Allow relative volume paths for k8s-kind deployments

For k8s-kind, relative paths (e.g., ./data/rpc-config) are resolved to $DEPLOYMENT_DIR/path by _make_absolute_host_path() during kind config generation. This provides Docker Host persistence that survives cluster restarts. Previously, validation threw an exception before paths could be resolved, making it impossible to use relative paths for persistent storage. Changes: - deployment_create.py: Skip relative path check for k8s-kind - cluster_info.py: Allow relative paths to reach PV generation - docs/deployment_patterns.md: Document volume persistence patterns Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Fix repo root path calculation (4 parents from stack path)
2026-02-02 23:26:13 -05:00 · 2026-02-02 22:49:19 -05:00 · 2026-02-02 22:48:19 -05:00 · 2026-02-02 22:18:19 -05:00 · 2026-02-02 19:31:45 -05:00 · 2026-02-02 19:30:13 -05:00
34 changed files with 471 additions and 4850 deletions
@@ -8,4 +8,3 @@ __pycache__
 package
 stack_orchestrator/data/build_tag.txt
 /build
-.worktrees
@@ -1 +0,0 @@
-pebbles.db
@@ -1 +0,0 @@
-{"project": "stack-orchestrator", "prefix": "so"}
@@ -1,10 +0,0 @@
-{"type": "create", "timestamp": "2026-03-18T14:45:07.038870Z", "issue_id": "so-a1a", "payload": {"title": "deploy create should support external credential injection", "type": "feature", "priority": "2", "description": "deploy create generates config.env but provides no mechanism to inject external credentials (API keys, tokens, etc.) at creation time. Operators must append to config.env after the fact, which mutates a build artifact. deploy create should accept --credentials-file or similar to include secrets in the generated config.env."}}
-{"type": "create", "timestamp": "2026-03-18T14:45:07.038942Z", "issue_id": "so-b2b", "payload": {"title": "REGISTRY_TOKEN / imagePullSecret flow undocumented", "type": "bug", "priority": "2", "description": "create_registry_secret() exists in deployment_create.py and is called during up(), but REGISTRY_TOKEN is not documented in spec.yml or any user-facing docs. The restart command warns \"Registry token env var REGISTRY_TOKEN not set, skipping registry secret\" but doesn't explain how to set it. For GHCR private images, this is required and the flow from spec.yml -> config.env -> imagePullSecret needs documentation."}}
-{"type": "create", "timestamp": "2026-03-18T19:10:00.000000Z", "issue_id": "so-k1k", "payload": {"title": "Stack path resolution differs between deploy create and deployment restart", "type": "bug", "priority": "2", "description": "deploy create resolves --stack as a relative path from cwd. deployment restart resolves --stack-path as absolute, then computes repo_root as 4 parents up (assuming stack_orchestrator/data/stacks/name structure). External stacks with different nesting depths (e.g. stack-orchestrator/stacks/name = 3 levels) get wrong repo_root, causing --spec-file resolution to fail. The two commands should use the same path resolution logic."}}
-{"type": "create", "timestamp": "2026-03-18T19:25:00.000000Z", "issue_id": "so-l2l", "payload": {"title": "deployment restart should update in place, not delete/recreate", "type": "bug", "priority": "1", "description": "deployment restart deletes the entire namespace then recreates everything from scratch. This causes:\n\n1. **Downtime** — nothing serves traffic between delete and successful recreate\n2. **No rollback** — deleting the namespace destroys ReplicaSet revision history\n3. **Race conditions** — namespace may still be terminating when up() tries to create\n4. **Cascading failures** — if ANY container fails to start, the entire site is down with no fallback\n\nFix: three changes needed.\n\n**A. up() should create-or-update, not just create.** Use patch/apply semantics for Deployments, Services, Ingresses. When the pod spec changes (new env vars, new image), k8s creates a new ReplicaSet, scales it up, waits for readiness probes, then scales the old one down. Old pods serve traffic until new pods are healthy.\n\n**B. down() should never delete the namespace on restart.** Only on explicit teardown. The namespace owns the revision history. Current code: _delete_namespace() on every down(). Should: delete individual resources by label for teardown, do nothing for restart (let update-in-place handle it).\n\n**C. All containers need readiness probes.** Without them k8s considers pods ready immediately, defeating rolling update safety. laconic-so should generate readiness probes from the http-proxy routes in spec.yml (if a container has an http route, probe that port).\n\nWith these changes, k8s native rolling updates provide zero-downtime deploys and automatic rollback (if new pods fail readiness, rollout stalls, old pods keep serving).\n\nSource files:\n- deploy_k8s.py: up(), down(), _create_deployment(), _delete_namespace()\n- cluster_info.py: pod spec generation (needs readiness probes)\n- deployment.py: restart() orchestration"}}
-{"type": "create", "timestamp": "2026-03-18T20:15:03.000000Z", "issue_id": "so-m3m", "payload": {"title": "Add credentials-files spec key for on-disk credential injection", "type": "feature", "priority": "1", "description": "deployment restart regenerates config.env from spec.yml, wiping credentials that were appended from on-disk files (e.g. ~/.credentials/*.env). Operators must append credentials after deploy create, which is fragile and breaks on restart.\n\nFix: New top-level spec key credentials-files. _write_config_file() reads each file and appends its contents to config.env after writing config vars. Files are read at deploy time from the deployment host.\n\nSpec syntax:\n  credentials-files:\n    - ~/.credentials/dumpster-secrets.env\n    - ~/.credentials/dumpster-r2.env\n\nFiles:\n- deploy/spec.py: add get_credentials_files() returning list of paths\n- deploy/deployment_create.py: in _write_config_file(), after writing config vars, read and append each credentials file (expand ~ to home dir)\n\nAlso update dumpster-stack spec.yml to use the new key and remove the ansible credential append workaround from woodburn_deployer (group_vars/all.yml credentials_env_files, stack_deploy role append tasks, restart_dumpster.yml credential steps). Those cleanups are in the woodburn_deployer repo."}}
-{"type":"status_update","timestamp":"2026-03-18T21:54:12.59148256Z","issue_id":"so-m3m","payload":{"status":"in_progress"}}
-{"type":"close","timestamp":"2026-03-18T21:55:31.6035544Z","issue_id":"so-m3m","payload":{}}
-{"type": "create", "timestamp": "2026-03-20T23:05:00.000000Z", "issue_id": "so-n1n", "payload": {"title": "Merge kind-mount-propagation branch — HostToContainer propagation for extraMounts", "type": "feature", "priority": "2", "description": "The kind-mount-root feature was cherry-picked to main (commit 8d03083d) but the mount propagation fix (commit 929bdab8 on branch enya-ac868cc4-kind-mount-propagation-fix) adds HostToContainer propagation so host submounts propagate into the Kind node. This is needed for ZFS child datasets and tmpfs mounts under the root. Cherry-pick 929bdab8 to main."}}
-{"type": "create", "timestamp": "2026-03-20T23:05:00.000000Z", "issue_id": "so-o2o", "payload": {"title": "etcd cert backup not persisting across cluster deletion", "type": "bug", "priority": "1", "description": "The extraMount for etcd at data/cluster-backups/<id>/etcd is configured but after cluster deletion the directory is empty. Caddy TLS certificates stored in etcd are lost. Either etcd isn't writing to the host mount, or the cleanup code is deleting the backup. Investigate _clean_etcd_keeping_certs in helpers.py."}}
-{"type": "create", "timestamp": "2026-03-21T00:20:00.000000Z", "issue_id": "so-p3p", "payload": {"title": "laconic-so should manage Caddy ingress image lifecycle", "type": "feature", "priority": "2", "description": "The Caddy ingress controller image is hardcoded in ingress-caddy-kind-deploy.yaml. There's no mechanism to update it without manual kubectl commands or cluster recreation. laconic-so should: 1) Allow spec.yml to specify a custom Caddy image, 2) Support updating the Caddy image as part of deployment restart, 3) Set strategy: Recreate on the Caddy Deployment (hostPort pods can't do RollingUpdate). This would let cryovial or similar tooling trigger Caddy updates through the normal deployment pipeline."}}
@@ -44,76 +44,6 @@ This project follows principles inspired by literate programming, where developm

 This approach treats the human-AI collaboration as a form of **conversational literate programming** where understanding emerges through dialogue before code implementation.

-## External Stacks Preferred
-
-When creating new stacks for any reason, **use the external stack pattern** rather than adding stacks directly to this repository.
-
-External stacks follow this structure:
-
-```
-my-stack/
-└── stack-orchestrator/
-    ├── stacks/
-    │   └── my-stack/
-    │       ├── stack.yml
-    │       └── README.md
-    ├── compose/
-    │   └── docker-compose-my-stack.yml
-    └── config/
-        └── my-stack/
-            └── (config files)
-```
-
-### Usage
-
-```bash
-# Fetch external stack
-laconic-so fetch-stack github.com/org/my-stack
-
-# Use external stack
-STACK_PATH=~/cerc/my-stack/stack-orchestrator/stacks/my-stack
-laconic-so --stack $STACK_PATH deploy init --output spec.yml
-laconic-so --stack $STACK_PATH deploy create --spec-file spec.yml --deployment-dir deployment
-laconic-so deployment --dir deployment start
-```
-
-### Examples
-
- `zenith-karma-stack` - Karma watcher deployment
- `urbit-stack` - Fake Urbit ship for testing
- `zenith-desk-stack` - Desk deployment stack
-
-## Architecture: k8s-kind Deployments
-
-### One Cluster Per Host
-One Kind cluster per host by design. Never request or expect separate clusters.
-
- `create_cluster()` in `helpers.py` reuses any existing cluster
- `cluster-id` in deployment.yml is an identifier, not a cluster request
- All deployments share: ingress controller, etcd, certificates
-
-### Stack Resolution
- External stacks detected via `Path(stack).exists()` in `util.py`
- Config/compose resolution: external path first, then internal fallback
- External path structure: `stack_orchestrator/data/stacks/<name>/stack.yml`
-
-### Secret Generation Implementation
- `GENERATE_TOKEN_PATTERN` in `deployment_create.py` matches `$generate:type:length$`
- `_generate_and_store_secrets()` creates K8s Secret
- `cluster_info.py` adds `envFrom` with `secretRef` to containers
- Non-secret config written to `config.env`
-
-### Repository Cloning
-`setup-repositories --git-ssh` clones repos defined in stack.yml's `repos:` field. Requires SSH agent.
-
-### Key Files (for codebase navigation)
- `repos/setup_repositories.py`: `setup-repositories` command (git clone)
- `deployment_create.py`: `deploy create` command, secret generation
- `deployment.py`: `deployment start/stop/restart` commands
- `deploy_k8s.py`: K8s deployer, cluster management calls
- `helpers.py`: `create_cluster()`, etcd cleanup, kind operations
- `cluster_info.py`: K8s resource generation (Deployment, Service, Ingress)
-
 ## Insights and Observations

