fix(deploy): make up passes on a stack with no Alertmanager, and the stale-mount guard sees the lab's prefixed containers - #569
Merged
Conversation
…stale-mount guard sees containers the lab names with a prefix Two checks in `make up` assumed the estate's stack. check_alert_channels.py exited 1 on any stack without alertmanager/alertmanager.yaml, so `make up STACK=lab` — and soc, media and sensitive after it — failed on its last step after compose, the reload and the health check had all succeeded; it now notes that the stack declares no alertmanager service and exits 0, and still fails hard for a stack that declares one without a config. The CI and validate.sh invocations pass no stack and are unchanged. check_mounted_config.py matched compose service names against `docker ps` names. stacks/lab sets container_name with a `lab-` prefix on every service, so every lab container was "not running" and the check reported "0 mount(s) match" as OK: the #355 guard had never guarded the lab. It now carries the container name beside the service name — the container for `docker ps` and `docker cp`, the service for `--force-recreate` — and the post-recreate re-check unpacks the same tuple. Found running build-the-jumpbox.md §5 on alexander (#436). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Two deploy-time checks in
make upstop assuming the estate's stack.scripts/check_alert_channels.pynotes and exits 0 when the stack'scompose.yamldeclares noalertmanagerservice. It still fails hard when a stack declares one and has no config. CI andvalidate.shcall it with no stack argument and see no change.scripts/check_mounted_config.pycarries the container name beside the service name.docker psanddocker cpget the container,docker compose up --force-recreategets the service, and the post-recreate re-check unpacks the same tuple.Why
Running
build-the-jumpbox.md§5 onalexandertoday (#436),make up STACK=labbrought the stack up, reloaded it and passed the health check, then exited 1 oncheck_alert_channels.py: noalertmanager.yamlfor the lab, which has none by ADR-0020. The soc, media and sensitive stacks would fail the same way.Two steps earlier,
check_mounted_config.py --fix labprintedSKIP <service> is not runningfor every service while all four were up, then reported0 single-file mount(s) matchas OK. The lab's services are namedlab-prometheusand so on, so the #355 stale-mount guard has never actually checked the lab since the stack landed.Blast radius
The deploy path of every stack. Nothing on the monitoring host changes behaviour: the observability stack has an Alertmanager and names its containers after its services, and both checks were exercised against the live stack here read-only with the same result as before.
secrets/*.sops.yamlVerification
scripts/lint.shpasses;py_compileon both scriptscheck_alert_channels.py --files --live lab,soc,media→ NOTE, exit 0; no argument →alert channels OK — 4 receiver URL(s)as beforecheck_mounted_config.py observabilityagainst the live stack, read-only →4 single-file mount(s) match, as beforemake up STACK=labonalexanderafter merge: the lab's four containers should now be checked rather than skipped, and the target should exit 0Refs #436.
🤖 Generated with Claude Code