)]}' { "log": [ { "commit": "0e057feb0b5c932e1b86ba769ad92bfc9bfdcd65", "tree": "f4ee473eacbf446c85f553ad417a8e4902c07bb7", "parents": [ "87bf0bf46c83f3a59536f577171985b4fa1db1eb" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 16:19:10 2022 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 19:51:25 2022 +0000" }, "message": "metropolis: use hybrid consoles\n\nThis enables two consoles, one on the serial port and one on the\non-screen EFI framebuffer, if it exists. It also enables quiet mode\nwhich stops Linux from logging purely informational messages to\nthe console making it hard to see our own output.\n\nChange-Id: I25499a1dda8cf0c566878ac24877bf19b64ddda6\nReviewed-on: https://review.monogon.dev/c/monogon/+/517\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "87bf0bf46c83f3a59536f577171985b4fa1db1eb", "tree": "2d1e3dc9ba4346a3ee79fb7e70727b973ad2aab0", "parents": [ "73c3fc11b053505a50c29feee878eee0ee2608a2" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 14:27:36 2022 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 16:46:06 2022 +0000" }, "message": "m/n/core/network/dhcp4c: fix logic bug in DNSServers\n\nThis previously accepted all non-undefined (0.0.0.0) IPs as servers on\naccount of the `|| ip4Num !\u003d 0` in the condition. That\u0027s unnecessary\nanyways, so let\u0027s drop it.\nWhile we\u0027re in there I also changed the deduplicating map from a\nmap[uint32]struct{} to a map[uint32]bool, making the code a bit shorter.\n\nChange-Id: Ic15cb96217a300913ebc58580d4314a6449da923\nReviewed-on: https://review.monogon.dev/c/monogon/+/516\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "73c3fc11b053505a50c29feee878eee0ee2608a2", "tree": "848b4bcf51a81fdb6d5780e43ccb7329ce7ecd5c", "parents": [ "8b786897cc419483fa586fd620c3d725d7bd6a95" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 14:24:11 2022 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 16:46:06 2022 +0000" }, "message": "m/n/core/network: fix mistake in requested DHCP options\n\nThis previously requested NameServer (option 5), not DomainNameServer\n(option 6), which meant that on DHCP servers only returning explicitly-\nrequested options we got no DNS servers. While we\u0027re in there also add\nClasslessStaticRoutes to the requested options as a hint that we can now\nprocess that option.\n\nChange-Id: I738c33abbf572c2b7da4e36d4a6cae5b971c830c\nReviewed-on: https://review.monogon.dev/c/monogon/+/515\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "8b786897cc419483fa586fd620c3d725d7bd6a95", "tree": "1e4f582b8c2272b73970e4727171175320aeab7c", "parents": [ "57d06a7cfa461f367d4362ccecf4a2d66068a1f9" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 14:21:16 2022 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jan 13 16:46:06 2022 +0000" }, "message": "m/n/core: only warn if no TPM 2.0 has been found\n\nCurrently the TPM is basically unused. The only user is the generator of\nnode and cluster unlock keys, which get fed with both TPM and local entropy\nwhich marginally increases security.\nThis converts a missing TPM 2.0 into a warning and falls back to generating\nboth of those keys purely with Linux entropy, allowing Metropolis to boot\non hardware without a TPM 2.0.\n\nChange-Id: I910f9768ede554e5ec2c3a35079a6799d1ee9c8c\nReviewed-on: https://review.monogon.dev/c/monogon/+/514\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "edffbb5a67e79fdb075c382995eaa0b52a16bfdd", "tree": "7941e1dfb40d13b00dbcd1071c3e7ecfdaee3963", "parents": [ "950c26d52a08499ebf45ee2b4b0e46d3bea66dee" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Jan 11 15:27:22 2022 +0100" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Wed Jan 12 15:20:32 2022 +0000" }, "message": "m/{t,n}/installer: move to m/installer\n\nChange-Id: I8fd15f1fa1e151369df251d1469e84cfeffd26fd\nReviewed-on: https://review.monogon.dev/c/monogon/+/510\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "cdcc739c88c98e1e174dda4094362c4d9a70db18", "tree": "8af9ddccecaa419d98df0442548b11c858f3e3a1", "parents": [ "9a66b18b911e4551c708b4b4fffbe9e89f19d232" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Wed Dec 08 15:34:53 2021 +0100" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Jan 03 11:37:58 2022 +0000" }, "message": "m/n/installer: reboot on fatal errors\n\nCurrently irrecoverable errors are handled by log.Fatal, which calls\nos.Exit after printing the error message. As this kills the init\nprocess, it leads the kernel to panic and print a long call trace,\nobscuring the true cause of trouble. The kernel then reboots\nimmediately, as it is configured to do so, making it impossible to\nread the logs off the screen when using a graphical console.