 ### Design Principles
@@ -71,59 +71,6 @@ The various [stacks](/stack_orchestrator/data/stacks) each contain instructions
 - [laconicd with console and CLI](stack_orchestrator/data/stacks/fixturenet-laconic-loaded)
 - [kubo (IPFS)](stack_orchestrator/data/stacks/kubo)

-## Deployment Types
-
- **compose**: Docker Compose on local machine
- **k8s**: External Kubernetes cluster (requires kubeconfig)
- **k8s-kind**: Local Kubernetes via Kind - one cluster per host, shared by all deployments
-
-## External Stacks
-
-Stacks can live in external git repositories. Required structure:
-
-```
-<repo>/
-  stack_orchestrator/data/
-    stacks/<stack-name>/stack.yml
-    compose/docker-compose-<pod-name>.yml
-  deployment/spec.yml
-```
-
-## Deployment Commands
-
-```bash
-# Create deployment from spec
-laconic-so --stack <path> deploy create --spec-file <spec.yml> --deployment-dir <dir>
-
-# Start (creates cluster on first run)
-laconic-so deployment --dir <dir> start
-
-# GitOps restart (git pull + redeploy, preserves data)
-laconic-so deployment --dir <dir> restart
-
-# Stop
-laconic-so deployment --dir <dir> stop
-```
-
-## spec.yml Reference
-
-```yaml
-stack: stack-name-or-path
-deploy-to: k8s-kind
-network:
-  http-proxy:
-    - host-name: app.example.com
-      routes:
-        - path: /
-          proxy-to: service-name:port
-  acme-email: admin@example.com
-config:
-  ENV_VAR: value
-  SECRET_VAR: $generate:hex:32$   # Auto-generated, stored in K8s Secret
-volumes:
-  volume-name:
-```
-
 ## Contributing

 See the [CONTRIBUTING.md](/docs/CONTRIBUTING.md) for developer mode install.
@@ -7,25 +7,6 @@ We need an "update stack" command in stack orchestrator and cleaner documentatio

 **Context**: Currently, `deploy init` generates a spec file and `deploy create` creates a deployment directory. The `deployment update` command (added by Thomas Lackey) only syncs env vars and restarts - it doesn't regenerate configurations. There's a gap in the workflow for updating stack configurations after initial deployment.

-## Bugs
-
-### `deploy create` doesn't auto-generate volume mappings for new pods
-
-When a new pod is added to `stack.yml` (e.g. `monitoring`), `deploy create`
-does not generate default host path mappings in spec.yml for the new pod's
-volumes. The deployment then fails at scheduling because the PVCs don't exist.
-
-**Expected**: `deploy create` enumerates all volumes from all compose files
-in the stack and generates default host paths for any that aren't already
-mapped in the spec.yml `volumes:` section.
-
-**Actual**: Only volumes already in spec.yml get PVs. New volumes are silently
-missing, causing `FailedScheduling: persistentvolumeclaim not found`.
-
-**Workaround**: Manually add volume entries to spec.yml and create host dirs.
-
-**Files**: `deployment_create.py` (`_write_config_file`, volume handling)
-
 ## Architecture Refactoring

 ### Separate Deployer from Stack Orchestrator CLI
@@ -68,7 +68,7 @@ $ laconic-so build-npms --include <package-name> --force-rebuild

 ## deploy

-The `deploy` command group manages persistent deployments. The general workflow is `deploy init` to generate a spec file, then `deploy create` to create a deployment directory from the spec, then runtime commands like `deployment start` and `deployment stop`.
+The `deploy` command group manages persistent deployments. The general workflow is `deploy init` to generate a spec file, then `deploy create` to create a deployment directory from the spec, then runtime commands like `deploy up` and `deploy down`.

 ### deploy init

@@ -101,91 +101,35 @@ Options:
 - `--spec-file` (required): spec file to use
 - `--deployment-dir`: target directory for deployment files
 - `--update`: update an existing deployment directory, preserving data volumes and env file. Changed files are backed up with a `.bak` suffix. The deployment's `config.env` and `deployment.yml` are also preserved.
- `--helm-chart`: generate Helm chart instead of deploying (k8s only)
 - `--network-dir`: network configuration supplied in this directory
 - `--initial-peers`: initial set of persistent peers

-## deployment
+### deploy up

-Runtime commands for managing a created deployment. Use `--dir` to specify the deployment directory.
-
-### deployment start
-
-Start a deployment (`up` is a legacy alias):
+Start a deployment:
 ```
-$ laconic-so deployment --dir <deployment-dir> start
+$ laconic-so deployment --dir <deployment-dir> up
 ```

-Options:
- `--stay-attached` / `--detatch-terminal`: attach to container stdout (default: detach)
- `--skip-cluster-management` / `--perform-cluster-management`: skip kind cluster creation/teardown (default: perform management). Only affects k8s-kind deployments. Use this when multiple stacks share a single cluster.
+### deploy down

-### deployment stop
-
-Stop a deployment (`down` is a legacy alias):
+Stop a deployment:
 ```
-$ laconic-so deployment --dir <deployment-dir> stop
+$ laconic-so deployment --dir <deployment-dir> down
 ```
+Use `--delete-volumes` to also remove data volumes.

-Options:
- `--delete-volumes` / `--preserve-volumes`: delete data volumes on stop (default: preserve)
- `--skip-cluster-management` / `--perform-cluster-management`: skip kind cluster teardown (default: perform management). Use this to stop a single deployment without destroying a shared cluster.
-
-### deployment restart
-
-Restart a deployment with GitOps-aware workflow. Pulls latest stack code, syncs the deployment directory from the git-tracked spec, and restarts services:
-```
-$ laconic-so deployment --dir <deployment-dir> restart
-```
-
-See [deployment_patterns.md](deployment_patterns.md) for the recommended GitOps workflow.
-
-### deployment ps
+### deploy ps

 Show running services:
 ```
 $ laconic-so deployment --dir <deployment-dir> ps
 ```

-### deployment logs
+### deploy logs

 View service logs:
 ```
 $ laconic-so deployment --dir <deployment-dir> logs
 ```
 Use `-f` to follow and `-n <count>` to tail.
-
-### deployment exec
-
-Execute a command in a running service container:
-```
-$ laconic-so deployment --dir <deployment-dir> exec <service-name> "<command>"
-```
-
-### deployment status
-
-Show deployment status:
-```
-$ laconic-so deployment --dir <deployment-dir> status
-```
-
-### deployment port
-
-Show mapped ports for a service:
-```
-$ laconic-so deployment --dir <deployment-dir> port <service-name> <port>
-```
-
-### deployment push-images
-
-Push deployment images to a registry:
-```
-$ laconic-so deployment --dir <deployment-dir> push-images
-```
-
-### deployment run-job
-
-Run a one-time job in the deployment:
-```
-$ laconic-so deployment --dir <deployment-dir> run-job <job-name>
-```
@@ -30,7 +30,7 @@ git commit -m "Add my-stack deployment configuration"
 git push

 # On deployment server: deploy from git-tracked spec
-laconic-so --stack my-stack deploy create \
+laconic-so deploy create \
  --spec-file /path/to/operator-repo/spec.yml \
  --deployment-dir my-deployment

