deploy.py

#!/usr/bin/env python3
"""deploy.py — Deploy NetCortex MCP services to local Kubernetes.

Prerequisites:
  - minikube or k3s or Docker Desktop K8s running
  - kubectl configured
  - docker available

Usage:
  python deploy.py                # Full deploy (build + apply)
  python deploy.py --no-build     # Apply manifests only (images already built)
  python deploy.py --teardown     # Remove all NetCortex resources
  python deploy.py --status       # Show pod/service status
"""

from __future__ import annotations

import argparse
import hashlib
import json
import shutil
import subprocess
import sys
import tempfile
import time
from pathlib import Path

import yaml

# Keep in sync with the `image:` tags in k8s/rca-deployment.yaml and
# k8s/telemetry-deployment.yaml. A mutable `:latest` tag combined with
# imagePullPolicy: IfNotPresent meant a rebuild silently kept running
# whatever was already cached on the node instead of picking up the new
# image, so both this script and the manifests now pin an explicit version.
IMAGE_TAG = "2.0.0"


def run(cmd: str, check: bool = True, capture: bool = False) -> subprocess.CompletedProcess:
    """Run a shell command and print it."""
    print(f"  $ {cmd}")
    result = subprocess.run(
        cmd, shell=True, capture_output=capture, text=True,
    )
    if check and result.returncode != 0:
        if capture:
            print(f"  STDERR: {result.stderr.strip()}")
        sys.exit(1)
    return result


def check_prereqs() -> None:
    """Verify kubectl and docker are available."""
    result = subprocess.run("kubectl version --client", shell=True, capture_output=True)
    if result.returncode != 0:
        print("ERROR: 'kubectl' not found or not working. Install it first.")
        sys.exit(1)
    # Plain `docker version` (no --client) works for both real Docker and
    # podman's docker-CLI-compat shim, which rejects the --client flag.
    result = subprocess.run("docker version", shell=True, capture_output=True)
    if result.returncode != 0:
        print("ERROR: 'docker' not found or not working. Install it first.")
        sys.exit(1)
    print("[OK] kubectl and docker available.")


def detect_cluster() -> str:
    """Detect which K8s environment is active and return external IP."""
    # Check minikube
    result = subprocess.run("minikube status --format={{.Host}}", shell=True, capture_output=True, text=True)
    if result.returncode == 0 and "Running" in result.stdout:
        print("[Info] Minikube detected.")
        # Point docker to minikube's daemon
        eval_cmd = subprocess.run("minikube docker-env --shell bash", shell=True, capture_output=True, text=True)
        if eval_cmd.returncode == 0:
            for line in eval_cmd.stdout.splitlines():
                if line.startswith("export "):
                    parts = line.replace("export ", "").split("=", 1)
                    if len(parts) == 2:
                        import os
                        os.environ[parts[0]] = parts[1].strip('"')
        ip_result = subprocess.run("minikube ip", shell=True, capture_output=True, text=True)
        return ip_result.stdout.strip() if ip_result.returncode == 0 else "localhost"

    # Fallback: Docker Desktop or k3s
    print("[Info] Using local Docker daemon (Docker Desktop / k3s assumed).")
    return "localhost"


def build_images() -> None:
    """Build Docker images for both services."""
    print("\n[1/5] Building Docker images...")
    run(f"docker build -t netcortex-telemetry:{IMAGE_TAG} -f Dockerfile.telemetry .")
    run(f"docker build -t netcortex-rca:{IMAGE_TAG} -f Dockerfile.rca .")

    # k3s uses containerd image store, which is separate from Docker/Podman.
    # Import freshly built images so kubelet can use them with imagePullPolicy=IfNotPresent.
    if shutil.which("k3s"):
        print("[Info] k3s detected. Importing local images into k3s containerd...")
        run(f"docker save netcortex-telemetry:{IMAGE_TAG} | sudo k3s ctr images import -")
        run(f"docker save netcortex-rca:{IMAGE_TAG} | sudo k3s ctr images import -")
        # Podman-backed docker builds are often imported as localhost/*.
        # Tag to docker.io/library/* so kubelet resolves image refs from manifests.
        run(f"sudo k3s ctr images tag localhost/netcortex-telemetry:{IMAGE_TAG} docker.io/library/netcortex-telemetry:{IMAGE_TAG}", check=False)
        run(f"sudo k3s ctr images tag localhost/netcortex-rca:{IMAGE_TAG} docker.io/library/netcortex-rca:{IMAGE_TAG}", check=False)
        print("[OK] Images imported into k3s containerd.")