\n\nThis patch makes the installer hang after displaying status\ninformation.\n\nChange-Id: Ib6a7582b621fd5072e636242f8279be2a831c3f3\nReviewed-on: https://review.monogon.dev/c/monogon/+/488\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "1de8b1845e75dc1e020df21b997b2d6fc66fb65e", "tree": "4a41005b1931aa13c3ed4a1b0732de31482a6eb8", "parents": [ "367f759f54e59b24b55024c8070513f9f7e6f4c1" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Dec 21 17:15:18 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Dec 22 15:57:16 2021 +0000" }, "message": "m/node: pass node identity into k8s\n\nThis plumbs through the node identity to K8s as an identity.Node\nobject and gets rid of the os.Hostname invocation that passed around\nthis data out-of-band. It also changes everything in its path to use\nthe newer identity.Node object instead of a plain string so that the\nMetropolis Identity CA is more accessible.\n\nChange-Id: I6db8e1db7e333c0ea364aefd61c27bf50acc25f3\nReviewed-on: https://review.monogon.dev/c/monogon/+/505\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "97783222fe1b7585af74ee58206b0f614da68975", "tree": "1a21deb8bd9f51019a3d229e476b49d357356162", "parents": [ "e2e0371cd685fcfa600a9ad49b29c91fba4a1261" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Dec 14 16:04:26 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Fri Dec 17 13:45:13 2021 +0000" }, "message": "m: {cli,installer}: runfiles through datafile.MustGet\n\nThis implements datafile, a small library to more ergonomically resolve\nBazel runfiles:\n\n1. It also works in cases where a tool doesn\u0027t run through `bazel run`.\n2. It provides a MustGet wrapper which returns already read bytes and\n removes some boilerplate at the callsite.\n3. It allows us to extend the library in the future to prepare special\n \u0027self-contained\u0027 builds of some binaries, for example to bundle the\n installer kernel in metroctl.\n\nWe then use this library to simplify the installer and installer tests.\nIn the installer, we technically remove the ability to specify arbitrary\nkernels/bundles on the command line, but is this functionality actually\nuseful?\n\nChange-Id: I46155b9951729c810e0d36930b470edfdfd82943\nReviewed-on: https://review.monogon.dev/c/monogon/+/484\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "098a863707da49b0338df29bb0c25826e027d0b5", "tree": "8a7c2c4b1535fca9d23169ee42d2521d42723707", "parents": [ "f05e80af8721a0b0ccf5425c4775695d84d09fdf" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Wed Dec 08 15:51:24 2021 +0100" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Thu Dec 16 17:04:15 2021 +0000" }, "message": "m/t/installer: deflake by silencing kernel logs\n\nThe installer test was failing due to the success flag getting broken\nin two by the kernel logs, like this:\n\u003eTestOS launched successfully! _TESTOS_LAUNCH_SUC[ 0.963289] kvm:\n\u003eexiting hardware virtualizationCESS_\n\nThis change addresses this problem by setting an adequate loglevel for\nboth the installer and testos kernels.\n\nm/t/installer/BUILD.bazel now defines its own unified kernel image\ntarget with a custom kernel cmdline needed for test purposes.\n\nChange-Id: I43547b6c81f8a1ebc4facb841a600b155af581df\nReviewed-on: https://review.monogon.dev/c/monogon/+/464\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "f05e80af8721a0b0ccf5425c4775695d84d09fdf", "tree": "1f4f15962293b345b02ae66e588a9aad35ce2be3", "parents": [ "a9b455f2be1fb9dbda3217adb69bc0076113a814" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 12 11:53:34 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Dec 16 16:32:51 2021 +0000" }, "message": "m/n/core/consensus: refactor for reliability and multinode support\n\nThis implements a big refactor of our consensus service/runnable.