argopromote

Overview ¶

Package argopromote implements the argo.promote builtin function: advance an Argo Rollout past one canary pause point, idempotently. Runs in-process inside kas; callers construct it with a K8sRoundTripperFactory. In production that factory routes to the tenant cluster's apiserver through agentk; argo.promote turns its http.RoundTripper into a dynamic Kubernetes client internally.

The deploy driver gates every canary traffic increment with an indefinite pause: {} step, so the Argo controller never self-advances — the flow clears each gate by calling argo.promote once per pause point. AutoFlow delivers at-least-once, so the call must be safe to replay.

The client sends a single conditional JSON Patch whose `test` ops assert the Rollout is parked at exactly this gate before clearing the pause. Any other state (already promoted, not yet at the gate, or re-paused at a different gate) fails a `test` and the apiserver applies nothing — no read-then-write race, no clobbering a pause the operator never approved.

That rejection is a 422, and a 422 is ambiguous on the wire: a rejected mutation (CRD structural-schema validation) carries the same reason `Invalid`, and the apiserver discards the json-patch error text entirely, so nothing in the response says which op failed. argo.promote resolves the ambiguity from the Rollout instead — it re-reads the object and compares the same two fields the `test` ops assert. A Rollout observably past this gate makes the call an idempotent replay: empty resource_version, no error. A Rollout short of the gate, sitting at it un-paused, or still satisfying the preconditions is a real failure and surfaces as one. The read runs only on a 422; promoting is still a single round trip.