@@ -76,94 +76,6 @@ git pull  # Get latest spec.yml from your operator repo
 laconic-so deployment --dir my-deployment restart
 ```

-## Private Registry Authentication
-
-For deployments using images from private container registries (e.g., GitHub Container Registry), configure authentication in your spec.yml:
-
-### Configuration
-
-Add a `registry-credentials` section to your spec.yml:
-
-```yaml
-registry-credentials:
-  server: ghcr.io
-  username: your-org-or-username
-  token-env: REGISTRY_TOKEN
-```
-
-**Fields:**
- `server`: The registry hostname (e.g., `ghcr.io`, `docker.io`, `gcr.io`)
- `username`: Registry username (for GHCR, use your GitHub username or org name)
- `token-env`: Name of the environment variable containing your API token/PAT
-
-### Token Environment Variable
-
-The `token-env` pattern keeps credentials out of version control. Set the environment variable when running `deployment start`:
-
-```bash
-export REGISTRY_TOKEN="your-personal-access-token"
-laconic-so deployment --dir my-deployment start
-```
-
-For GHCR, create a Personal Access Token (PAT) with `read:packages` scope.
-
-### Ansible Integration
-
-When using Ansible for deployments, pass the token from a credentials file:
-
-```yaml
- name: Start deployment
-  ansible.builtin.command:
-    cmd: laconic-so deployment --dir {{ deployment_dir }} start
-  environment:
-    REGISTRY_TOKEN: "{{ lookup('file', '~/.credentials/ghcr_token') }}"
-```
-
-### How It Works
-
-1. laconic-so reads the `registry-credentials` config from spec.yml
-2. Creates a Kubernetes `docker-registry` secret named `{deployment}-registry`
-3. The deployment's pods reference this secret for image pulls
-
-## Cluster and Volume Management
-
-### Stopping Deployments
-
-The `deployment stop` command has two important flags:
-
-```bash
-# Default: stops deployment, deletes cluster, PRESERVES volumes
-laconic-so deployment --dir my-deployment stop
-
-# Explicitly delete volumes (USE WITH CAUTION)
-laconic-so deployment --dir my-deployment stop --delete-volumes
-```
-
-### Volume Persistence
-
-Volumes persist across cluster deletion by design. This is important because:
- **Data survives cluster recreation**: Ledger data, databases, and other state are preserved
- **Faster recovery**: No need to re-sync or rebuild data after cluster issues
- **Safe cluster upgrades**: Delete and recreate cluster without data loss
-
-**Only use `--delete-volumes` when:**
- You explicitly want to start fresh with no data
- The user specifically requests volume deletion
- You're cleaning up a test/dev environment completely
-
-### Shared Cluster Architecture
-
-In kind deployments, multiple stacks share a single cluster:
- First `deployment start` creates the cluster
- Subsequent deployments reuse the existing cluster
- `deployment stop` on ANY deployment deletes the shared cluster
- Other deployments will fail until cluster is recreated
-
-To stop a single deployment without affecting the cluster:
-```bash
-laconic-so deployment --dir my-deployment stop --skip-cluster-management
-```
-
 ## Volume Persistence in k8s-kind

 k8s-kind has 3 storage layers:
@@ -29,7 +29,6 @@ network_key = "network"
 http_proxy_key = "http-proxy"
 image_registry_key = "image-registry"
 configmaps_key = "configmaps"
-secrets_key = "secrets"
 resources_key = "resources"
 volumes_key = "volumes"
 security_key = "security"
@@ -46,6 +45,3 @@ runtime_class_key = "runtime-class"
 high_memlock_runtime = "high-memlock"
 high_memlock_spec_filename = "high-memlock-spec.json"
 acme_email_key = "acme-email"
-kind_mount_root_key = "kind-mount-root"
-external_services_key = "external-services"
-ca_certificates_key = "ca-certificates"
@@ -1,5 +0,0 @@
-services:
-  test-job:
-    image: cerc/test-container:local
-    entrypoint: /bin/sh
-    command: ["-c", "echo 'Job completed successfully'"]
@@ -186,8 +186,8 @@ spec:
          operator: Equal
      containers:
        - name: caddy-ingress-controller
-          image: ghcr.io/laconicnetwork/caddy-ingress:latest
-          imagePullPolicy: Always
+          image: caddy/ingress:latest
+          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 80
@@ -21,7 +21,7 @@ from stack_orchestrator.deploy.deploy_util import VolumeMapping, run_container_c
 from pathlib import Path

 default_spec_file_content = """config:
-    test_variable_1: test-value-1
+    test-variable-1: test-value-1
 """


@@ -7,5 +7,3 @@ containers:
  - cerc/test-container
 pods:
  - test
-jobs:
-  - test-job
@@ -48,7 +48,7 @@ class DockerDeployer(Deployer):
        self.compose_project_name = compose_project_name
        self.compose_env_file = compose_env_file

-    def up(self, detach, skip_cluster_management, services, image_overrides=None):
+    def up(self, detach, skip_cluster_management, services):
        if not opts.o.dry_run:
            try:
                return self.docker.compose.up(detach=detach, services=services)
@@ -35,7 +35,6 @@ from stack_orchestrator.util import (
    get_dev_root_path,
    stack_is_in_deployment,
    resolve_compose_file,
-    get_job_list,
 )
 from stack_orchestrator.deploy.deployer import DeployerException
 from stack_orchestrator.deploy.deployer_factory import getDeployer
@@ -131,17 +130,12 @@ def create_deploy_context(
        compose_files=cluster_context.compose_files,
        compose_project_name=cluster_context.cluster,
        compose_env_file=cluster_context.env_file,
-        job_compose_files=cluster_context.job_compose_files,
    )
    return DeployCommandContext(stack, cluster_context, deployer)


 def up_operation(
-    ctx,
-    services_list,
-    stay_attached=False,
-    skip_cluster_management=False,
-    image_overrides=None,
+    ctx, services_list, stay_attached=False, skip_cluster_management=False
 ):
    global_context = ctx.parent.parent.obj
    deploy_context = ctx.obj
@@ -160,7 +154,6 @@ def up_operation(
        detach=not stay_attached,
        skip_cluster_management=skip_cluster_management,
        services=services_list,
-        image_overrides=image_overrides,
    )
    for post_start_command in cluster_context.post_start_commands:
        _run_command(global_context, cluster_context.cluster, post_start_command)
@@ -410,7 +403,7 @@ def _make_cluster_context(ctx, stack, include, exclude, cluster, env_file):
        stack_config = get_parsed_stack_config(stack)
        if stack_config is not None:
            # TODO: syntax check the input here
-            pods_in_scope = stack_config.get("pods") or []
+            pods_in_scope = stack_config["pods"]
            cluster_config = (
                stack_config["config"] if "config" in stack_config else None
            )
@@ -484,22 +477,6 @@ def _make_cluster_context(ctx, stack, include, exclude, cluster, env_file):
    if ctx.verbose:
        print(f"files: {compose_files}")

-    # Gather job compose files (from compose-jobs/ directory in deployment)
-    job_compose_files = []
-    if deployment and stack:
-        stack_config = get_parsed_stack_config(stack)
-        if stack_config:
-            jobs = get_job_list(stack_config)
-            compose_jobs_dir = stack.joinpath("compose-jobs")
-            for job in jobs:
-                job_file_name = os.path.join(
-                    compose_jobs_dir, f"docker-compose-{job}.yml"
-                )
-                if os.path.exists(job_file_name):
-                    job_compose_files.append(job_file_name)
-            if ctx.verbose:
-                print(f"job files: {job_compose_files}")
-
    return ClusterContext(
        ctx,
        cluster,
@@ -508,7 +485,6 @@ def _make_cluster_context(ctx, stack, include, exclude, cluster, env_file):
        post_start_commands,
        cluster_config,
        env_file,
-        job_compose_files=job_compose_files if job_compose_files else None,
    )


@@ -29,7 +29,6 @@ class ClusterContext:
    post_start_commands: List[str]
    config: Optional[str]
    env_file: Optional[str]
-    job_compose_files: Optional[List[str]] = None


@dataclass
@@ -20,7 +20,7 @@ from typing import Optional

 class Deployer(ABC):
    @abstractmethod
-    def up(self, detach, skip_cluster_management, services, image_overrides=None):
+    def up(self, detach, skip_cluster_management, services):
        pass

    @abstractmethod
@@ -34,12 +34,7 @@ def getDeployerConfigGenerator(type: str, deployment_context):


 def getDeployer(
-    type: str,
-    deployment_context,
-    compose_files,
-    compose_project_name,
-    compose_env_file,
-    job_compose_files=None,
+    type: str, deployment_context, compose_files, compose_project_name, compose_env_file
 ):
    if type == "compose" or type is None:
        return DockerDeployer(
@@ -59,7 +54,6 @@ def getDeployer(
            compose_files,
            compose_project_name,
            compose_env_file,
-            job_compose_files=job_compose_files,
        )
    else:
        print(f"ERROR: deploy-to {type} is not valid")
@@ -17,7 +17,7 @@ import click
 from pathlib import Path
 import subprocess
 import sys
-
+import time
 from stack_orchestrator import constants
 from stack_orchestrator.deploy.images import push_images_operation
 from stack_orchestrator.deploy.deploy import (
@@ -248,13 +248,8 @@ def run_job(ctx, job_name, helm_release):
    "--expected-ip",
    help="Expected IP for DNS verification (if different from egress)",
 )
-@click.option(
-    "--image",
-    multiple=True,
-    help="Override container image: container=image",
-)
@click.pass_context
-def restart(ctx, stack_path, spec_file, config_file, force, expected_ip, image):
+def restart(ctx, stack_path, spec_file, config_file, force, expected_ip):
    """Pull latest code and restart deployment using git-tracked spec.

    GitOps workflow:
@@ -281,17 +276,6 @@ def restart(ctx, stack_path, spec_file, config_file, force, expected_ip, image):

    deployment_context: DeploymentContext = ctx.obj

-    # Parse --image flags into a dict of container_name -> image
-    image_overrides = {}
-    for entry in image:
-        if "=" not in entry:
-            raise click.BadParameter(
-                f"Invalid --image format '{entry}', expected container=image",
-                param_hint="'--image'",
-            )
-        container_name, image_ref = entry.split("=", 1)
-        image_overrides[container_name] = image_ref
-
    # Get current spec info (before git pull)
    current_spec = deployment_context.spec
    current_http_proxy = current_spec.get_http_proxy()
@@ -338,22 +322,9 @@ def restart(ctx, stack_path, spec_file, config_file, force, expected_ip, image):

    # Determine spec file location
    # Priority: --spec-file argument > repo's deployment/spec.yml > deployment dir
-    # Find repo root via git rather than assuming a fixed directory depth.
-    git_root_result = subprocess.run(
-        ["git", "rev-parse", "--show-toplevel"],
-        cwd=stack_source,
-        capture_output=True,
-        text=True,
-    )
-    if git_root_result.returncode == 0:
-        repo_root = Path(git_root_result.stdout.strip())
-    else:
-        # Fallback: walk up from stack_source looking for .git
-        repo_root = stack_source
-        while repo_root != repo_root.parent:
-            if (repo_root / ".git").exists():
-                break
-            repo_root = repo_root.parent
+    # Stack path is like: repo/stack_orchestrator/data/stacks/stack-name
+    # So repo root is 4 parents up
+    repo_root = stack_source.parent.parent.parent.parent
    if spec_file:
        # Spec file relative to repo root
