feat: Add spec.ordinals.start.

.github/workflows/release.yaml

@@ -58,11 +58,14 @@ jobs:
           build-args: VERSION=${{ steps.meta.outputs.version }}
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: '${{ fromJSON(steps.meta.outputs.json).tags[0] }}'
-          format: 'table'
-          exit-code: '1'
-          ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'
+        run: |
+          for i in {1..3}; do
+            if docker run --rm aquasec/trivy:latest image --exit-code 0 --severity CRITICAL,HIGH --ignore-unfixed ${{ fromJSON(steps.meta.outputs.json).tags[0] }}; then
+              break
+            elif [ $i -lt 3 ]; then
+              echo "Retrying in 60 seconds..."
+              sleep 60
+            else
+              exit 1
+            fi
+          done

api/v1/cosmosfullnode_types.go

@@ -32,11 +32,25 @@ const CosmosFullNodeController = "CosmosFullNode"
 // EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
 // NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
 
+// Ordinal specifies the configuration for pod ordinal numbers
+type Ordinals struct {
+	// start is the number representing the first replica's index. It may be used to number replicas from an alternate index (eg: 1-indexed) over the default 0-indexed names,
+	// or to orchestrate progressive movement of replicas from one CosmosFullnode spec to another. If set, replica indices will be in the range:
+	// [.spec.ordinals.start, .spec.ordinals.start + .spec.replicas).
+	// If unset, defaults to 0. Replica indices will be in the range:
+	// [0, .spec.replicas).
+	// +kubebuilder:validation:Minimum:=0
+	Start int32 `json:"start,omitempty"`
+}
+
 // FullNodeSpec defines the desired state of CosmosFullNode
 type FullNodeSpec struct {
 	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 
+	// Ordinal specifies the configuration for pod ordinal numbers
+	Ordinals Ordinals `json:"ordinal,omitempty"`
+
 	// Number of replicas to create.
 	// Individual replicas have a consistent identity.
 	// +kubebuilder:validation:Minimum:=0

config/crd/bases/cosmos.strange.love_cosmosfullnodes.yaml

@@ -555,6 +555,20 @@ spec:
                   Example: cosmos-1
                   Used for debugging.
                 type: object
+              ordinal:
+                description: Ordinal specifies the configuration for pod ordinal numbers
+                properties:
+                  start:
+                    description: |-
+                      start is the number representing the first replica's index. It may be used to number replicas from an alternate index (eg: 1-indexed) over the default 0-indexed names,
+                      or to orchestrate progressive movement of replicas from one CosmosFullnode spec to another. If set, replica indices will be in the range:
+                      [.spec.ordinals.start, .spec.ordinals.start + .spec.replicas).
+                      If unset, defaults to 0. Replica indices will be in the range:
+                      [0, .spec.replicas).
+                    format: int32
+                    minimum: 0
+                    type: integer
+                type: object
               podTemplate:
                 description: |-
                   Template applied to all pods.

internal/fullnode/build_pods.go

@@ -18,7 +18,7 @@ func BuildPods(crd *cosmosv1.CosmosFullNode, cksums ConfigChecksums) ([]diff.Res
 		pods    []diff.Resource[*corev1.Pod]
 	)
 	candidates := podCandidates(crd)
-	for i := int32(0); i < crd.Spec.Replicas; i++ {
+	for i := crd.Spec.Ordinals.Start; i < crd.Spec.Ordinals.Start+crd.Spec.Replicas; i++ {
 		pod, err := builder.WithOrdinal(i).Build()
 		if err != nil {
 			return nil, err

internal/fullnode/build_pods_test.go

@@ -17,7 +17,7 @@ import (
 func TestBuildPods(t *testing.T) {
 	t.Parallel()
 
-	t.Run("happy path", func(t *testing.T) {
+	t.Run("happy path with starting ordinal", func(t *testing.T) {
 		crd := &cosmosv1.CosmosFullNode{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "agoric",
@@ -30,40 +30,44 @@ func TestBuildPods(t *testing.T) {
 					Image: "busybox:latest",
 				},
 				InstanceOverrides: nil,
+				Ordinals: cosmosv1.Ordinals{
+					Start: 2,
+				},
 			},
 		}
 
 		cksums := make(ConfigChecksums)
 		for i := 0; i < int(crd.Spec.Replicas); i++ {
-			cksums[client.ObjectKey{Namespace: crd.Namespace, Name: fmt.Sprintf("agoric-%d", i)}] = strconv.Itoa(i)
+			cksums[client.ObjectKey{Namespace: crd.Namespace, Name: fmt.Sprintf("agoric-%d", i+int(crd.Spec.Ordinals.Start))}] = strconv.Itoa(i + int(crd.Spec.Ordinals.Start))
 		}
 
