Repository navigation
Render a Move: its step Jobs, its move identity and policy for both Instances #335
Description
Parent
What
Render a Move (chapter 55):
- one Job per step (start, sync, lag, fence, final lag, flip, unfence, reverse), named by the revision's tag and the step, created suspended and applied once;
- the move identity
<process>-move: ServiceAccount, Vault role and policy, the method's credential atsecret/data/<project>/<process>/move, and one Kubernetes permission, update on the Stable Addresses that name the source; - the allow-set rules for every Instance while the Move is open, and between the Instances on the method's surface (chapter 16);
- retirement drops the source, its reverse step and the move identity from the render, and the source claim stays bound under its prune-disabled mark;
- the Postgres move example's rendered tree, hand-written and reviewed.
Lands in TypeScript only, after emf/ is deleted (#347), with the rendered-tree and diagnostics oracles it affects, in one pull request. The intent, effective and dependencies goldens are dropped (#346), so it adds none.
Behaviour (draft ledger row)
A Process with an open Move renders its step Jobs suspended, a move identity that can update only the Stable Addresses naming its source, and policy admitting every consumer to both Instances, and the example's share equals its committed tree byte for byte.
Blocked by
#341, the map whose rewrite plan replaces the closed placement ticket #328 (see #350).
Activity
ExtraToast commentedon Oct 27, 2026
Resume here (updated 2026-10-27)
State: merged as
f00fc54e(PR #649).Next step: none.
Blocked by: nothing.
Decisions (taken with the maintainer):
<process>-<tag>, and its claims are<claim>-<suffix>. ClusterState recordsnameandtarget.name.kustomize.toolkit.fluxcd.io/ssa: IfNotPresent.app.kubernetes.io/instance: <process>, and its workload and Service select{name: <instance>, instance: <process>}.<process>-move. A Role and RoleBinding inestate-system, named<ns>-<process>-move, may update only the flipped Services (resourceNames).<identity>-<step>-<tag>: start, sync, lag, fence, final-lag, flip, unfence, and reverse when the Move is reversible.Gotchas:
claimed()insrc/adapters/kubernetes/move.tshandles it, and a spelling test covers it.test/adapters/spelling.test.ts(two new describe blocks at the same spot) and generated files.