        spec_file_path = repo_root / spec_file
@@ -397,14 +368,7 @@ def restart(ctx, stack_path, spec_file, config_file, force, expected_ip, image):
        print("\n[2/4] Hostname unchanged, skipping DNS verification")

    # Step 3: Sync deployment directory with spec
-    # The spec's "stack:" value is often a relative path (e.g.
-    # "stack-orchestrator/stacks/dumpster") that must resolve from the
-    # repo root.  Change cwd so stack_is_external() sees it correctly.
    print("\n[3/4] Syncing deployment directory...")
-    import os
-
-    prev_cwd = os.getcwd()
-    os.chdir(repo_root)
    deploy_ctx = make_deploy_context(ctx)
    create_operation(
        deployment_command_context=deploy_ctx,
@@ -414,216 +378,28 @@ def restart(ctx, stack_path, spec_file, config_file, force, expected_ip, image):
        network_dir=None,
        initial_peers=None,
    )
+
    # Reload deployment context with updated spec
    deployment_context.init(deployment_context.deployment_dir)
    ctx.obj = deployment_context

-    # Apply updated deployment.
-    # If maintenance-service is configured, swap Ingress to maintenance
-    # backend during the Recreate window so users see a branded page
-    # instead of bare 502s.
-    print("\n[4/4] Applying deployment update...")
+    # Stop deployment
+    print("\n[4/4] Restarting deployment...")
    ctx.obj = make_deploy_context(ctx)
+    down_operation(
+        ctx, delete_volumes=False, extra_args_list=[], skip_cluster_management=True
+    )

-    # Check for maintenance service in the (reloaded) spec
-    maintenance_svc = deployment_context.spec.get_maintenance_service()
-    if maintenance_svc:
-        print(f"Maintenance service configured: {maintenance_svc}")
-        _restart_with_maintenance(
-            ctx, deployment_context, maintenance_svc, image_overrides
-        )
-    else:
-        up_operation(
-            ctx,
-            services_list=None,
-            stay_attached=False,
-            skip_cluster_management=True,
-            image_overrides=image_overrides or None,
-        )
+    # Brief pause to ensure clean shutdown
+    time.sleep(5)

-    # Restore cwd after both create_operation and up_operation have run.
-    # Both need the relative stack path to resolve from repo_root.
-    os.chdir(prev_cwd)
+    # Start deployment
+    up_operation(
+        ctx, services_list=None, stay_attached=False, skip_cluster_management=True
+    )

    print("\n=== Restart Complete ===")
-    print("Deployment updated via rolling update.")
+    print("Deployment restarted with git-tracked configuration.")
    if new_hostname and new_hostname != current_hostname:
        print(f"\nNew hostname: {new_hostname}")
        print("Caddy will automatically provision TLS certificate.")
-
-
-def _restart_with_maintenance(
-    ctx, deployment_context, maintenance_svc, image_overrides
-):
-    """Restart with Ingress swap to maintenance service during Recreate.
-
-    Flow:
-    1. Deploy all pods (including maintenance pod) with up_operation
-    2. Patch Ingress: swap all route backends to maintenance service
-    3. Scale main (non-maintenance) Deployments to 0
-    4. Scale main Deployments back up (triggers Recreate with new spec)
-    5. Wait for readiness
-    6. Patch Ingress: restore original backends
-
-    This ensures the maintenance pod is already running before we touch
-    the Ingress, and the main pods get a clean Recreate.
-    """
-    import time
-
-    from kubernetes.client.exceptions import ApiException
-
-    from stack_orchestrator.deploy.deploy import up_operation
-
-    # Step 1: Apply the full deployment (creates/updates all pods + services)
-    # This ensures maintenance pod exists before we swap Ingress to it.
-    up_operation(
-        ctx,
-        services_list=None,
-        stay_attached=False,
-        skip_cluster_management=True,
-        image_overrides=image_overrides or None,
-    )
-
-    # Parse maintenance service spec: "container-name:port"
-    maint_container = maintenance_svc.split(":")[0]
-    maint_port = int(maintenance_svc.split(":")[1])
-
-    # Connect to k8s API
-    deploy_ctx = ctx.obj
-    deployer = deploy_ctx.deployer
-    deployer.connect_api()
-    namespace = deployer.k8s_namespace
-    app_name = deployer.cluster_info.app_name
-    networking_api = deployer.networking_api
-    apps_api = deployer.apps_api
-
-    ingress_name = f"{app_name}-ingress"
-
-    # Step 2: Read current Ingress and save original backends
-    try:
-        ingress = networking_api.read_namespaced_ingress(
-            name=ingress_name, namespace=namespace
-        )
-    except ApiException:
-        print("Warning: No Ingress found, skipping maintenance swap")
-        return
-
-    # Resolve which service the maintenance container belongs to
-    maint_service_name = deployer.cluster_info._resolve_service_name_for_container(
-        maint_container
-    )
-
-    # Save original backends for restoration
-    original_backends = []
-    for rule in ingress.spec.rules:
-        rule_backends = []
-        for path in rule.http.paths:
-            rule_backends.append(
-                {
-                    "name": path.backend.service.name,
-                    "port": path.backend.service.port.number,
-                }
-            )
-        original_backends.append(rule_backends)
-
-    # Patch all Ingress backends to point to maintenance service
-    print("Swapping Ingress to maintenance service...")
-    for rule in ingress.spec.rules:
-        for path in rule.http.paths:
-            path.backend.service.name = maint_service_name
-            path.backend.service.port.number = maint_port
-
-    networking_api.replace_namespaced_ingress(
-        name=ingress_name, namespace=namespace, body=ingress
-    )
-    print("Ingress now points to maintenance service")
-
-    # Step 3: Find main (non-maintenance) Deployments and scale to 0
-    # then back up to trigger a clean Recreate
-    deployments_resp = apps_api.list_namespaced_deployment(
-        namespace=namespace, label_selector=f"app={app_name}"
-    )
-    main_deployments = []
-    for dep in deployments_resp.items:
-        dep_name = dep.metadata.name
-        # Skip maintenance deployments
-        component = (dep.metadata.labels or {}).get("app.kubernetes.io/component", "")
-        is_maintenance = maint_container in component
-        if not is_maintenance:
-            main_deployments.append(dep_name)
-
-    if main_deployments:
-        # Scale down main deployments
-        for dep_name in main_deployments:
-            print(f"Scaling down {dep_name}...")
-            apps_api.patch_namespaced_deployment_scale(
-                name=dep_name,
-                namespace=namespace,
-                body={"spec": {"replicas": 0}},
-            )
-
-        # Wait for pods to terminate
-        print("Waiting for main pods to terminate...")
-        deadline = time.monotonic() + 120
-        while time.monotonic() < deadline:
-            pods = deployer.core_api.list_namespaced_pod(
-                namespace=namespace,
-                label_selector=f"app={app_name}",
-            )
-            # Count non-maintenance pods
-            active = sum(
-                1
-                for p in pods.items
-                if p.metadata
-                and p.metadata.deletion_timestamp is None
-                and not any(
-                    maint_container in (c.name or "") for c in (p.spec.containers or [])
-                )
-            )
-            if active == 0:
-                break
-            time.sleep(2)
-
-        # Scale back up
-        replicas = deployment_context.spec.get_replicas()
-        for dep_name in main_deployments:
-            print(f"Scaling up {dep_name} to {replicas} replicas...")
-            apps_api.patch_namespaced_deployment_scale(
-                name=dep_name,
-                namespace=namespace,
-                body={"spec": {"replicas": replicas}},
-            )
-
-        # Step 5: Wait for readiness
-        print("Waiting for main pods to become ready...")
-        deadline = time.monotonic() + 300
-        while time.monotonic() < deadline:
-            all_ready = True
-            for dep_name in main_deployments:
-                dep = apps_api.read_namespaced_deployment(
-                    name=dep_name, namespace=namespace
-                )
-                ready = dep.status.ready_replicas or 0
-                desired = dep.spec.replicas or 1
-                if ready < desired:
-                    all_ready = False
-                    break
-            if all_ready:
-                break
-            time.sleep(5)
-
-    # Step 6: Restore original Ingress backends
-    print("Restoring original Ingress backends...")
-    ingress = networking_api.read_namespaced_ingress(
-        name=ingress_name, namespace=namespace
-    )
-    for i, rule in enumerate(ingress.spec.rules):
-        for j, path in enumerate(rule.http.paths):
-            if i < len(original_backends) and j < len(original_backends[i]):
-                path.backend.service.name = original_backends[i][j]["name"]
-                path.backend.service.port.number = original_backends[i][j]["port"]
-
-    networking_api.replace_namespaced_ingress(
-        name=ingress_name, namespace=namespace, body=ingress
-    )
-    print("Ingress restored to original backends")
@@ -15,10 +15,7 @@

 import click
 from importlib import util
-import json
 import os
-import re
-import base64
 from pathlib import Path
 from typing import List, Optional
 import random
@@ -265,25 +262,6 @@ def call_stack_deploy_create(deployment_context, extra_args):
                imported_stack.create(deployment_context, extra_args)


-def call_stack_deploy_start(deployment_context):
-    """Call start() hooks after k8s deployments and jobs are created.
-
-    The start() hook receives the DeploymentContext, allowing stacks to
-    create additional k8s resources (Services, etc.) in the deployment namespace.
-    The namespace can be derived as f"laconic-{deployment_context.id}".
-    """
-    python_file_paths = _commands_plugin_paths(deployment_context.stack.name)
-    for python_file_path in python_file_paths:
-        if python_file_path.exists():
-            spec = util.spec_from_file_location("commands", python_file_path)
-            if spec is None or spec.loader is None:
-                continue
-            imported_stack = util.module_from_spec(spec)
-            spec.loader.exec_module(imported_stack)
-            if _has_method(imported_stack, "start"):
-                imported_stack.start(deployment_context)
-
-
 # Inspect the pod yaml to find config files referenced in subdirectories
 # other than the one associated with the pod
 def _find_extra_config_dirs(parsed_pod_file, pod):
@@ -496,9 +474,6 @@ def init_operation(
            spec_file_content["volumes"] = {**volume_descriptors, **orig_volumes}
        if configmap_descriptors:
            spec_file_content["configmaps"] = configmap_descriptors
-        if "k8s" in deployer_type:
-            if "secrets" not in spec_file_content:
-                spec_file_content["secrets"] = {}

    if opts.o.debug:
        print(
@@ -509,217 +484,15 @@ def init_operation(
        get_yaml().dump(spec_file_content, output_file)


-# Token pattern: $generate:hex:32$ or $generate:base64:16$
-GENERATE_TOKEN_PATTERN = re.compile(r"\$generate:(\w+):(\d+)\$")
-
-
-def _generate_and_store_secrets(config_vars: dict, deployment_name: str):