 		pods, err := BuildPods(crd, cksums)
 		require.NoError(t, err)
 		require.Equal(t, 5, len(pods))
 
 		for i, r := range pods {
-			require.Equal(t, int64(i), r.Ordinal(), i)
+			expectedOrdinal := crd.Spec.Ordinals.Start + int32(i)
+			require.Equal(t, int64(expectedOrdinal), r.Ordinal(), i)
 			require.NotEmpty(t, r.Revision(), i)
-			require.Equal(t, strconv.Itoa(i), r.Object().Annotations["cosmos.strange.love/config-checksum"])
+			require.Equal(t, strconv.Itoa(int(expectedOrdinal)), r.Object().Annotations["cosmos.strange.love/config-checksum"])
 		}
 
-		want := lo.Map([]int{0, 1, 2, 3, 4}, func(_ int, i int) string {
+		want := lo.Map([]int{2, 3, 4, 5, 6}, func(i int, _ int) string {
 			return fmt.Sprintf("agoric-%d", i)
 		})
 		got := lo.Map(pods, func(pod diff.Resource[*corev1.Pod], _ int) string { return pod.Object().Name })
 		require.Equal(t, want, got)
 
-		pod, err := NewPodBuilder(crd).WithOrdinal(0).Build()
+		pod, err := NewPodBuilder(crd).WithOrdinal(crd.Spec.Ordinals.Start).Build()
 		require.NoError(t, err)
 		require.Equal(t, pod.Spec, pods[0].Object().Spec)
 	})
 
-	t.Run("instance overrides", func(t *testing.T) {
+	t.Run("instance overrides with starting ordinal", func(t *testing.T) {
 		const (
 			image         = "agoric:latest"
 			overrideImage = "some_image:custom"
-			overridePod   = "agoric-5"
+			overridePod   = "agoric-7"
 		)
 		crd := &cosmosv1.CosmosFullNode{
 			ObjectMeta: metav1.ObjectMeta{
@@ -75,18 +79,21 @@ func TestBuildPods(t *testing.T) {
 					Image: image,
 				},
 				InstanceOverrides: map[string]cosmosv1.InstanceOverridesSpec{
-					"agoric-2":  {DisableStrategy: ptr(cosmosv1.DisablePod)},
-					"agoric-4":  {DisableStrategy: ptr(cosmosv1.DisableAll)},
+					"agoric-4":  {DisableStrategy: ptr(cosmosv1.DisablePod)},
+					"agoric-6":  {DisableStrategy: ptr(cosmosv1.DisableAll)},
 					overridePod: {Image: overrideImage},
 				},
+				Ordinals: cosmosv1.Ordinals{
+					Start: 2,
+				},
 			},
 		}
 
 		pods, err := BuildPods(crd, nil)
 		require.NoError(t, err)
 		require.Equal(t, 4, len(pods))
 
-		want := lo.Map([]int{0, 1, 3, 5}, func(i int, _ int) string {
+		want := lo.Map([]int{2, 3, 5, 7}, func(i int, _ int) string {
 			return fmt.Sprintf("agoric-%d", i)
 		})
 		got := lo.Map(pods, func(pod diff.Resource[*corev1.Pod], _ int) string { return pod.Object().Name })
@@ -101,18 +108,19 @@ func TestBuildPods(t *testing.T) {
 		}
 	})
 
-	t.Run("scheduled volume snapshot pod candidate", func(t *testing.T) {
+	t.Run("scheduled volume snapshot pod candidate with starting ordinal", func(t *testing.T) {
 		crd := &cosmosv1.CosmosFullNode{
 			ObjectMeta: metav1.ObjectMeta{
 				Name: "agoric",
 			},
 			Spec: cosmosv1.FullNodeSpec{
 				Replicas: 6,
+				Ordinals: cosmosv1.Ordinals{Start: 2},
 			},
 			Status: cosmosv1.FullNodeStatus{
 				ScheduledSnapshotStatus: map[string]cosmosv1.FullNodeSnapshotStatus{
-					"some.scheduled.snapshot.1":       {PodCandidate: "agoric-1"},
-					"some.scheduled.snapshot.2":       {PodCandidate: "agoric-2"},
+					"some.scheduled.snapshot.1":       {PodCandidate: "agoric-3"},
+					"some.scheduled.snapshot.2":       {PodCandidate: "agoric-4"},
 					"some.scheduled.snapshot.ignored": {PodCandidate: "agoric-99"},
 				},
 			},
@@ -122,7 +130,7 @@ func TestBuildPods(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, 4, len(pods))
 
