stack-orchestrator/stack_orchestrator
Prathamesh Musale 4733631572 feat(k8s): namespace ownership check to prevent silent cross-deployment override
Two deployments whose stack_name derives the same namespace (e.g. two
deployments of the test stack, or any spec without an explicit
`namespace:` override) silently patch each other's Deployment,
ConfigMaps, Services, and PVCs when they share a cluster — last
`deployment start` wins. No error today; operator sees only "Updated
Deployment ... (rolling update)" and can't tell what happened.

Stamp the namespace with a `laconic.com/deployment-dir` annotation on
first creation. On subsequent `deployment start`:

- Annotation missing (legacy / user-created namespace): adopt by
  stamping, so the NEXT conflicting deployment fails loudly.
- Annotation matches this deployment's dir: proceed.
- Annotation points to a different deployment dir: raise
  DeployerException with both dirs and the exact `namespace:` spec
  override to fix it.

Low migration risk: the woodburn pattern (multiple stacks, each with
its own stack_name-derived namespace) continues to work — those
namespaces don't collide by construction. Only same-stack+same-cluster
deployments are affected, which never worked correctly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 13:30:53 +00:00
..
build Apply pre-commit linting fixes 2026-01-21 20:58:31 -05:00
data so-o2o: kubectl-level Caddy cert backup/restore (#746) 2026-04-17 15:36:40 +05:30
deploy feat(k8s): namespace ownership check to prevent silent cross-deployment override 2026-04-20 13:30:53 +00:00
repos Fix pyright type errors across codebase 2026-01-22 01:10:36 -05:00
__init__.py Rename app -> stack_orchestrator (#625) 2023-11-07 00:06:55 -07:00
__main__.py Rename app -> stack_orchestrator (#625) 2023-11-07 00:06:55 -07:00
base.py Fix pyright type errors across codebase 2026-01-22 01:10:36 -05:00
command_types.py Rename app -> stack_orchestrator (#625) 2023-11-07 00:06:55 -07:00
constants.py Merge wd-a7b: cluster-id/namespace naming, jobs, multi-cert, secrets 2026-04-01 18:22:07 +00:00
ids.py fix: black formatting, line length, pyright type narrowing 2026-04-02 05:22:25 +00:00
main.py Apply pre-commit linting fixes 2026-01-21 20:58:31 -05:00
opts.py Fix pyright type errors across codebase 2026-01-22 01:10:36 -05:00
update.py Apply pre-commit linting fixes 2026-01-21 20:58:31 -05:00
util.py Add Job and secrets support for k8s-kind deployments (#995) 2026-03-11 03:56:21 +00:00
version.py Apply pre-commit linting fixes 2026-01-21 20:58:31 -05:00