    print("[OK] Images built successfully.")


def read_env_file(path: str = "config/.env") -> dict[str, str]:
    """Parse KEY=VALUE lines from config/.env without touching os.environ."""
    env_path = Path(path)
    if not env_path.exists():
        return {}
    values: dict[str, str] = {}
    for line in env_path.read_text(encoding="utf-8").splitlines():
        stripped = line.strip()
        if not stripped or stripped.startswith("#") or "=" not in stripped:
            continue
        key, value = stripped.split("=", 1)
        values[key.strip()] = value.strip()
    return values


def provision_secret() -> None:
    """Create/update the netcortex-secrets Secret from config/.env's GEMINI_API_KEY.

    Done imperatively (kubectl create ... --dry-run=client -o yaml | kubectl apply -f -)
    instead of committing a populated k8s/secrets.yaml, so the real key never lands in
    git. Falls back to the empty tracked template if no key is available locally.
    """
    gemini_api_key = read_env_file().get("GEMINI_API_KEY", "")
    if not gemini_api_key:
        print("  [Warn] No GEMINI_API_KEY in config/.env — applying empty secret template.")
        print("         RCA synthesizer will run in deterministic-fallback mode only.")
        run("kubectl apply -f k8s/secrets.yaml")
        return
    run(
        "kubectl create secret generic netcortex-secrets -n netcortex "
        f"--from-literal=gemini-api-key={gemini_api_key} "
        "--dry-run=client -o yaml | kubectl apply -f -"
    )
    print("  [OK] netcortex-secrets provisioned from config/.env.")


CATALOG_CONFIGMAP = Path("k8s/catalog-configmap.yaml")
DEFAULT_CATALOG = Path("contract/catalog")
CATALOG_HASH_PLACEHOLDER = "__CATALOG_HASH__"
# Deployments that mount the catalog and carry the catalog-hash annotation.
CATALOG_DEPLOYMENTS = ("k8s/telemetry-deployment.yaml", "k8s/rca-deployment.yaml")


def catalog_override_files(configmap: Path = CATALOG_CONFIGMAP) -> dict[str, str]:
    data = yaml.safe_load(configmap.read_text(encoding="utf-8")).get("data") or {}
    return {str(k): str(v) for k, v in data.items()}


def catalog_hash(configmap: Path = CATALOG_CONFIGMAP, default_dir: Path = DEFAULT_CATALOG) -> str:
    """sha256 over the shipped default catalog and the override ConfigMap data.

    Stamped into each pod template (netcortex.dev/catalog-hash), so editing
    either one changes the template and Kubernetes rolls the pods; a mounted
    ConfigMap update alone would never restart them.
    """
    digest = hashlib.sha256()
    for path in sorted(default_dir.glob("*.json")):
        digest.update(path.name.encode() + b"\0" + path.read_bytes() + b"\0")
    digest.update(json.dumps(catalog_override_files(configmap), sort_keys=True).encode())
    return digest.hexdigest()


def validate_catalog_override(configmap: Path = CATALOG_CONFIGMAP) -> None:
    """Refuse to deploy an override the pods would refuse to start with."""
    from contract.catalog_loader import CatalogError, load_catalog

    with tempfile.TemporaryDirectory() as tmp:
        for name, content in catalog_override_files(configmap).items():
            (Path(tmp) / name).write_text(content, encoding="utf-8")
        try:
            load_catalog(tmp)
        except CatalogError as exc:
            print(f"ERROR: {configmap} holds an invalid catalog override: {exc}")
            sys.exit(1)


def render_with_catalog_hash(manifest: str, digest: str) -> str:
    return Path(manifest).read_text(encoding="utf-8").replace(CATALOG_HASH_PLACEHOLDER, digest)


