fix(deploy): a restricted render probes natively; refuse what a native probe cannot express (#91)

A cell's execution admission refuses any container with an exec probe, and
model is down on it. Restricted renders (what a cell runs) now render the
kubelet's own handlers: a transport predicate is a tcpSocket probe, an HTTP
predicate an httpGet on the same path (HTTPS when the endpoint is secured),
with the authored timing kept. A predicate those handlers cannot express — a
response-body check, or a status outside the kubelet's 200–399 — is refused
at render, never weakened. The local apply keeps probe.py's exec probe.

Co-authored-by: Antoine Toussaint <toussaint.antoine@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: 3 people

builder.go

@@ -452,7 +452,9 @@ func (s *Builder) Deploy(ctx context.Context, req *builderv0.DeploymentRequest)
 	if plan.Startup == nil || plan.Liveness == nil {
 		return nil, fmt.Errorf("the Kubernetes manifest profile requires explicit endpoint health.startup and health.liveness; readiness is not a restart policy")
 	}
-	probes, err := deploymentProbes(s.FastAPI.RestEndpoint)
+	// A restricted render is what a cell runs, and a cell's execution
+	// admission refuses an exec probe: probe natively there.
+	probes, err := deploymentProbesFor(s.FastAPI.RestEndpoint, req.GetDeployment().GetKubernetes().GetProfile())
 	if err != nil {
 		return nil, err
 	}

probes.go

@@ -7,7 +7,9 @@ import (
 	"strings"
 	"time"
 
+	"github.com/codefly-dev/core/agents/services"
 	basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0"
+	builderv0 "github.com/codefly-dev/core/generated/go/codefly/services/builder/v0"
 	"github.com/codefly-dev/core/resources"
 	"gopkg.in/yaml.v3"
 )
@@ -30,7 +32,16 @@ type localProbe struct {
 // deploymentProbes preserves the producing endpoint's three separate intents.
 // Kubernetes has only one probe per intent; predicates for additional listeners
 // need an explicit combined implementation rather than being silently ignored.
-func deploymentProbes(endpoint *basev0.Endpoint) (string, error) {
+//
+// native selects Kubernetes' own probes (tcpSocket, httpGet) instead of the
+// container-local exec probe. A restricted render is what a cell runs, and a
+// cell's execution admission refuses any container with an exec probe: it runs
+// a command of the delivering party's choosing inside a pod that already holds
+// the workload identity. A native probe expresses less than probe.py (no body
+// predicate, no redirect refusal, no certificate pinning, and the kubelet takes
+// any 200–399 status as success), so a predicate it cannot express is refused
+// at render rather than weakened.
+func deploymentProbes(endpoint *basev0.Endpoint, native bool) (string, error) {
 	if endpoint == nil {
 		return "", fmt.Errorf("HTTP endpoint is required for deployment probes")
 	}
@@ -48,7 +59,7 @@ func deploymentProbes(endpoint *basev0.Endpoint) (string, error) {
 		if intent.probe == nil {
 			continue
 		}
-		value, err := kubernetesProbe(endpoint, intent.probe, intent.name)
+		value, err := kubernetesProbe(endpoint, intent.probe, intent.name, native)
 		if err != nil {
 			return "", fmt.Errorf("%s: %w", intent.name, err)
 		}
@@ -61,7 +72,7 @@ func deploymentProbes(endpoint *basev0.Endpoint) (string, error) {
 	return "          " + strings.ReplaceAll(strings.TrimSuffix(string(raw), "\n"), "\n", "\n          "), nil
 }
 