-		want := lo.Map([]int{0, 3, 4, 5}, func(i int, _ int) string {
+		want := lo.Map([]int{2, 5, 6, 7}, func(i int, _ int) string {
 			return fmt.Sprintf("agoric-%d", i)
 		})
 		got := lo.Map(pods, func(pod diff.Resource[*corev1.Pod], _ int) string { return pod.Object().Name })

internal/fullnode/configmap_builder.go

@@ -26,12 +26,13 @@ const (
 func BuildConfigMaps(crd *cosmosv1.CosmosFullNode, peers Peers) ([]diff.Resource[*corev1.ConfigMap], error) {
 	var (
 		buf = bufPool.Get().(*bytes.Buffer)
-		cms = make([]diff.Resource[*corev1.ConfigMap], crd.Spec.Replicas)
+		cms = make([]diff.Resource[*corev1.ConfigMap], 0, crd.Spec.Replicas)
 	)
 	defer bufPool.Put(buf)
 	defer buf.Reset()
+	startOrdinal := crd.Spec.Ordinals.Start
 
-	for i := int32(0); i < crd.Spec.Replicas; i++ {
+	for i := startOrdinal; i < startOrdinal+crd.Spec.Replicas; i++ {
 		data := make(map[string]string)
 		instance := instanceName(crd, i)
 		if err := addConfigToml(buf, data, crd, instance, peers); err != nil {
@@ -75,7 +76,7 @@ func BuildConfigMaps(crd *cosmosv1.CosmosFullNode, peers Peers) ([]diff.Resource
 		)
 		cm.Data = data
 		kube.NormalizeMetadata(&cm.ObjectMeta)
-		cms[i] = diff.Adapt(&cm, i)
+		cms = append(cms, diff.Adapt(&cm, int(i-startOrdinal)))
 	}
 
 	return cms, nil

internal/fullnode/node_key_builder.go

@@ -20,8 +20,10 @@ const nodeKeyFile = "node_key.json"
 // If the secret already has a node key, it is reused.
 // Returns an error if a new node key cannot be serialized. (Should never happen.)
 func BuildNodeKeySecrets(existing []*corev1.Secret, crd *cosmosv1.CosmosFullNode) ([]diff.Resource[*corev1.Secret], error) {
-	secrets := make([]diff.Resource[*corev1.Secret], crd.Spec.Replicas)
-	for i := int32(0); i < crd.Spec.Replicas; i++ {
+	secrets := make([]diff.Resource[*corev1.Secret], 0, crd.Spec.Replicas)
+	startOrdinal := crd.Spec.Ordinals.Start
+
+	for i := startOrdinal; i < startOrdinal+crd.Spec.Replicas; i++ {
 		var s corev1.Secret
 		s.Name = nodeKeySecretName(crd, i)
 		s.Namespace = crd.Namespace
@@ -52,7 +54,7 @@ func BuildNodeKeySecrets(existing []*corev1.Secret, crd *cosmosv1.CosmosFullNode
 			}
 		}
 
-		secrets[i] = diff.Adapt(&secret, i)
+		secrets = append(secrets, diff.Adapt(&secret, int(i-startOrdinal)))
 	}
 	return secrets, nil
 }

internal/fullnode/peer_collector.go

@@ -105,12 +105,14 @@ func NewPeerCollector(client Getter) *PeerCollector {
 // Collect peer information given the crd.
 func (c PeerCollector) Collect(ctx context.Context, crd *cosmosv1.CosmosFullNode) (Peers, kube.ReconcileError) {
 	peers := make(Peers)
+	startOrdinal := crd.Spec.Ordinals.Start
 
 	clusterDomain := "cluster.local"
 	if crd.Spec.Service.ClusterDomain != nil {
 		clusterDomain = *crd.Spec.Service.ClusterDomain
 	}
-	for i := int32(0); i < crd.Spec.Replicas; i++ {
+
+	for i := startOrdinal; i < startOrdinal+crd.Spec.Replicas; i++ {
 		secretName := nodeKeySecretName(crd, i)
 		var secret corev1.Secret
 		// Hoping the caching layer kubebuilder prevents API errors or rate limits. Simplifies logic to use a Get here

internal/fullnode/pvc_builder.go

@@ -40,14 +40,16 @@ func BuildPVCs(
 
 	var pvcs []diff.Resource[*corev1.PersistentVolumeClaim]
 	for i := int32(0); i < crd.Spec.Replicas; i++ {
-		if pvcDisabled(crd, i) {
+		ordinal := i + crd.Spec.Ordinals.Start
+		if pvcDisabled(crd, ordinal) {
 			continue
 		}
 
 		pvc := base.DeepCopy()
-		name := pvcName(crd, i)
+		name := pvcName(crd, ordinal)
 		pvc.Name = name
-		pvc.Labels[kube.InstanceLabel] = instanceName(crd, i)
+		podName := instanceName(crd, ordinal)
+		pvc.Labels[kube.InstanceLabel] = podName
 