def apply_rendered(manifest: str, content: str) -> None:
    print(f"  $ kubectl apply -f {manifest}  (catalog-hash rendered)")
    result = subprocess.run(["kubectl", "apply", "-f", "-"], input=content, text=True)
    if result.returncode != 0:
        sys.exit(1)


def apply_manifests() -> None:
    """Apply all K8s manifests in order."""
    print("\n[2/5] Applying Kubernetes manifests...")
    validate_catalog_override()
    digest = catalog_hash()
    print(f"  Detection catalog hash: {digest[:16]}…")
    run("kubectl apply -f k8s/namespace.yaml")
    provision_secret()
    for m in [
        "k8s/configmap.yaml",
        str(CATALOG_CONFIGMAP),
        "k8s/telemetry-deployment.yaml",
        "k8s/telemetry-service.yaml",
        "k8s/rca-deployment.yaml",
        "k8s/rca-service.yaml",
    ]:
        if m in CATALOG_DEPLOYMENTS:
            apply_rendered(m, render_with_catalog_hash(m, digest))
        else:
            run(f"kubectl apply -f {m}")
    print("[OK] Manifests applied.")


def wait_for_pods() -> None:
    """Wait for pods to become ready."""
    print("\n[3/5] Waiting for telemetry pod...")
    result = run(
        "kubectl -n netcortex wait --for=condition=ready pod -l app=netcortex-telemetry --timeout=60s",
        check=False,
    )
    if result.returncode != 0:
        print("  WARNING: Telemetry pod not ready within 60s")
        run("kubectl -n netcortex get pods -l app=netcortex-telemetry", check=False)
    else:
        print("  Telemetry pod ready.")

    print("\n[4/5] Waiting for RCA pod...")
    result = run(
        "kubectl -n netcortex wait --for=condition=ready pod -l app=netcortex-rca --timeout=120s",
        check=False,
    )
    if result.returncode != 0:
        print("  WARNING: RCA pod not ready within 120s")
        run("kubectl -n netcortex get pods -l app=netcortex-rca", check=False)
    else:
        print("  RCA pod ready.")


def show_status() -> None:
    """Print deployment status."""
    print("\n[5/5] Deployment status:")
    run("kubectl -n netcortex get pods", check=False)
    run("kubectl -n netcortex get services", check=False)


def teardown() -> None:
    """Remove all NetCortex K8s resources."""
    print("[Teardown] Removing NetCortex resources...")
    run("kubectl delete namespace netcortex --ignore-not-found", check=False)
    print("[Done] All NetCortex resources removed.")


def main() -> None:
    parser = argparse.ArgumentParser(description="Deploy NetCortex MCP to local K8s")
    parser.add_argument("--no-build", action="store_true", help="Skip image build")
    parser.add_argument("--teardown", action="store_true", help="Remove all resources")
    parser.add_argument("--status", action="store_true", help="Show status only")
    args = parser.parse_args()

    print("=" * 50)
    print(" NetCortex MCP v2.0 — K8s Deployment")
    print("=" * 50)

    if args.teardown:
        teardown()
        return

    if args.status:
        show_status()
        return

    check_prereqs()
    detect_cluster()  # side effect: points docker at minikube's daemon when applicable

    if not args.no_build:
        build_images()
    else:
        print("\n[1/5] Skipping build (--no-build).")

    apply_manifests()
    wait_for_pods()
    show_status()

    print()
    print("=" * 50)
    print(" Deployment Complete!")
    print("=" * 50)
    print()
    print("  netcortex-rca is ClusterIP-only by default (no NodePort) — see")
    print("  k8s/rca-service.yaml for why. Reach it from your machine with:")
    print()
    print("    kubectl -n netcortex port-forward svc/netcortex-rca 9000:9000")
    print()
    print("  Then MCP RCA Server: http://localhost:9000/mcp")
    print()
    print("  Test with MCP Inspector:")
    print("    npx @modelcontextprotocol/inspector")
    print()
    print("  View logs:")
    print("    kubectl -n netcortex logs -l app=netcortex-rca --tail=20")
    print("    kubectl -n netcortex logs -l app=netcortex-telemetry --tail=20")
    print()
    print("  Teardown:")
    print("    python deploy.py --teardown")
    print()


if __name__ == "__main__":
    main()