-    """Generate secrets for $generate:...$ tokens and store in K8s Secret.
-
-    Called by `deploy create` - generates fresh secrets and stores them.
-    Returns the generated secrets dict for reference.
-    """
-    from kubernetes import client, config as k8s_config
-
-    secrets = {}
-    for name, value in config_vars.items():
-        if not isinstance(value, str):
-            continue
-        match = GENERATE_TOKEN_PATTERN.search(value)
-        if not match:
-            continue
-
-        secret_type, length = match.group(1), int(match.group(2))
-        if secret_type == "hex":
-            secrets[name] = token_hex(length)
-        elif secret_type == "base64":
-            secrets[name] = base64.b64encode(os.urandom(length)).decode()
-        else:
-            secrets[name] = token_hex(length)
-
-    if not secrets:
-        return secrets
-
-    # Store in K8s Secret
-    try:
-        k8s_config.load_kube_config()
-    except Exception:
-        # Fall back to in-cluster config if available
-        try:
-            k8s_config.load_incluster_config()
-        except Exception:
-            print(
-                "Warning: Could not load kube config, secrets will not be stored in K8s"
-            )
-            return secrets
-
-    v1 = client.CoreV1Api()
-    secret_name = f"{deployment_name}-generated-secrets"
-    namespace = "default"
-
-    secret_data = {k: base64.b64encode(v.encode()).decode() for k, v in secrets.items()}
-    k8s_secret = client.V1Secret(
-        metadata=client.V1ObjectMeta(name=secret_name), data=secret_data, type="Opaque"
-    )
-
-    try:
-        v1.create_namespaced_secret(namespace, k8s_secret)
-        num_secrets = len(secrets)
-        print(f"Created K8s Secret '{secret_name}' with {num_secrets} secret(s)")
-    except client.exceptions.ApiException as e:
-        if e.status == 409:  # Already exists
-            v1.replace_namespaced_secret(secret_name, namespace, k8s_secret)
-            num_secrets = len(secrets)
-            print(f"Updated K8s Secret '{secret_name}' with {num_secrets} secret(s)")
-        else:
-            raise
-
-    return secrets
-
-
-def create_registry_secret(
-    spec: Spec, deployment_name: str, namespace: str = "default"
-) -> Optional[str]:
-    """Create K8s docker-registry secret from spec + environment.
-
-    Reads registry configuration from spec.yml and creates a Kubernetes
-    secret of type kubernetes.io/dockerconfigjson for image pulls.
-
-    Args:
-        spec: The deployment spec containing image-registry config
-        deployment_name: Name of the deployment (used for secret naming)
-        namespace: K8s namespace to create the secret in
-
-    Returns:
-        The secret name if created, None if no registry config
-    """
-    from kubernetes import client, config as k8s_config
-
-    registry_config = spec.get_image_registry_config()
-    if not registry_config:
-        return None
-
-    server = registry_config.get("server")
-    username = registry_config.get("username")
-    token_env = registry_config.get("token-env")
-    token_file = registry_config.get("token-file")
-
-    if not server or not username:
-        return None
-    if not token_env and not token_file:
-        return None
-
-    # Resolve token: file takes precedence over env var
-    token = None
-    if token_file:
-        token_path = os.path.expanduser(token_file)
-        if os.path.exists(token_path):
-            with open(token_path) as f:
-                token = f.read().strip()
-        else:
-            print(f"Warning: Registry token file '{token_path}' not found")
-    if not token and token_env:
-        token = os.environ.get(token_env)
-
-    if not token:
-        source = token_file or token_env
-        print(
-            f"Warning: Registry token not available from '{source}', "
-            "skipping registry secret"
-        )
-        return None
-
-    # Create dockerconfigjson format (Docker API uses "password" field for tokens)
-    auth = base64.b64encode(f"{username}:{token}".encode()).decode()
-    docker_config = {
-        "auths": {server: {"username": username, "password": token, "auth": auth}}
-    }
-
-    # Secret name derived from deployment name
-    secret_name = f"{deployment_name}-image-pull-secret"
-
-    # Load kube config
-    try:
-        k8s_config.load_kube_config()
-    except Exception:
-        try:
-            k8s_config.load_incluster_config()
-        except Exception:
-            print("Warning: Could not load kube config, registry secret not created")
-            return None
-
-    v1 = client.CoreV1Api()
-
-    k8s_secret = client.V1Secret(
-        metadata=client.V1ObjectMeta(name=secret_name),
-        data={
-            ".dockerconfigjson": base64.b64encode(
-                json.dumps(docker_config).encode()
-            ).decode()
-        },
-        type="kubernetes.io/dockerconfigjson",
-    )
-
-    try:
-        v1.create_namespaced_secret(namespace, k8s_secret)
-        print(f"Created registry secret '{secret_name}' for {server}")
-    except client.exceptions.ApiException as e:
-        if e.status == 409:  # Already exists
-            v1.replace_namespaced_secret(secret_name, namespace, k8s_secret)
-            print(f"Updated registry secret '{secret_name}' for {server}")
-        else:
-            raise
-
-    return secret_name
-
-
-def _write_config_file(
-    spec_file: Path, config_env_file: Path, deployment_name: Optional[str] = None
-):
+def _write_config_file(spec_file: Path, config_env_file: Path):
    spec_content = get_parsed_deployment_spec(spec_file)
-    config_vars = spec_content.get("config", {}) or {}
-
-    # Generate and store secrets in K8s if deployment_name provided and tokens exist
-    if deployment_name and config_vars:
-        has_generate_tokens = any(
-            isinstance(v, str) and GENERATE_TOKEN_PATTERN.search(v)
-            for v in config_vars.values()
-        )
-        if has_generate_tokens:
-            _generate_and_store_secrets(config_vars, deployment_name)
-
-    # Write non-secret config to config.env (exclude $generate:...$ tokens)
+    # Note: we want to write an empty file even if we have no config variables
    with open(config_env_file, "w") as output_file:
-        output_file.write(
-            "# AUTO-GENERATED by laconic-so from spec.yml config section.\n"
-            "# Source: stack_orchestrator/deploy/deployment_create.py"
-            " _write_config_file()\n"
-            "# Do not edit — changes will be overwritten on deploy create"
-            " or restart.\n"
-            "# To change config, edit the config section in your spec.yml"
-            " and redeploy.\n"
-        )
-        if config_vars:
-            for variable_name, variable_value in config_vars.items():
-                # Skip variables with generate tokens - they go to K8s Secret
-                if isinstance(variable_value, str) and GENERATE_TOKEN_PATTERN.search(
-                    variable_value
-                ):
-                    continue
-                output_file.write(f"{variable_name}={variable_value}\n")
-
-        # Append contents of credentials files listed in spec
-        credentials_files = spec_content.get("credentials-files", []) or []
-        for cred_path_str in credentials_files:
-            cred_path = Path(cred_path_str).expanduser()
-            if not cred_path.exists():
-                print(f"Error: credentials file does not exist: {cred_path}")
-                sys.exit(1)
-            output_file.write(f"# From credentials file: {cred_path_str}\n")
-            contents = cred_path.read_text()
-            output_file.write(contents)
-            if not contents.endswith("\n"):
-                output_file.write("\n")
+        if "config" in spec_content and spec_content["config"]:
+            config_vars = spec_content["config"]
+            if config_vars:
+                for variable_name, variable_value in config_vars.items():
+                    output_file.write(f"{variable_name}={variable_value}\n")


 def _write_kube_config_file(external_path: Path, internal_path: Path):
@@ -872,7 +645,9 @@ def create_operation(
            # Copy from temp to deployment dir, excluding data volumes
            # and backing up changed files.
            # Exclude data/* to avoid touching user data volumes.
-            exclude_patterns = ["data", "data/*"]
+            # Exclude config file to preserve deployment settings
+            # (XXX breaks passing config vars from spec)
+            exclude_patterns = ["data", "data/*", constants.config_file_name]
            _safe_copy_tree(
                temp_dir, deployment_dir_path, exclude_patterns=exclude_patterns
            )
@@ -985,12 +760,7 @@ def _write_deployment_files(
        _create_deployment_file(target_dir, stack_source=stack_source)

    # Copy any config variables from the spec file into an env file suitable for compose
-    # Use stack_name as deployment_name for K8s secret naming
-    # Extract just the name part if stack_name is a path ("path/to/stack" -> "stack")
-    deployment_name = Path(stack_name).name.replace("_", "-")
-    _write_config_file(
-        spec_file, target_dir.joinpath(constants.config_file_name), deployment_name
-    )
+    _write_config_file(spec_file, target_dir.joinpath(constants.config_file_name))

    # Copy any k8s config file into the target dir
    if deployment_type == "k8s":
@@ -1039,7 +809,17 @@ def _write_deployment_files(
            script_paths = get_pod_script_paths(parsed_stack, pod)
            _copy_files_to_directory(script_paths, destination_script_dir)

-        if not parsed_spec.is_kubernetes_deployment():
+        if parsed_spec.is_kubernetes_deployment():
+            for configmap in parsed_spec.get_configmaps():
+                source_config_dir = resolve_config_dir(stack_name, configmap)
+                if os.path.exists(source_config_dir):
+                    destination_config_dir = target_dir.joinpath(
+                        "configmaps", configmap
+                    )
+                    copytree(
+                        source_config_dir, destination_config_dir, dirs_exist_ok=True
+                    )
+        else:
            # TODO:
            # This is odd - looks up config dir that matches a volume name,
            # then copies as a mount dir?
@@ -1061,18 +841,9 @@ def _write_deployment_files(
                            dirs_exist_ok=True,
                        )

-    # Copy configmap directories for k8s deployments (outside the pod loop
-    # so this works for jobs-only stacks too)
-    if parsed_spec.is_kubernetes_deployment():
-        for configmap in parsed_spec.get_configmaps():
-            source_config_dir = resolve_config_dir(stack_name, configmap)
-            if os.path.exists(source_config_dir):
-                destination_config_dir = target_dir.joinpath("configmaps", configmap)
-                copytree(source_config_dir, destination_config_dir, dirs_exist_ok=True)
-
-    # Copy the job files into the target dir
+    # Copy the job files into the target dir (for Docker deployments)
    jobs = get_job_list(parsed_stack)
-    if jobs:
+    if jobs and not parsed_spec.is_kubernetes_deployment():
        destination_compose_jobs_dir = target_dir.joinpath("compose-jobs")
        os.makedirs(destination_compose_jobs_dir, exist_ok=True)
        for job in jobs:
@@ -14,13 +14,11 @@
 # along with this program.  If not, see <http:#www.gnu.org/licenses/>.

 from kubernetes import client, utils, watch