-func kubernetesProbe(endpoint *basev0.Endpoint, probe *basev0.Probe, intent string) (map[string]any, error) {
+func kubernetesProbe(endpoint *basev0.Endpoint, probe *basev0.Probe, intent string, native bool) (map[string]any, error) {
 	config := localProbe{Port: 8080, Secured: resources.EndpointSecured(endpoint), Timeout: 1}
 	switch predicate := probe.GetPredicate().(type) {
 	case *basev0.Probe_Transport:
@@ -111,10 +122,68 @@ func kubernetesProbe(endpoint *basev0.Endpoint, probe *basev0.Probe, intent stri
 		}
 		result["successThreshold"] = n
 	}
+	if native {
+		handler, err := nativeProbe(config)
+		if err != nil {
+			return nil, err
+		}
+		for key, value := range handler {
+			result[key] = value
+		}
+		return result, nil
+	}
 	raw, err := json.Marshal(config)
 	if err != nil {
 		return nil, err
 	}
 	result["exec"] = map[string]any{"command": []string{"python", "-I", "-c", probeScript, string(raw)}}
 	return result, nil
 }
+
+// deploymentProbesFor renders the endpoint's probes for the requested output
+// profile: native for a restricted render (what a cell runs), the
+// container-local exec probe otherwise.
+func deploymentProbesFor(endpoint *basev0.Endpoint, profile builderv0.KubernetesOutputProfile) (string, error) {
+	return deploymentProbes(endpoint, restrictedOutput(profile))
+}
+
+// restrictedOutput reports whether the deployment selects the restricted,
+// portable output contract a cell runs. An unparseable profile is treated as
+// restricted, the stricter of the two.
+func restrictedOutput(profile builderv0.KubernetesOutputProfile) bool {
+	parsed, err := services.ParseOutputProfile(profile)
+	if err != nil {
+		return true
+	}
+	return parsed.Restricted()
+}
+
+// kubeletSuccess is the status range a kubelet httpGet probe takes as success.
+var kubeletSuccess = [2]uint32{200, 399}
+
+// nativeProbe expresses a predicate with the kubelet's own handler, or refuses
+// it. A transport predicate is a TCP connect. An HTTP predicate is an httpGet on
+// the same path, over HTTPS when the endpoint is secured; it is refused when it
+// checks the response body, or accepts a status the kubelet would not, because
+// the kubelet cannot check either.
+func nativeProbe(config localProbe) (map[string]any, error) {
+	switch config.Kind {
+	case "transport":
+		return map[string]any{"tcpSocket": map[string]any{"port": config.Port}}, nil
+	case "http":
+		if config.Body != "" {
+			return nil, fmt.Errorf("a cell refuses an exec probe, and a native HTTP probe cannot check that the response body contains %q; drop the body predicate or probe a path whose status alone answers", config.Body)
+		}
+		for _, status := range config.Statuses {
+			if status[0] < kubeletSuccess[0] || status[1] > kubeletSuccess[1] {
+				return nil, fmt.Errorf("a cell refuses an exec probe, and a native HTTP probe takes only %d–%d as success, so it cannot accept %d–%d", kubeletSuccess[0], kubeletSuccess[1], status[0], status[1])
+			}
+		}
+		get := map[string]any{"path": config.Path, "port": config.Port}
+		if config.Secured {
+			get["scheme"] = "HTTPS"
+		}
+		return map[string]any{"httpGet": get}, nil
+	}
+	return nil, fmt.Errorf("predicate kind %q has no native probe", config.Kind)
+}

probes_test.go

@@ -30,7 +30,7 @@ func healthEndpoint(t *testing.T, secured bool, health *resources.Health) *basev
 
 func renderedProbe(t *testing.T, endpoint *basev0.Endpoint) map[string]any {
 	t.Helper()
-	probes, err := deploymentProbes(endpoint)
+	probes, err := deploymentProbes(endpoint, false)
 	require.NoError(t, err)
 	var result map[string]any
 	require.NoError(t, yaml.Unmarshal([]byte(probes), &result))
@@ -76,10 +76,10 @@ func TestDeploymentRefusesUnrepresentableTimingAndPredicates(t *testing.T) {
 		{Kind: "http", Path: "/readyz", Period: "1500ms"},
 		{Kind: "agent"},
 	} {
-		_, err := deploymentProbes(healthEndpoint(t, false, &resources.Health{Readiness: probe}))
+		_, err := deploymentProbes(healthEndpoint(t, false, &resources.Health{Readiness: probe}), false)
 		require.Error(t, err)
 	}
-	_, err := deploymentProbes(healthEndpoint(t, false, &resources.Health{Liveness: &resources.Probe{Kind: "transport", SuccessThreshold: 2}}))
+	_, err := deploymentProbes(healthEndpoint(t, false, &resources.Health{Liveness: &resources.Probe{Kind: "transport", SuccessThreshold: 2}}), false)
 	require.Error(t, err)
 }
 
