Mark read-only controllers as read-only

Some controllers will be effectively read-only, because

 - they are under control of the system (e.g., addons)
 - they don't appear in the git repo, so we can't write changes
 - the git repo isn't ready, or hasn't been supplied

So that we can treat these specially, mark them as read-only in the
ListServices API result.

On backwards compatibility: I have added this into the v6 API, because
it's a hint to the API client; the zero value indicates it is
_probably_ OK to attempt whatever you want to attempt. Since prior
daemon code wouldn't proceed if the git repo wasn't ready, that is
more often than not the case.

api/v6/api.go

@@ -16,9 +16,23 @@ type ImageStatus struct {
 	Containers []Container
 }
 
+// ReadOnlyReason enumerates the reasons that a controller is
+// considered read-only. The zero value is considered "OK", since the
+// zero value is what prior versions of the daemon will effectively
+// send.
+type ReadOnlyReason string
+
+const (
+	ReadOnlyOK      ReadOnlyReason = ""
+	ReadOnlyMissing ReadOnlyReason = "NotInRepo"
+	ReadOnlySystem  ReadOnlyReason = "System"
+	ReadOnlyNoRepo  ReadOnlyReason = "NoRepo"
+)
+
 type ControllerStatus struct {
 	ID         flux.ResourceID
 	Containers []Container
+	ReadOnly   ReadOnlyReason `json:",omitempty"`
 	Status     string
 	Automated  bool
 	Locked     bool

cluster/cluster.go

@@ -29,6 +29,10 @@ type Cluster interface {
 type Controller struct {
 	ID     flux.ResourceID
 	Status string // A status summary for display
+	// Is the controller considered read-only because it's under the
+	// control of the platform. In the case of Kibernetes, we simply
+	// omit these controllers; but this may not always be the case.
+	IsSystem bool
 
 	Containers ContainersOrExcuse
 }

daemon/daemon.go

@@ -76,24 +76,35 @@ func (d *Daemon) ListServices(ctx context.Context, namespace string) ([]v6.Contr
 	}
 
 	var services policy.ResourceMap
+	var noRepo bool
 	err = d.WithClone(ctx, func(checkout *git.Checkout) error {
 		var err error
 		services, err = d.Manifests.ServicesWithPolicies(checkout.ManifestDir())
 		return err
 	})
 	switch {
 	case err == git.ErrNotReady:
-		services = policy.ResourceMap{}
+		noRepo = true
 	case err != nil:
 		return nil, errors.Wrap(err, "getting service policies")
 	}
 
 	var res []v6.ControllerStatus
 	for _, service := range clusterServices {
-		policies := services[service.ID]
+		var readonly v6.ReadOnlyReason
+		policies, ok := services[service.ID]
+		switch {
+		case noRepo:
+			readonly = v6.ReadOnlyNoRepo
+		case !ok:
+			readonly = v6.ReadOnlyMissing
+		case service.IsSystem:
+			readonly = v6.ReadOnlySystem
+		}
 		res = append(res, v6.ControllerStatus{
 			ID:         service.ID,
 			Containers: containers2containers(service.ContainersOrNil()),
+			ReadOnly:   readonly,
 			Status:     service.Status,
 			Automated:  policies.Contains(policy.Automated),
 			Locked:     policies.Contains(policy.Locked),