\n\nFirst, we move away from the old bespoke API for retrieving the\nconsensus status (and consensus clients) into using Event Values, as the\nrest of the codebase does.\n\nSecond, we move away from the bespoke PKI library used to generate\ncertificates in-memory and then commit them to etcd into using the\nstandard metropolis pki library. We then change the bootstrap process to\nstart a PKI-less etcd instance first, generate the PKI data directly on\nthe running instance, and then restart into a fully PKI-supporting etcd\ninstance.\n\nWe also move away from using etcd-specific private keys into reusing the\nnode\u0027s private key. This makes management slightly easier, but reviewers\nshould consider the security implications of this change.\n\nFinally, we implement and test multi-member cluster support, which is\ndone by exposing an AddNode method to the newly exposed status, and a\nJoinCluster option in the node configuration.\n\nChange-Id: Iea2bf6114cb699d3792efd45d06de2fa5a48feb1\nReviewed-on: https://review.monogon.dev/c/monogon/+/466\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "9e7961b7be5a87aca8bdf6bacb1675625348c883", "tree": "f9688e8dcbaa94db8ecc7be416ab490ecc5e357f", "parents": [ "78e590504a86b38b313bdc6463cdda81f5dc8479" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Dec 15 18:47:31 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Dec 16 12:00:23 2021 +0000" }, "message": "m/node: add PortString method\n\nThis adds the PortString method to Port type as Go very commonly handles\nports as strings. Doing the conversion there avoids littering the\nint-to-string conversion all over the place.\n\nChange-Id: I7b077f697be49ac80fd81fd6d78c25080c9d7b75\nReviewed-on: https://review.monogon.dev/c/monogon/+/487\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "fdb7322f8a9061c6c57c89ee1fb4b754589802e7", "tree": "4590b3e79ba54e670c46642be4bd6e689231b150", "parents": [ "6c35e97e7da34dd8497f4d40172ecf745448ad21" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Dec 13 05:19:25 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Dec 16 11:57:45 2021 +0000" }, "message": "m/n/c/n/dhcp4c: support route configuration (including RFC 3442)\n\nThis implements support for configuring routes other than the default\nroute via our DHCP client. It extends the DHCP lease interface with a\nmethod to return canonicalized routes from a lease containing Router,\nStaticRoute or ClasslessStaticRouting options.\nIt also extends and renames the former ManageDefaultRoutes callback into\nManageRoutes and makes it use the new canonicalized routing data instead\nof just the default router.\n\nChange-Id: Ie6ec20d67c0e9cdfa6be088324b42e0d811e81e9\nReviewed-on: https://review.monogon.dev/c/monogon/+/482\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "6c35e97e7da34dd8497f4d40172ecf745448ad21", "tree": "17e023a1849f629a641c43eff27e4dfdc7a9c04a", "parents": [ "999e1db0130f148ac6e79e1acbb5ee68db1dcb64" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Dec 14 03:08:23 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Dec 14 11:27:13 2021 +0000" }, "message": "metropolis: align EFI partition layout\n\nThis moves non-EFI-related data inside the ESP from under the EFI\nsubdirectory to the root. The data moved is never accessed from EFI and\nthus shouldn\u0027t be under the EFI folder. This also aligns localstorage\nwith the new layout as previously it and osimage didn\u0027t agree on a\nspecific layout, indirectly breaking the installer.\n\nChange-Id: I36bdc9782e181dafab40aaa85cc0b4eaf2448f6e\nReviewed-on: https://review.monogon.dev/c/monogon/+/483\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "e78a08987e48aa5d9f77954886b7cc544f218638", "tree": "77d91020801cf19d2979db69495e40f3aeb889d5", "parents": [ "957c5b142abf8976c212ae013e6c36c4ff80f6c8" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Oct 07 17:03:49 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Dec 09 17:51:43 2021 +0000" }, "message": "m/n/c/cluster: implement register flow\n\nChange-Id: I197cbfa96d34c9912c7fc19710db25276e7440fc\nReviewed-on: https://review.monogon.dev/c/monogon/+/454\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "957c5b142abf8976c212ae013e6c36c4ff80f6c8", "tree": "31094f33eb84f70c5c1c2310f6d9dfe683847ef4", "parents": [ "a554528f7b9658e283efae618eb474d9161e0be1" ], "author": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Sat Dec 04 01:34:40 2021 +0100" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Thu Dec 09 12:11:28 2021 +0000" }, "message": "m/node: add image_gcp rule\n\nChange-Id: I224c551d13d939ade56ddef7a7b9f5c30f7b6cff\nReviewed-on: https://review.monogon.dev/c/monogon/+/461\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "a554528f7b9658e283efae618eb474d9161e0be1", "tree": "443119f6281b390418a589b25864d8a0b99b72df", "parents": [ "612a0335e94100137d8d95cbaf43da328bfb2e80" ], "author": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Sat Dec 04 23:29:44 2021 +0100" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Wed Dec 08 19:29:07 2021 +0000" }, "message": "m/n/c/cluster: retrieve node parameters from GCP metadata\n\nThis allows configuration via GCP instance metadata.\n\nChange-Id: I56609019cef998aa779c5a602232767b920a9721\nReviewed-on: https://review.monogon.dev/c/monogon/+/462\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "612a0335e94100137d8d95cbaf43da328bfb2e80", "tree": "839adcb5b38bbf92f5bad000b44816499e324fa0", "parents": [ "290436425ac7e9f9c3a9c5a79520b48c623c95bd" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Wed Nov 17 20:04:52 2021 +0100" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Wed Dec 08 17:36:42 2021 +0000" }, "message": "efivarfs, osimage: fix boot entry handling\n\nefivarfs was updated to handle partition UUIDs in the mixed-endian\nformat [1], enabling it to produce correct boot entries. Its interface\nwas changed in the process, leading to further changes in osimage.\n\nIn addition, BootEntry.Marshal will replace any backslash with a\nforward slash in the EFI executable path.\n\n[1] https://en.wikipedia.org/wiki/Universally_unique_identifier#Encoding\n\nChange-Id: Ib8300e01fd1664d0c08bb033b1dc36addb925b20\nReviewed-on: https://review.monogon.dev/c/monogon/+/456\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "8f72b5ddae45109331258cea8af0662a608c1123", "tree": "00525a79ad1d4a0baa8e59a5aebae7767a5616d7", "parents": [ "02d69e99f0c8ccdd9f53e5bc6c2a5e4ee26cbd83" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Fri Dec 03 17:08:59 2021 +0100" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Dec 07 12:13:07 2021 +0000" }, "message": "coding style: fix error strings\n\nThe way errors are passed to log was changed according to [1].\n\n[1] https://github.com/golang/go/wiki/CodeReviewComments#error-strings\n\nChange-Id: I75194557d4f3b2f9f5e286a40fe4f0a4648eb71f\nReviewed-on: https://review.monogon.dev/c/monogon/+/458\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "0b93c8d162d9772b124a8f9d586317765bcd7de4", "tree": "33a17e3388d222a0506a3f630658cace335c172c", "parents": [ "f8ede09aea5ecd9b90213e09efd75210ce0a043c" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Nov 09 03:58:40 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Nov 30 23:00:04 2021 +0000" }, "message": "m/{t,n}/installer: use bundles and test install\n\nThis makes the installer use actual bundles and uses TestOS bundles\nto test the installation process end-to-end.\n\nChange-Id: I64fa412032796d7d7633e9944dbae727d90a863e\nReviewed-on: https://review.monogon.dev/c/monogon/+/433\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "f8ede09aea5ecd9b90213e09efd75210ce0a043c", "tree": "05e175a58fc980c13fe50df879dd157dc4e77723", "parents": [ "dcfc6787c736ae3461138224a33c5d5c560df2ff" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Nov 08 20:50:57 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Nov 30 22:29:22 2021 +0000" }, "message": "m/c/metroctl: use in-tree artifacts if called using bazel run\n\nThis allows for not specifying a bundle or installer and instead\ntaking them from the current build if running under bazel run.\nSo bazel run //metropolis/cli/metroctl -- install will automatically\nbuild and use the bundle and installer. This just changes the defaults,\nif you manually specify installer and/or bundle these are still\nrespected.