@@ -161,7 +161,7 @@ func deploymentTestParameters(t *testing.T, parameters Parameters) Parameters {
 		Liveness:  &resources.Probe{Kind: "transport"},
 	}
 	var err error
-	parameters.Probes, err = deploymentProbes(healthEndpoint(t, false, health))
+	parameters.Probes, err = deploymentProbes(healthEndpoint(t, false, health), false)
 	require.NoError(t, err)
 	return parameters
 }
@@ -186,8 +186,66 @@ func TestBuilderLoadsAuthoredTLSAndHealthBeforeProjection(t *testing.T) {
 	endpoint := loaded.FastAPI.RestEndpoint
 	require.True(t, resources.EndpointSecured(endpoint))
 	require.Equal(t, "/readyz", endpoint.GetHealth().GetReadiness().GetHttp().GetPath())
-	probes, err := deploymentProbes(endpoint)
+	probes, err := deploymentProbes(endpoint, false)
 	require.NoError(t, err)
 	require.Contains(t, probes, "/readyz")
 	require.NotContains(t, probes, "/version")
 }
+
+// A restricted render is what a cell runs, and a cell's execution admission
+// refuses any container with an exec probe. There the intents become the
+// kubelet's own handlers, with the authored timing kept; a predicate those
+// handlers cannot express is refused at render, never weakened.
+func TestRestrictedRenderProbesNativelyAndRefusesWhatItCannotExpress(t *testing.T) {
+	native := func(t *testing.T, secured bool, health *resources.Health) map[string]any {
+		t.Helper()
+		probes, err := deploymentProbes(healthEndpoint(t, secured, health), true)
+		require.NoError(t, err)
+		var result map[string]any
+		require.NoError(t, yaml.Unmarshal([]byte(probes), &result))
+		return result
+	}
+	rendered := native(t, false, &resources.Health{
+		Startup:   &resources.Probe{Kind: "http", Path: "/healthz", Statuses: []string{"200"}, Period: "5s", Timeout: "3s", FailureThreshold: 12},
+		Readiness: &resources.Probe{Kind: "http", Path: "/readyz", Statuses: []string{"200"}, Period: "5s", Timeout: "3s", FailureThreshold: 3},
+		Liveness:  &resources.Probe{Kind: "transport", Period: "10s", Timeout: "3s", FailureThreshold: 3},
+	})
+	for intent, want := range map[string]map[string]any{
+		"startupProbe":   {"httpGet": map[string]any{"path": "/healthz", "port": 8080}},
+		"readinessProbe": {"httpGet": map[string]any{"path": "/readyz", "port": 8080}},
+		"livenessProbe":  {"tcpSocket": map[string]any{"port": 8080}},
+	} {
+		probe := rendered[intent].(map[string]any)
+		require.NotContainsf(t, probe, "exec", "%s execs", intent)
+		for handler, spec := range want {
+			require.Equalf(t, spec, probe[handler], "%s %s", intent, handler)
+		}
+		require.EqualValues(t, 3, probe["timeoutSeconds"], "%s keeps its authored timing", intent)
+	}
+
+	secured := native(t, true, &resources.Health{Readiness: &resources.Probe{Kind: "http", Path: "/readyz", Statuses: []string{"200"}}})
+	require.Equal(t, "HTTPS", secured["readinessProbe"].(map[string]any)["httpGet"].(map[string]any)["scheme"])
+
+	for name, probe := range map[string]*resources.Probe{
+		"a body predicate":             {Kind: "http", Path: "/readyz", Statuses: []string{"200"}, BodyContains: "ready"},
+		"a status the kubelet refuses": {Kind: "http", Path: "/readyz", Statuses: []string{"404"}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := deploymentProbes(healthEndpoint(t, false, &resources.Health{Readiness: probe}), true)
+			require.ErrorContains(t, err, "a cell refuses an exec probe")
+		})
+	}
+}
+
+// The profile picks the probe: the restricted render a cell runs probes
+// natively; the ephemeral local apply keeps the container-local exec probe.
+func TestTheOutputProfileSelectsTheProbe(t *testing.T) {
+	endpoint := healthEndpoint(t, false, &resources.Health{Readiness: &resources.Probe{Kind: "http", Path: "/readyz", Statuses: []string{"200"}}})
+	restricted, err := deploymentProbesFor(endpoint, builderv0.KubernetesOutputProfile_KUBERNETES_OUTPUT_PROFILE_RESTRICTED_PORTABLE_V1)
+	require.NoError(t, err)
+	require.NotContains(t, restricted, "exec:")
+	require.Contains(t, restricted, "httpGet:")
+	local, err := deploymentProbesFor(endpoint, builderv0.KubernetesOutputProfile_KUBERNETES_OUTPUT_PROFILE_EPHEMERAL_LOCAL_APPLY_V1)
+	require.NoError(t, err)
+	require.Contains(t, local, "exec:")
+}