-from kubernetes.client.exceptions import ApiException
 import os
 from pathlib import Path
 import subprocess
 import re
 from typing import Set, Mapping, List, Optional, cast
-import yaml

 from stack_orchestrator.util import get_k8s_dir, error_exit
 from stack_orchestrator.opts import opts
@@ -264,61 +262,20 @@ def _clean_etcd_keeping_certs(etcd_path: str) -> bool:


 def create_cluster(name: str, config_file: str):
-    """Create or reuse the single kind cluster for this host.
-
-    There is only one kind cluster per host by design. Multiple deployments
-    share this cluster. If a cluster already exists, it is reused.
-
-    Args:
-        name: Cluster name (used only when creating the first cluster)
-        config_file: Path to kind config file (used only when creating)
-
-    Returns:
-        The name of the cluster being used
-    """
-    existing = get_kind_cluster()
-    if existing:
-        print(f"Using existing cluster: {existing}")
-        return existing
-
    # Clean persisted etcd, keeping only TLS certificates
    etcd_path = _get_etcd_host_path_from_kind_config(config_file)
    if etcd_path:
        _clean_etcd_keeping_certs(etcd_path)

-    print(f"Creating new cluster: {name}")
    result = _run_command(f"kind create cluster --name {name} --config {config_file}")
    if result.returncode != 0:
        raise DeployerException(f"kind create cluster failed: {result}")
-    return name


 def destroy_cluster(name: str):
    _run_command(f"kind delete cluster --name {name}")


-def is_ingress_running() -> bool:
-    """Check if the Caddy ingress controller is already running in the cluster."""
-    try:
-        core_v1 = client.CoreV1Api()
-        pods = core_v1.list_namespaced_pod(
-            namespace="caddy-system",
-            label_selector=(
-                "app.kubernetes.io/name=caddy-ingress-controller,"
-                "app.kubernetes.io/component=controller"
-            ),
-        )
-        for pod in pods.items:
-            if pod.status and pod.status.container_statuses:
-                if pod.status.container_statuses[0].ready is True:
-                    if opts.o.debug:
-                        print("Caddy ingress controller already running")
-                    return True
-        return False
-    except ApiException:
-        return False
-
-
 def wait_for_ingress_in_kind():
    core_v1 = client.CoreV1Api()
    for i in range(20):
@@ -354,34 +311,22 @@ def install_ingress_for_kind(acme_email: str = ""):
    )
    if opts.o.debug:
        print("Installing Caddy ingress controller in kind cluster")
+    utils.create_from_yaml(api_client, yaml_file=ingress_install)

-    # Template the YAML with email before applying
-    with open(ingress_install) as f:
-        yaml_content = f.read()
-
+    # Patch ConfigMap with acme email if provided
    if acme_email:
-        yaml_content = yaml_content.replace('email: ""', f'email: "{acme_email}"')
-        if opts.o.debug:
-            print(f"Configured Caddy with ACME email: {acme_email}")
-
-    # Apply templated YAML
-    yaml_objects = list(yaml.safe_load_all(yaml_content))
-    utils.create_from_yaml(api_client, yaml_objects=yaml_objects)
-
-    # Patch ConfigMap with ACME email if provided
-    if acme_email:
-        if opts.o.debug:
-            print(f"Configuring ACME email: {acme_email}")
-        core_api = client.CoreV1Api()
-        configmap = core_api.read_namespaced_config_map(
+        core_v1 = client.CoreV1Api()
+        configmap = core_v1.read_namespaced_config_map(
            name="caddy-ingress-controller-configmap", namespace="caddy-system"
        )
        configmap.data["email"] = acme_email
-        core_api.patch_namespaced_config_map(
+        core_v1.patch_namespaced_config_map(
            name="caddy-ingress-controller-configmap",
            namespace="caddy-system",
            body=configmap,
        )
+        if opts.o.debug:
+            print(f"Patched Caddy ConfigMap with email: {acme_email}")


 def load_images_into_kind(kind_cluster_name: str, image_set: Set[str]):
@@ -393,12 +338,10 @@ def load_images_into_kind(kind_cluster_name: str, image_set: Set[str]):
            raise DeployerException(f"kind load docker-image failed: {result}")


-def pods_in_deployment(
-    core_api: client.CoreV1Api, deployment_name: str, namespace: str = "default"
-):
+def pods_in_deployment(core_api: client.CoreV1Api, deployment_name: str):
    pods = []
    pod_response = core_api.list_namespaced_pod(
-        namespace=namespace, label_selector=f"app={deployment_name}"
+        namespace="default", label_selector=f"app={deployment_name}"
    )
    if opts.o.debug:
        print(f"pod_response: {pod_response}")
@@ -408,12 +351,10 @@ def pods_in_deployment(
    return pods


-def containers_in_pod(
-    core_api: client.CoreV1Api, pod_name: str, namespace: str = "default"
-) -> List[str]:
+def containers_in_pod(core_api: client.CoreV1Api, pod_name: str) -> List[str]:
    containers: List[str] = []
    pod_response = cast(
-        client.V1Pod, core_api.read_namespaced_pod(pod_name, namespace=namespace)
+        client.V1Pod, core_api.read_namespaced_pod(pod_name, namespace="default")
    )
    if opts.o.debug:
        print(f"pod_response: {pod_response}")
@@ -444,20 +385,7 @@ def named_volumes_from_pod_files(parsed_pod_files):
    return named_volumes


-def get_kind_pv_bind_mount_path(
-    volume_name: str,
-    kind_mount_root: Optional[str] = None,
-    host_path: Optional[str] = None,
-):
-    """Get the path inside the Kind node for a PV.
-
-    When kind-mount-root is set and the volume's host path is under
-    that root, return /mnt/{relative_path} so it resolves through the
-    single root extraMount. Otherwise fall back to /mnt/{volume_name}.
-    """
-    if kind_mount_root and host_path and host_path.startswith(kind_mount_root):
-        rel = os.path.relpath(host_path, kind_mount_root)
-        return f"/mnt/{rel}"
+def get_kind_pv_bind_mount_path(volume_name: str):
    return f"/mnt/{volume_name}"


@@ -580,36 +508,6 @@ def _generate_kind_mounts(parsed_pod_files, deployment_dir, deployment_context):
    volume_definitions = []
    volume_host_path_map = _get_host_paths_for_volumes(deployment_context)
    seen_host_path_mounts = set()  # Track to avoid duplicate mounts
-    kind_mount_root = deployment_context.spec.get_kind_mount_root()
-
-    # Cluster state backup for offline data recovery (unique per deployment)
-    # etcd contains all k8s state; PKI certs needed to decrypt etcd offline
-    deployment_id = deployment_context.id
-    backup_subdir = f"cluster-backups/{deployment_id}"
-
-    etcd_host_path = _make_absolute_host_path(
-        Path(f"./data/{backup_subdir}/etcd"), deployment_dir
-    )
-    volume_definitions.append(
-        f"  - hostPath: {etcd_host_path}\n" f"    containerPath: /var/lib/etcd\n"
-    )
-
-    pki_host_path = _make_absolute_host_path(
-        Path(f"./data/{backup_subdir}/pki"), deployment_dir
-    )
-    volume_definitions.append(
-        f"  - hostPath: {pki_host_path}\n" f"    containerPath: /etc/kubernetes/pki\n"
-    )
-
-    # When kind-mount-root is set, emit a single extraMount for the root.
-    # Individual volumes whose host path starts with the root are covered
-    # by this single mount and don't need their own extraMount entries.
-    mount_root_emitted = False
-    if kind_mount_root:
-        volume_definitions.append(
-            f"  - hostPath: {kind_mount_root}\n" f"    containerPath: /mnt\n"
-        )
-        mount_root_emitted = True

    # Note these paths are relative to the location of the pod files (at present)
    # So we need to fix up to make them correct and absolute because kind assumes
@@ -670,12 +568,6 @@ def _generate_kind_mounts(parsed_pod_files, deployment_dir, deployment_context):
                                        volume_host_path_map[volume_name],
                                        deployment_dir,
                                    )
-                                    # Skip individual extraMount if covered
-                                    # by the kind-mount-root single mount
-                                    if mount_root_emitted and str(host_path).startswith(
-                                        kind_mount_root
-                                    ):
-                                        continue
                                    container_path = get_kind_pv_bind_mount_path(
                                        volume_name
                                    )
@@ -976,43 +868,8 @@ def envs_from_compose_file(
    return result


-def translate_sidecar_service_names(
-    envs: Mapping[str, str], sibling_service_names: List[str]
-) -> Mapping[str, str]:
-    """Translate docker-compose service names to localhost for sidecar containers.
-
-    In docker-compose, services can reference each other by name (e.g., 'db:5432').
-    In Kubernetes, when multiple containers are in the same pod (sidecars), they
-    share the same network namespace and must use 'localhost' instead.
-
-    This function replaces service name references with 'localhost' in env values.
-    """
-    import re
-
-    if not sibling_service_names:
-        return envs
-
-    result = {}
-    for env_var, env_val in envs.items():
-        if env_val is None:
-            result[env_var] = env_val
-            continue
-
-        new_val = str(env_val)
-        for service_name in sibling_service_names:
-            # Match service name followed by optional port (e.g., 'db:5432', 'db')
-            # Handle URLs like: postgres://user:pass@db:5432/dbname
-            # and simple refs like: db:5432 or just db
-            pattern = rf"\b{re.escape(service_name)}(:\d+)?\b"
-            new_val = re.sub(pattern, lambda m: f'localhost{m.group(1) or ""}', new_val)
-
-        result[env_var] = new_val
-
-    return result
-
-
 def envs_from_environment_variables_map(
-    map: Mapping[str, str],
+    map: Mapping[str, str]
 ) -> List[client.V1EnvVar]:
    result = []
    for env_var, env_val in map.items():
@@ -98,98 +98,25 @@ class Spec:
    def get_image_registry(self):
        return self.obj.get(constants.image_registry_key)

-    def get_credentials_files(self) -> typing.List[str]:
-        """Returns list of credential file paths to append to config.env."""
-        return self.obj.get("credentials-files", [])
-
-    def get_image_registry_config(self) -> typing.Optional[typing.Dict]:
-        """Returns registry auth config: {server, username, token-env}.
-
-        Used for private container registries like GHCR. The token-env field
-        specifies an environment variable containing the API token/PAT.
-        """
-        return self.obj.get("image-pull-secret")
-
    def get_volumes(self):
        return self.obj.get(constants.volumes_key, {})

    def get_configmaps(self):
        return self.obj.get(constants.configmaps_key, {})

-    def get_secrets(self):
-        return self.obj.get(constants.secrets_key, {})
-
    def get_container_resources(self):
        return Resources(
            self.obj.get(constants.resources_key, {}).get("containers", {})
        )

-    def get_container_resources_for(
-        self, container_name: str
-    ) -> typing.Optional[Resources]:
-        """Look up per-container resource overrides from spec.yml.
-
-        Checks resources.containers.<container_name> in the spec. Returns None
-        if no per-container override exists (caller falls back to other sources).
-        """