\n\nChange-Id: I0676c9b28308544712c06881ad6ace2dba4cab2c\nReviewed-on: https://review.monogon.dev/c/monogon/+/425\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\n" }, { "commit": "43e2107d9b76e8c1df0974c3125878ca64f2bb61", "tree": "3dbf072846ba3439240043f6f2f161f02d18ec50", "parents": [ "cb2dcf6c3ffa2d50293faa1708fad975ea237afa" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Fri Oct 08 18:05:29 2021 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Nov 30 15:09:01 2021 +0000" }, "message": "m/{n,t}/installer: init\n\nThis adds partial implementation of the installer [1].\n\nIt needs to be integrated with the installer bundle to become\nfunctional.\n\n[1] https://github.com/monogon-dev/monogon/issues/44\n\nChange-Id: I6223e50dc02bc1ad1a8d1351b556ecba43f30a2f\nReviewed-on: https://review.monogon.dev/c/monogon/+/408\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "764a2de7911a42d57720911332a12895f0aad707", "tree": "dd0e31cee8fb5c753a762462e9eb16f776c3ec73", "parents": [ "e65731049afb6fd49da80f064fa40a28c9d5741d" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Nov 22 16:26:36 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Nov 22 20:39:51 2021 +0000" }, "message": "tree-wide: rewrite ioutil functions to their replacements\n\nThe ioutil package has been deprecated in Go 1.16 [1]. This CL removes\nall our own users of that package and rewrites them to use their\nreplacements in the os package. I initially wanted to do this with a\ngofix but because all replacements were signature-compatible I just\ndid it with a few string replaces and then ran goimports to fix up the\nimports.\n\nI intentionally didn\u0027t rewrite the patches as that would require a\ndifferent process and is IMO of less value.\n\n[1] https://github.com/golang/go/issues/42026\n\nChange-Id: Iac6663a1f1ee49f9b1c6e4b3d97e73f2c3b54a13\nReviewed-on: https://review.monogon.dev/c/monogon/+/449\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "c71efc9d3b6c9d626e752ec5e17ea6893a3fbe34", "tree": "00fc1385013f39898a3cdada31695de69a42a838", "parents": [ "a7d65e1e672f996746084afd679869518a4a2b42" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Sep 07 16:46:25 2021 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Nov 22 12:05:56 2021 +0000" }, "message": "n/b/mkimage/osimage: init\n\nCommon parts of mkimage were moved to osimage.\n\nmkimage remains in use as a frontend to osimage, with backward\ncompatible use semantics.\n\nChange-Id: I08c1c44afdf7bf0c07333ab3c6bbebf53ff4d0db\nReviewed-on: https://review.monogon.dev/c/monogon/+/324\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "a7d65e1e672f996746084afd679869518a4a2b42", "tree": "13d6955bd78a589b68297916d9215062d3c10323", "parents": [ "030a551eb6a6faa99aa184a243acffcf7c74323e" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Nov 18 17:29:49 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Nov 22 11:19:04 2021 +0000" }, "message": "m/n/c/curator: deflake leader election test\n\nThe check for proper leadership re-election was vulnerable to a race\nwhere it assumed optimistically that if a leader got re-elected, other\nnodes would have already established them as followers. This isn\u0027t\nalways the case, so we re-work the check to instead be a wait-until\nconstruct.\n\nChange-Id: I6326dad9a88f7b1ba61c218e37a73e868d722506\nReviewed-on: https://review.monogon.dev/c/monogon/+/448\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "030a551eb6a6faa99aa184a243acffcf7c74323e", "tree": "9e83f1af010b51383a69795a6143f1071d148d09", "parents": [ "cb1e4da5b3c1d2d5efa6a4495af40f8fc50c72ad" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Nov 18 16:39:39 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Nov 22 11:18:43 2021 +0000" }, "message": "m/n/c/curator: factor out node{Load,Save}\n\nThis removes some duplicated logic between RPC implementations.\n\nChange-Id: I3683ba11635a53f792def4d8dabddc09776ab427\nReviewed-on: https://review.monogon.dev/c/monogon/+/447\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "cb1e4da5b3c1d2d5efa6a4495af40f8fc50c72ad", "tree": "39b896bb35e4a4e55a03e8cff431018b8390737d", "parents": [ "1612d4b51f74e439d1efb4b8957d440d148035b7" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Nov 11 16:42:52 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Nov 22 11:18:43 2021 +0000" }, "message": "m/n/c/curator: implement Curator.CommitNode\n\nThis takes a node from STANDBY to UP. This is the last step required in\na node\u0027s registration flow.