[scotwells]

Requested by Scot Schuchert-Wells · project thread

Restarting one location of a workload failed with a permission error for project users, while restarting every location worked. The location restart edited the workload's deployments directly, which project users can't write, and which the workload controller overwrites on its next reconcile anyway. It now records the restart on the Workload itself, and the controller rolls only the deployments at that location. A location restart therefore needs the same permission as a full restart, with no RBAC change.

Fixes #487

How it works

• restart --location <loc> sets location-restart.compute.datumapis.com/<loc> (an RFC3339 timestamp) on the Workload's metadata, after checking the workload has a deployment there.
• The workload controller copies that value into compute.datumapis.com/locationRestartedAt on the template of the deployments at that location only. It's part of the template hash, so it triggers the same ordered in-place roll as a full restart.
• The Workload's own template is untouched, so other locations don't roll.
• A location name too long to fit an annotation key is rejected with a clear error.

Test plan

• Unit test: a location restart updates only the Workload and never writes a deployment
• Unit test: the controller stamps the restart on the matching location's deployment only
• make test and golangci-lint pass
• After merge, a project user restarts one location in staging and only that location rolls

---

Generated by Claude Code

[ecv]

Approve. A location restart is now a Workload annotation that the controller reads by exact key, only for locations the Workload's placements resolve to, and copies into one fixed template annotation of that location's deployment. It needs only Workload update, less than the old path, and cannot reach another location, Workload or project.

Follow-ups:

• The annotation is never cleared. A stale value does not re-roll, but deleting it later rolls that location once more. Clear it, or document that.
• restartLocation does a full Update of a Workload read earlier, so a concurrent edit returns 409 instead of retrying. A merge patch of the one annotation avoids that.
• The test covers one location; nothing tests a key naming a location the Workload does not place in.

[kevwilliams]

Verified the restart stamp lands on a deep-copied template inside the full-template hash, annotation-only Workload changes still reconcile, and it merges cleanly with #640.