
]);
|
||||
|
||||
return $operation->refresh();
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user