-        containers_block = self.obj.get(constants.resources_key, {}).get(
-            "containers", {}
-        )
-        if container_name in containers_block:
-            entry = containers_block[container_name]
-            # Only treat it as a per-container override if it's a dict with
-            # reservations/limits nested inside (not a top-level global key)
-            if isinstance(entry, dict) and (
-                "reservations" in entry or "limits" in entry
-            ):
-                return Resources(entry)
-        return None
-
    def get_volume_resources(self):
        return Resources(
            self.obj.get(constants.resources_key, {}).get(constants.volumes_key, {})
        )

-    def get_volume_resources_for(self, volume_name: str) -> typing.Optional[Resources]:
-        """Look up per-volume resource overrides from spec.yml.
-
-        Supports two formats under resources.volumes:
-
-        Global (original):
-            resources:
-              volumes:
-                reservations:
-                  storage: 5Gi
-
-        Per-volume (new):
-            resources:
-              volumes:
-                my-volume:
-                  reservations:
-                    storage: 10Gi
-
-        Returns the per-volume Resources if found, otherwise None.
-        The caller should fall back to get_volume_resources() then the default.
-        """
-        vol_section = self.obj.get(constants.resources_key, {}).get(
-            constants.volumes_key, {}
-        )
-        if volume_name not in vol_section:
-            return None
-        entry = vol_section[volume_name]
-        if isinstance(entry, dict) and ("reservations" in entry or "limits" in entry):
-            return Resources(entry)
-        return None
-
    def get_http_proxy(self):
        return self.obj.get(constants.network_key, {}).get(constants.http_proxy_key, [])

-    def get_namespace(self):
-        return self.obj.get("namespace")
-
-    def get_kind_cluster_name(self):
-        return self.obj.get("kind-cluster-name")
-
    def get_annotations(self):
        return self.obj.get(constants.annotations_key, {})

@@ -264,46 +191,5 @@ class Spec:
    def is_kind_deployment(self):
        return self.get_deployment_type() in [constants.k8s_kind_deploy_type]

-    def get_kind_mount_root(self) -> typing.Optional[str]:
-        """Return kind-mount-root path or None.
-
-        When set, laconic-so emits a single Kind extraMount mapping this
-        host path to /mnt inside the Kind node. Volumes with host paths
-        under this root resolve to /mnt/{relative_path} and don't need
-        individual extraMounts. This allows adding new volumes without
-        recreating the Kind cluster.
-        """
-        return self.obj.get(constants.kind_mount_root_key)
-
-    def get_maintenance_service(self) -> typing.Optional[str]:
-        """Return maintenance-service value (e.g. 'dumpster-maintenance:8000') or None.
-
-        When set, the restart command swaps Ingress backends to this service
-        during the main pod Recreate, so users see a branded maintenance page
-        instead of a bare 502.
-        """
-        return self.obj.get("maintenance-service")
-
-    def get_external_services(self) -> typing.Dict[str, typing.Dict]:
-        """Return external-services config from spec.
-
-        Each entry maps a service name to its routing config:
-        - host mode: {host: "example.com", port: 443}
-          → ExternalName k8s Service (DNS CNAME)
-        - selector mode: {selector: {app: "foo"}, namespace: "ns", port: 443}
-          → Headless Service + Endpoints (cross-namespace routing to mock pod)
-        """
-        return self.obj.get(constants.external_services_key, {})
-
-    def get_ca_certificates(self) -> typing.List[str]:
-        """Return list of CA certificate file paths to trust.
-
-        Used in testing specs to inject mkcert root CAs so containers
-        trust TLS certs on mock services. Files are mounted into all
-        containers at /etc/ssl/certs/ and NODE_EXTRA_CA_CERTS is set.
-        Production specs omit this key entirely.
-        """
-        return self.obj.get(constants.ca_certificates_key, [])
-
    def is_docker_deployment(self):
        return self.get_deployment_type() in [constants.compose_deploy_type]
@@ -19,7 +19,7 @@ from pathlib import Path
 from urllib.parse import urlparse
 from tempfile import NamedTemporaryFile

-from stack_orchestrator.util import error_exit, global_options2, get_yaml
+from stack_orchestrator.util import error_exit, global_options2
 from stack_orchestrator.deploy.deployment_create import init_operation, create_operation
 from stack_orchestrator.deploy.deploy import create_deploy_context
 from stack_orchestrator.deploy.deploy_types import DeployCommandContext
@@ -41,23 +41,19 @@ def _fixup_container_tag(deployment_dir: str, image: str):
 def _fixup_url_spec(spec_file_name: str, url: str):
    # url is like: https://example.com/path
    parsed_url = urlparse(url)
+    http_proxy_spec = f"""
+  http-proxy:
+    - host-name: {parsed_url.hostname}
+      routes:
+        - path: '{parsed_url.path if parsed_url.path else "/"}'
+          proxy-to: webapp:80
+    """
    spec_file_path = Path(spec_file_name)
-    yaml = get_yaml()
    with open(spec_file_path) as rfile:
-        contents = yaml.load(rfile)
-    contents.setdefault("network", {})["http-proxy"] = [
-        {
-            "host-name": parsed_url.hostname,
-            "routes": [
-                {
-                    "path": parsed_url.path if parsed_url.path else "/",
-                    "proxy-to": "webapp:80",
-                }
-            ],
-        }
-    ]
+        contents = rfile.read()
+        contents = contents + http_proxy_spec
    with open(spec_file_path, "w") as wfile:
-        yaml.dump(contents, wfile)
+        wfile.write(contents)


 def create_deployment(
@@ -75,8 +75,6 @@ def get_parsed_stack_config(stack):

 def get_pod_list(parsed_stack):
    # Handle both old and new format
-    if "pods" not in parsed_stack or not parsed_stack["pods"]:
-        return []
    pods = parsed_stack["pods"]
    if type(pods[0]) is str:
        result = pods
@@ -105,7 +103,7 @@ def get_job_list(parsed_stack):

 def get_plugin_code_paths(stack) -> List[Path]:
    parsed_stack = get_parsed_stack_config(stack)
-    pods = parsed_stack.get("pods") or []
+    pods = parsed_stack["pods"]
    result: Set[Path] = set()
    for pod in pods:
        if type(pod) is str:
@@ -155,16 +153,15 @@ def resolve_job_compose_file(stack, job_name: str):
        if proposed_file.exists():
            return proposed_file
        # If we don't find it fall through to the internal case
-    data_dir = Path(__file__).absolute().parent.joinpath("data")
-    compose_jobs_base = data_dir.joinpath("compose-jobs")
+    # TODO: Add internal compose-jobs directory support if needed
+    # For now, jobs are expected to be in external stacks only
+    compose_jobs_base = Path(stack).parent.parent.joinpath("compose-jobs")
    return compose_jobs_base.joinpath(f"docker-compose-{job_name}.yml")


 def get_pod_file_path(stack, parsed_stack, pod_name: str):
-    pods = parsed_stack.get("pods") or []
+    pods = parsed_stack["pods"]
    result = None
-    if not pods:
-        return result
    if type(pods[0]) is str:
        result = resolve_compose_file(stack, pod_name)
    else:
@@ -192,9 +189,9 @@ def get_job_file_path(stack, parsed_stack, job_name: str):


 def get_pod_script_paths(parsed_stack, pod_name: str):
-    pods = parsed_stack.get("pods") or []
+    pods = parsed_stack["pods"]
    result = []
-    if not pods or not type(pods[0]) is str:
+    if not type(pods[0]) is str:
        for pod in pods:
            if pod["name"] == pod_name:
                pod_root_dir = os.path.join(
@@ -210,9 +207,9 @@ def get_pod_script_paths(parsed_stack, pod_name: str):


 def pod_has_scripts(parsed_stack, pod_name: str):
-    pods = parsed_stack.get("pods") or []
+    pods = parsed_stack["pods"]
    result = False
-    if not pods or type(pods[0]) is str:
+    if type(pods[0]) is str:
        result = False
    else:
        for pod in pods:
@@ -141,35 +141,28 @@ echo "$test_config_file_changed_content" > "$test_config_file"
 test_unchanged_config="$test_deployment_dir/config/test/script.sh"

 # Modify spec file to simulate an update
-sed -i.bak 's/CERC_TEST_PARAM_3: FAST/CERC_TEST_PARAM_3: FASTER/' $test_deployment_spec
+sed -i.bak 's/CERC_TEST_PARAM_3:/CERC_TEST_PARAM_3: FASTER/' $test_deployment_spec

-# Save config.env before update (to verify it gets backed up)
+# Create/modify config.env to test it isn't overwritten during sync
 config_env_file="$test_deployment_dir/config.env"
+config_env_persistent_content="PERSISTENT_VALUE=should-not-be-overwritten-$(date +%s)"
+echo "$config_env_persistent_content" >> "$config_env_file"
 original_config_env_content=$(<$config_env_file)

 # Run sync to update deployment files without destroying data
 $TEST_TARGET_SO --stack test deploy create --spec-file $test_deployment_spec --deployment-dir $test_deployment_dir --update

-# Verify config.env was regenerated from spec (reflects the FASTER change)
+# Verify config.env was not overwritten
 synced_config_env_content=$(<$config_env_file)
-if [[ "$synced_config_env_content" == *"CERC_TEST_PARAM_3=FASTER"* ]]; then
-    echo "deployment update test: config.env regenerated from spec - passed"
+if [ "$synced_config_env_content" == "$original_config_env_content" ]; then
+    echo "deployment update test: config.env preserved - passed"
 else
-    echo "deployment update test: config.env not regenerated - FAILED"
-    echo "Expected CERC_TEST_PARAM_3=FASTER in config.env"
+    echo "deployment update test: config.env was overwritten - FAILED"
+    echo "Expected: $original_config_env_content"
    echo "Got: $synced_config_env_content"
    exit 1
 fi

-# Verify old config.env was backed up
-config_env_backup="${config_env_file}.bak"
-if [ -f "$config_env_backup" ]; then
-    echo "deployment update test: config.env backed up - passed"
-else
-    echo "deployment update test: config.env backup not created - FAILED"
-    exit 1
-fi
-
 # Verify the spec file was updated in deployment dir
 updated_deployed_spec=$(<$test_deployment_dir/spec.yml)
 if [[ "$updated_deployed_spec" == *"FASTER"* ]]; then
@@ -105,15 +105,6 @@ fi
 # Add a config file to be picked up by the ConfigMap before starting.
 echo "dbfc7a4d-44a7-416d-b5f3-29842cc47650" > $test_deployment_dir/configmaps/test-config/test_config

-# Add secrets to the deployment spec (references a pre-existing k8s Secret by name).
-# deploy init already writes an empty 'secrets: {}' key, so we replace it
-# rather than appending (ruamel.yaml rejects duplicate keys).
-deployment_spec_file=${test_deployment_dir}/spec.yml
-sed -i 's/^secrets: {}$/secrets:\n  test-secret:\n    - TEST_SECRET_KEY/' ${deployment_spec_file}
-
-# Get the deployment ID for kubectl queries
-deployment_id=$(cat ${test_deployment_dir}/deployment.yml | cut -d ' ' -f 2)
-
 echo "deploy create output file test: passed"
 # Try to start the deployment
 $TEST_TARGET_SO deployment --dir $test_deployment_dir start
@@ -175,71 +166,12 @@ else
    delete_cluster_exit
 fi

-# --- New feature tests: namespace, labels, jobs, secrets ---
-
-# Check that the pod is in the deployment-specific namespace (not default)
-ns_pod_count=$(kubectl get pods -n laconic-${deployment_id} -l app=${deployment_id} --no-headers 2>/dev/null | wc -l)
-if [ "$ns_pod_count" -gt 0 ]; then
