moby/swarmkit@8af8c42...1a0ebd4

relevant changes:

• Allow using Configs as CredentialSpecs swarmkit#2771 Allow using Configs as CredentialSpecs
• Make Service.UpdateStatus non-ambiguous swarmkit#2804 Make Service.UpdateStatus non-ambiguous
• Refactor condition in restart supervisor swarmkit#2805 Refactor condition in restart supervisor
• api: add BindOptions.NonRecursive swarmkit#2780 api: add BindOptions.NonRecursive
  • related to mount: add BindOptions.NonRecursive (API v1.40) #38003
• Fix possible panic if NetworkConfig is nil swarmkit#2790 Fix possible panic if NetworkConfig is nil
• Include old error-message for backward compatibility swarmkit#2797 Include old error-message for backward compatibility
  • related to Return correct error-codes on conflicting names swarmkit#2779 / Service create API returns 5xx status instead of 4xx #38140 / API: Add test for status code on conflicting service names #38142

See description below for the original PR description (before swarmkit bump)

In situations where only annotations of a service were updated, SwarmKit never marks a service as UpdateStateUpdating; the service's UpdateStatus is set to nil, and never updated after.

Because of this, it's not possible to verify if the update actually happened (unless comparing the services Version before and after).

This patch modifies the SwarmKit vendored code to try to make this situation non-ambigious, and mark the services as "updated" in all cases.

Relates to #38499 (comment) :

Looking at that code; #38499 (comment)

As part of the Service update, controlapi.UpdateService() sets Updatestatus to nil to indicate that an update is in progress; after that the updated service is written to the store (store.UpdateService()), which updates the UpdatedAt and Version.

Updater.Run() checks if any tasks are "dirty" and need updating; https://github.com/docker/swarmkit/blob/486ad69951868792367a503042ef3f55b399cc40/manager/orchestrator/update/updater.go#L137-L141

	var dirtySlots []orchestrator.Slot
	for _, slot := range slots {
		if u.isSlotDirty(slot) {
			dirtySlots = append(dirtySlots, slot)
		}
	}

Some changes on a service don't require updates to the task (container); to check if updates are needed, these functions are called:

• Updater.isSlotDirty()
  • -> Updater.isTaskDirty
    • -> orchestrator.IsTaskDirty()

If changes are needed, len(dirtySlots) > 0, in which case and update is started (if no update is in progress yet). From that part of the code, it's clear that service.UpdateStatus == nil is required to even consider starting an update. Updater.startUpdate() is called, which sets the service's UpdateStatus to UpdateStatus_UPDATING, and sets the UpdateStatus.StartedAt to the current time.

However, in case of the service-label update, no updates to the tasks are needed, so len(dirtySlots) == 0; in that case, no action is needed, given that no update (or "rollback") was ever started for this. In that case, the Service.UpdateStatus is not updated, so remains nil

	// Abort immediately if all tasks are clean.
	if len(dirtySlots) == 0 {
		if service.UpdateStatus != nil &&
			(service.UpdateStatus.State == api.UpdateStatus_UPDATING ||
				service.UpdateStatus.State == api.UpdateStatus_ROLLBACK_STARTED) {
			u.completeUpdate(ctx, service.ID)
		}
		return
	}

Even if we would skip the check (if an updated or rollback was started), update.completeUpdate() checks service.UpdateStatus. If service.UpdateStatus == nil, it assumes that another update was started, so the service.UpdateStatus is not updated;

	if service.UpdateStatus == nil {
		// The service was changed since we started this update
		return nil
	}

Based on the above, it looks like service.UpdateStatus == nil is ambiguous; as it can either be;

• An update was triggered, but no action was required (in which case it's equal to UpdateStatus_COMPLETED or UpdateStatus_ROLLBACK_COMPLETED)
• An update was triggered, but the actual update was not yet started

I think we can make it non-ambiguous if we set the status to UpdateStatus_COMPLETED if there are no tasks to update (len(dirtySlots) == 0); this requires a change to Updater.Run() (change the check), and to update.completeUpdate()