Coverage for scripts / live_release_validation / actions / platform_workloads.py: 100.00%

1"""platform-workloads: the gco-system services are hosted as the manifests promise.""" 

2 

3from __future__ import annotations 

4 

5from typing import Any 

6 

7from ..checks.cluster import cluster_kubectl 

8from ..checks.internal_pki import verify_internal_pki 

9from ..checks.platform_workloads import ( 

10 expected_deployments, 

11 manifest_processor_autoscaling_enabled, 

12 network_policy_enforcement_enabled, 

13 verify_platform_workloads, 

14) 

15from ..models import RunContext 

16 

17 

18def action_platform_workloads(ctx: RunContext) -> dict[str, Any]: 

19 """Require every Region's platform services to be converged, restart-free, drain-safe, autoscaled as configured, and served under the internal CA. 

20 

21 For every deployed Region, open the tunnelled kubectl session and poll a 

22 bounded snapshot of the ``gco-system`` Deployments (health-monitor, 

23 manifest-processor, inference-monitor, inference-proxy, plus cost-monitor 

24 when cost monitoring is configured). Each must be converged at its current 

25 generation with every live container at zero restarts; each multi-replica 

26 service's PodDisruptionBudget must be ``maxUnavailable: 1`` and currently 

27 allow a disruption; the inference-proxy HPA must exist, target its 

28 Deployment, and be able to scale, and the manifest-processor HPA must exist 

29 exactly when ``manifest_processor.autoscaling.enabled`` is set; and the 

30 ``kube-system/amazon-vpc-cni`` switch must carry the value rendered from 

31 ``eks_cluster.network_policy_enforcement``. 

32 

33 In the same session the internal PKI must be sound: the ``gco-internal-ca`` 

34 ClusterIssuer and its CA Certificate ``Ready``, every GCO leaf Certificate 

35 the configuration deploys ``Ready`` and issued by that ClusterIssuer, and 

36 the retired ``gco-api-selfsigned`` Issuer gone. 

37 

38 Running late in the registry is deliberate: by then the Job, queue, 

39 scheduler, inference, and cost actions have exercised every service, so a 

40 zero restart count is evidence the services held up under real traffic, 

41 not just that they started. 

42 """ 

43 regions: dict[str, Any] = {} 

44 internal_tls: dict[str, Any] = {} 

45 for region in ctx.deployment_regions: 

46 with cluster_kubectl(ctx, region) as kubectl: 

47 regions[region] = verify_platform_workloads(ctx, region, kubectl) 

48 internal_tls[region] = verify_internal_pki(ctx, region, kubectl) 

49 return { 

50 "deployments": list(expected_deployments(ctx)), 

51 "manifest_processor_autoscaling": manifest_processor_autoscaling_enabled(ctx), 

52 "network_policy_enforcement": network_policy_enforcement_enabled(ctx), 

53 "regions": regions, 

54 "internal_tls": internal_tls, 

55 }