-    echo "namespace isolation test: passed"
-else
-    echo "namespace isolation test: FAILED"
-    echo "Expected pod in namespace laconic-${deployment_id}"
-    delete_cluster_exit
-fi
-
-# Check that the stack label is set on the pod
-stack_label_count=$(kubectl get pods -n laconic-${deployment_id} -l app.kubernetes.io/stack=test --no-headers 2>/dev/null | wc -l)
-if [ "$stack_label_count" -gt 0 ]; then
-    echo "stack label test: passed"
-else
-    echo "stack label test: FAILED"
-    delete_cluster_exit
-fi
-
-# Check that the job completed successfully
-for i in {1..30}; do
-    job_status=$(kubectl get job ${deployment_id}-job-test-job -n laconic-${deployment_id} -o jsonpath='{.status.succeeded}' 2>/dev/null || true)
-    if [ "$job_status" == "1" ]; then
-        break
-    fi
-    sleep 2
-done
-if [ "$job_status" == "1" ]; then
-    echo "job completion test: passed"
-else
-    echo "job completion test: FAILED"
-    echo "Job status.succeeded: ${job_status}"
-    delete_cluster_exit
-fi
-
-# Check that the secrets spec results in an envFrom secretRef on the pod
-secret_ref=$(kubectl get pod -n laconic-${deployment_id} -l app=${deployment_id} \
-    -o jsonpath='{.items[0].spec.containers[0].envFrom[?(@.secretRef.name=="test-secret")].secretRef.name}' 2>/dev/null || true)
-if [ "$secret_ref" == "test-secret" ]; then
-    echo "secrets envFrom test: passed"
-else
-    echo "secrets envFrom test: FAILED"
-    echo "Expected secretRef 'test-secret', got: ${secret_ref}"
-    delete_cluster_exit
-fi
-
-# Stop then start again and check the volume was preserved.
-# Use --skip-cluster-management to reuse the existing kind cluster instead of
-# destroying and recreating it (which fails on CI runners due to stale etcd/certs
-# and cgroup detection issues).
-# Use --delete-volumes to clear PVs so fresh PVCs can bind on restart.
-# Bind-mount data survives on the host filesystem; provisioner volumes are recreated fresh.
-$TEST_TARGET_SO deployment --dir $test_deployment_dir stop --delete-volumes --skip-cluster-management
-# Wait for the namespace to be fully terminated before restarting.
-# Without this, 'start' fails with 403 Forbidden because the namespace
-# is still in Terminating state.
-for i in {1..60}; do
-    if ! kubectl get namespace laconic-${deployment_id} 2>/dev/null | grep -q .; then
-        break
-    fi
-    sleep 2
-done
-$TEST_TARGET_SO deployment --dir $test_deployment_dir start --skip-cluster-management
+# Stop then start again and check the volume was preserved
+$TEST_TARGET_SO deployment --dir $test_deployment_dir stop
+# Sleep a bit just in case
+# sleep for longer to check if that's why the subsequent create cluster fails
+sleep 20
+$TEST_TARGET_SO deployment --dir $test_deployment_dir start
 wait_for_pods_started
 wait_for_log_output
 sleep 1
@@ -252,9 +184,8 @@ else
    delete_cluster_exit
 fi

-# Provisioner volumes are destroyed when PVs are deleted (--delete-volumes on stop).
-# Unlike bind-mount volumes whose data persists on the host, provisioner storage
-# is gone, so the volume appears fresh after restart.
+# These volumes will be completely destroyed by the kind delete/create, because they lived inside
+# the kind container.  So, unlike the bind-mount case, they will appear fresh after the restart.
 log_output_11=$( $TEST_TARGET_SO deployment --dir $test_deployment_dir logs )
 if [[ "$log_output_11" == *"/data2 filesystem is fresh"* ]]; then
    echo "Fresh provisioner volumes test: passed"
@@ -206,7 +206,7 @@ fi
 # The deployment's pod should be scheduled onto node: worker3
 # Check that's what happened
 # Get get the node onto which the stack pod has been deployed
-deployment_node=$(kubectl get pods -n laconic-${deployment_id} -l app=${deployment_id} -o=jsonpath='{.items..spec.nodeName}')
+deployment_node=$(kubectl get pods -l app=${deployment_id} -o=jsonpath='{.items..spec.nodeName}')
 expected_node=${deployment_id}-worker3
 echo "Stack pod deployed to node: ${deployment_node}"
 if [[ ${deployment_node} == ${expected_node} ]]; then
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 # TODO: handle ARM
-curl --silent -Lo ./kind https://kind.sigs.k8s.io/dl/v0.25.0/kind-linux-amd64
+curl --silent -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64
 chmod +x ./kind
 mv ./kind /usr/local/bin
@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 # TODO: handle ARM
-# Pin kubectl to match Kind's default k8s version (v1.31.x)
-curl --silent -LO "https://dl.k8s.io/release/v1.31.2/bin/linux/amd64/kubectl"
+curl --silent -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
 chmod +x ./kubectl
 mv ./kubectl /usr/local/bin
@@ -1,53 +0,0 @@
-#!/bin/bash
-# Run a test suite locally in an isolated venv.
-#
-# Usage:
-#   ./tests/scripts/run-test-local.sh <test-script>
-#
-# Examples:
-#   ./tests/scripts/run-test-local.sh tests/webapp-test/run-webapp-test.sh
-#   ./tests/scripts/run-test-local.sh tests/smoke-test/run-smoke-test.sh
-#   ./tests/scripts/run-test-local.sh tests/k8s-deploy/run-deploy-test.sh
-#
-# The script creates a temporary venv, installs shiv, builds the laconic-so
-# package, runs the requested test, then cleans up.
-
-set -euo pipefail
-
-if [ $# -lt 1 ]; then
-  echo "Usage: $0 <test-script> [args...]"
-  exit 1
-fi
-
-TEST_SCRIPT="$1"
-shift
-
-if [ ! -f "$TEST_SCRIPT" ]; then
-  echo "Error: $TEST_SCRIPT not found"
-  exit 1
-fi
-
-REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-VENV_DIR=$(mktemp -d /tmp/so-test-XXXXXX)
-
-cleanup() {
-  echo "Cleaning up venv: $VENV_DIR"
-  rm -rf "$VENV_DIR"
-}
-trap cleanup EXIT
-
-cd "$REPO_DIR"
-
-echo "==> Creating venv in $VENV_DIR"
-python3 -m venv "$VENV_DIR"
-source "$VENV_DIR/bin/activate"
-
-echo "==> Installing shiv"
-pip install -q shiv
-
-echo "==> Building laconic-so package"
-./scripts/create_build_tag_file.sh
-./scripts/build_shiv_package.sh
-
-echo "==> Running: $TEST_SCRIPT $*"
-exec "./$TEST_SCRIPT" "$@"
Author	SHA1	Message	Date
A. F. DudleyandClaude Opus 4.5	5a0f573b0e	Allow relative volume paths for k8s-kind deployments Lint Checks / Run linter (push) Successful in 13s Details For k8s-kind, relative paths (e.g., ./data/rpc-config) are resolved to $DEPLOYMENT_DIR/path by _make_absolute_host_path() during kind config generation. This provides Docker Host persistence that survives cluster restarts. Previously, validation threw an exception before paths could be resolved, making it impossible to use relative paths for persistent storage. Changes: - deployment_create.py: Skip relative path check for k8s-kind - cluster_info.py: Allow relative paths to reach PV generation - docs/deployment_patterns.md: Document volume persistence patterns Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 23:26:13 -05:00
A. F. Dudley	ee89f9e87d	Fix repo root path calculation (4 parents from stack path) Lint Checks / Run linter (push) Successful in 14s Details	2026-02-02 22:49:19 -05:00
A. F. DudleyandClaude Opus 4.5	600eb93b4d	Add --spec-file option to restart and auto-detect GitOps spec Lint Checks / Run linter (push) Successful in 14s Details - Add --spec-file option to specify spec location in repo - Auto-detect deployment/spec.yml in repo as GitOps location - Fall back to deployment dir if no repo spec found Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 22:48:19 -05:00
A. F. DudleyandClaude Opus 4.5	ca3153bb78	Fix restart command for GitOps deployments Lint Checks / Run linter (push) Successful in 13s Details - Remove init_operation() from restart - don't regenerate spec from commands.py defaults, use existing git-tracked spec.yml instead - Add docs/deployment_patterns.md documenting GitOps workflow - Add pre-commit rule to CLAUDE.md - Fix line length issues in helpers.py Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 22:18:19 -05:00
A. F. DudleyandClaude Opus 4.5	be334ca39f	Use docker for etcd existence check (root-owned dir) Lint Checks / Run linter (push) Successful in 13s Details The etcd directory is root-owned, so shell test -f fails. Use docker with volume mount to check file existence. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 19:31:45 -05:00
A. F. DudleyandClaude Opus 4.5	0213ec5d7d	Keep timestamped backup of etcd forever Lint Checks / Run linter (push) Successful in 15s Details Create member.backup-YYYYMMDD-HHMMSS before cleaning. Each cluster recreation creates a new backup, preserving history. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 19:30:13 -05:00
A. F. DudleyandClaude Opus 4.5	a4d8592815	Preserve original etcd backup until restore is verified Lint Checks / Run linter (push) Successful in 14s Details Move original to .bak, move new into place, then delete bak. If anything fails before the swap, original remains intact. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 19:28:53 -05:00
A. F. DudleyandClaude Opus 4.5	8d6e50b3ae	Use whitelist approach for etcd cleanup Lint Checks / Run linter (push) Successful in 14s Details Instead of trying to delete specific stale resources (blacklist), keep only the valuable data (caddy TLS certs) and delete everything else. This is more robust as we don't need to maintain a list of all possible stale resources. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 19:27:59 -05:00
A. F. DudleyandClaude Opus 4.5	51e65857b9	Fix etcd cleanup to use docker for root-owned files Lint Checks / Run linter (push) Successful in 14s Details Use docker containers with volume mounts to handle all file operations on root-owned etcd directories, avoiding the need for sudo on the host. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 19:22:41 -05:00
A. F. DudleyandClaude Opus 4.5	ba9f51116d	Clear stale CNI resources from persisted etcd before cluster creation Lint Checks / Run linter (push) Successful in 14s Details When etcd is persisted (for certificate backup) and a cluster is recreated, kind tries to install CNI (kindnet) fresh but the persisted etcd already has those resources, causing 'AlreadyExists' errors and cluster creation failure. This fix: - Detects etcd mount path from kind config - Before cluster creation, clears stale CNI resources (kindnet, coredns) - Preserves certificate and other important data Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 19:21:00 -05:00
A. F. DudleyandClaude Opus 4.5	5214bc8c0c	Fix Caddy ingress ACME email and RBAC issues Lint Checks / Run linter (push) Successful in 14s Details - Add acme_email_key constant for spec.yml parsing - Add get_acme_email() method to Spec class - Modify install_ingress_for_kind() to patch ConfigMap with email - Pass acme-email from spec to ingress installation - Add 'delete' verb to leases RBAC for certificate lock cleanup The acme-email field in spec.yml was previously ignored, causing Let's Encrypt to fail with "unable to parse email address". The missing delete permission on leases caused lock cleanup failures. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-02 19:13:10 -05:00
A. F. DudleyandClaude Opus 4.5	10716e9d44	feat(deploy): add deployment restart command Add `laconic-so deployment restart` command that: - Pulls latest code from stack git repository - Regenerates spec.yml from stack's commands.py - Verifies DNS if hostname changed (with --force to skip) - Syncs deployment directory preserving cluster ID and data - Stops and restarts deployment with --skip-cluster-management Also stores stack-source path in deployment.yml during create for automatic stack location on restart. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-31 19:05:27 -05:00
				`@@ -1 +0,0 @@`
				`{"project": "stack-orchestrator", "prefix": "so"}`