\n\nChange-Id: I6806e84abb862088335a76c42738db43aec75c62\nReviewed-on: https://review.monogon.dev/c/monogon/+/443\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "1612d4b51f74e439d1efb4b8957d440d148035b7", "tree": "c69d3d08b638ed54ef938a97166893e7b9779cf5", "parents": [ "5b60e581bdc1cd420a281e3a110367e310337850" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Nov 12 13:54:15 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Nov 22 11:18:43 2021 +0000" }, "message": "m/n/c/curator: implement Management.ApproveNode\n\nThis takes a node from NEW to STANDBY. This is the second-to-last\nstep requires in a node\u0027s regsitration flow.\n\nChange-Id: I88f9c7d2cd824c7d3182195b784a725ec9528d28\nReviewed-on: https://review.monogon.dev/c/monogon/+/442\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "5611447f05c85eb5d0b7f7c5865911b1d560ef66", "tree": "19274d1fae7747027ad2758d3027f0e09b9c599e", "parents": [ "6cefe518de0b964db90c1b10d57b8be47aa4448e" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Oct 11 14:47:54 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Nov 18 15:40:45 2021 +0000" }, "message": "m/n/c/curator: implement Management.GetNodes\n\nThis is a management call that provides detailed per-node details.\nCurrently it returns all information about all nodes, but can be then\nextended to allow filtering and selective/masked field retrieval.\n\nThis call is then used to implement a test which exercises\nCurator.NodeRegister and GetNodes.\n\nChange-Id: Ia093d9f03a4213b01acbb0fdac9714d8e7b02dd3\nReviewed-on: https://review.monogon.dev/c/monogon/+/434\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "fbd38e280916f0883263cf0b566984d3fea4ff39", "tree": "44abb583a39606b61940523e873af4d92a787be4", "parents": [ "579015afff6be9d6c87c867b0645f254b9aeb2d8" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Oct 08 14:41:16 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Nov 18 13:01:16 2021 +0000" }, "message": "m/proto: switch from CA pubkey to CA certificate in ClusterDirectory/Register\n\nA CA certificate is a strict superset of the public key, and using it\ninstead of a public key allows us to connect to the cluster securely by\nreusing standard/existing x509 CA auth, instead of having to implement a\ncheck based on just a public key.\n\nBackwards-incompatible proto change, but we\u0027re pre-MVP, and this flow is\njust being implemented.\n\nChange-Id: I014780a6ec3e5e8c6e81532531b18ad1438c8258\nReviewed-on: https://review.monogon.dev/c/monogon/+/424\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "516d300df9a34da5b39944017cebf1b11897e7a0", "tree": "b045662801001e5c53412baa6d744346892830f0", "parents": [ "c6c092be9c8774192867620d1df41c6014e20de1" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Oct 01 00:05:41 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Nov 16 14:39:15 2021 +0000" }, "message": "m/n/c/curator: implement Curator.RegisterNode\n\nThis is the \u0027Register\u0027 call from the cluster lifecycle design document.\nWe don\u0027t yet call it from node startup code, but we do exercise it in a\nCurator test.\n\nChange-Id: Ife617b148a25fc8aecb0ed15f78a758ca4538016\nReviewed-on: https://review.monogon.dev/c/monogon/+/423\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "c2e3b1b7f29708fa136e9195645b31fce530c1f0", "tree": "94d45711f78c1c1cc859e251519838350ce91938", "parents": [ "44d2ad428573bb20ee6be4b957b1abbacad50fcb" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Nov 11 11:06:41 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Nov 16 12:47:21 2021 +0000" }, "message": "WORKSPACE: bump rules_go go 0.29 and Go to 1.17.1\n\nThe changes to nogo are from rules_go being able to use go_library\ntargets as part toolchain definitions. gVisor needed to be bumped\nto be compatible with Go 1.17. It also needs a fix for us not having\nthe systemd cgroup controller.