 		var dataSource *corev1.TypedLocalObjectReference
 		var existingSize resource.Quantity
@@ -65,15 +67,15 @@ func BuildPVCs(
 		}
 
 		tpl := crd.Spec.VolumeClaimTemplate
-		if override, ok := crd.Spec.InstanceOverrides[instanceName(crd, i)]; ok {
+		if override, ok := crd.Spec.InstanceOverrides[podName]; ok {
 			if overrideTpl := override.VolumeClaimTemplate; overrideTpl != nil {
 				tpl = *overrideTpl
 			}
 		}
 
 		pvc.Spec = corev1.PersistentVolumeClaimSpec{
 			AccessModes:      sliceOrDefault(tpl.AccessModes, defaultAccessModes),
-			Resources:        pvcResources(crd, name, dataSources[i], existingSize),
+			Resources:        pvcResources(crd, name, dataSources[i], existingSize, tpl.Resources),
 			StorageClassName: ptr(tpl.StorageClassName),
 			VolumeMode:       valOrDefault(tpl.VolumeMode, ptr(corev1.PersistentVolumeFilesystem)),
 		}
@@ -88,24 +90,14 @@ func BuildPVCs(
 	return pvcs
 }
 
-func pvcDisabled(crd *cosmosv1.CosmosFullNode, ordinal int32) bool {
-	name := instanceName(crd, ordinal)
-	disable := crd.Spec.InstanceOverrides[name].DisableStrategy
-	return disable != nil && *disable == cosmosv1.DisableAll
-}
-
-func pvcName(crd *cosmosv1.CosmosFullNode, ordinal int32) string {
-	name := fmt.Sprintf("pvc-%s-%d", appName(crd), ordinal)
-	return kube.ToName(name)
-}
-
 func pvcResources(
 	crd *cosmosv1.CosmosFullNode,
 	name string,
 	dataSource *dataSource,
 	existingSize resource.Quantity,
+	tplResources corev1.ResourceRequirements,
 ) corev1.ResourceRequirements {
-	var reqs = crd.Spec.VolumeClaimTemplate.Resources.DeepCopy()
+	reqs := tplResources.DeepCopy()
 
 	if dataSource != nil {
 		reqs.Requests[corev1.ResourceStorage] = dataSource.size
@@ -129,3 +121,13 @@ func pvcResources(
 
 	return *reqs
 }
+func pvcDisabled(crd *cosmosv1.CosmosFullNode, ordinal int32) bool {
+	name := instanceName(crd, ordinal)
+	disable := crd.Spec.InstanceOverrides[name].DisableStrategy
+	return disable != nil && *disable == cosmosv1.DisableAll
+}
+
+func pvcName(crd *cosmosv1.CosmosFullNode, ordinal int32) string {
+	name := fmt.Sprintf("pvc-%s-%d", appName(crd), ordinal)
+	return kube.ToName(name)
+}

internal/fullnode/pvc_control.go

@@ -52,7 +52,8 @@ func (control PVCControl) Reconcile(ctx context.Context, reporter kube.Reporter,
 	dataSources := make(map[int32]*dataSource)
 	if len(currentPVCs) < int(crd.Spec.Replicas) {
 		for i := int32(0); i < crd.Spec.Replicas; i++ {
-			name := pvcName(crd, i)
+			ordinal := i + crd.Spec.Ordinals.Start
+			name := pvcName(crd, ordinal)
 			found := false
 			for _, pvc := range currentPVCs {
 				if pvc.Name == name {
@@ -61,7 +62,7 @@ func (control PVCControl) Reconcile(ctx context.Context, reporter kube.Reporter,
 				}
 			}
 			if !found {
-				ds := control.findDataSource(ctx, reporter, crd, i)
+				ds := control.findDataSource(ctx, reporter, crd, ordinal)
 				if ds == nil {
 					ds = &dataSource{
 						size: crd.Spec.VolumeClaimTemplate.Resources.Requests[corev1.ResourceStorage],
@@ -160,7 +161,8 @@ type dataSource struct {
 }
 
 func (control PVCControl) findDataSource(ctx context.Context, reporter kube.Reporter, crd *cosmosv1.CosmosFullNode, ordinal int32) *dataSource {
-	if override, ok := crd.Spec.InstanceOverrides[instanceName(crd, ordinal)]; ok {
+	podName := instanceName(crd, ordinal)
+	if override, ok := crd.Spec.InstanceOverrides[podName]; ok {
 		if overrideTpl := override.VolumeClaimTemplate; overrideTpl != nil {
 			return control.findDataSourceWithPvcSpec(ctx, reporter, crd, *overrideTpl, ordinal)
 		}