\n\nChange-Id: I058b5c68d97809a286fbe36df00e49e55874dfd5\nReviewed-on: https://review.monogon.dev/c/monogon/+/438\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "f73d8a993251c8fda30ce665c7f4eabdb7a203e3", "tree": "80d1f94ce1be04bef15b4632083ad7e2745bbcb3", "parents": [ "80861fd796e8f32e2866fa3757ff92ee186a9e8f" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Nov 02 21:19:45 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Nov 09 17:01:29 2021 +0000" }, "message": "m/n/c/network/hostsfile: implement\n\nThis implementes a dedicated runnable for maintaining hostsfile-like\nlocal state based on the node\u0027s local state and any possible cluster\ndata.\n\nThis needs to be able to be maintained by a single runnable regardless\nof the cluster enrolment process (bootstrap, register or join), and\nregardless of the state of enrolment (don\u0027t have networking data, only\nhave local networking data, have cluster state from any kind of\navailable cluster dialer).\n\nFor now this is just piped into the bootstrap logic and has no access to\ncluster data, but a planned revamp of the enrolment logic into the\nroleserver will fully integrate this with cluster information.\n\nChange-Id: Icc472a0da302109882c5a6d8b4e124a7b9af4813\nReviewed-on: https://review.monogon.dev/c/monogon/+/422\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "80861fd796e8f32e2866fa3757ff92ee186a9e8f", "tree": "3e02b5ce623b8d429f082a0e8f8a06fba546c163", "parents": [ "f758ce419a4a63261e4cacf8b8795a17d024df87" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Nov 02 22:14:06 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Nov 09 16:41:17 2021 +0000" }, "message": "m/n/c/curator: implement Watching NodesInCluster\n\nThis pipes etcd ranged watchers for nodes into a Curator RPC. This is to\nbe used by systems that need to compile information based on all/some\nnodes in the cluster, eg. when building a cluster directory or hosts\nfile with DNS mappings.\n\nThe existence of both NodeInCluster and NodesInCluster could be argued\nas unnecessary, and it might make sense to merge NodeInCluster\nfunctionality into NodesInCluster with a filter-by-node-id field. We\nshould consider doing this once the dust settles.\n\nWe also use this opportunity to write tests for Node{,s}InCluster.\n\nChange-Id: I544657b1bfe266a37230760236510024c6007c24\nReviewed-on: https://review.monogon.dev/c/monogon/+/420\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "f758ce419a4a63261e4cacf8b8795a17d024df87", "tree": "593f6821c2fe9e2c37eb9a4629e5a97650739f8c", "parents": [ "3ec8116383edfbe4aa4e04803f45a7201998ac80" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Nov 09 03:40:43 2021 +0100" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Nov 09 13:54:32 2021 +0000" }, "message": "m/node: add a crude MVP bundle\n\nSince the bundle format will likely need some more time cooking let\u0027s\njust use a quick\u0027n\u0027dirty ZIP file for now. This is explicitly not stable\nand will be replaced by the actual bundle format before release. But\nit allows us to untangle various parts of the installer machinery and\nland them while this is still cooking.\n\nChange-Id: I7ba7875232e4b9a03a4dd564f2ca02d2663f829c\nReviewed-on: https://review.monogon.dev/c/monogon/+/430\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "dc7e31c81095fe809e3bfe07bbda36a21f54464e", "tree": "20ac8760617b9aa18968b5fb7fad288aeabca6f4", "parents": [ "d32d1eaec33b9b6e8a2ce6f207892d7a2b236382" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Thu Oct 07 22:23:39 2021 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Nov 08 10:03:04 2021 +0000" }, "message": "m/node: move kernel cmdline to the unified kernel image\n\nThe upcoming installer code relies on its own params.\n\nChange-Id: I6408ffa3f14ae184e05786a48b59499ac25d8928\nReviewed-on: https://review.monogon.dev/c/monogon/+/406\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\n" }, { "commit": "8d45a0598ae83b8da89442ce8960e64f065182c7", "tree": "76fc262f260152be7be130ed2a078738e03073c2", "parents": [ "52304a8aa84604846e316e28c955b67e68c52f34" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Oct 18 17:24:24 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Nov 03 15:01:37 2021 +0000" }, "message": "m/pkg/event/etcd: implement ranged watchers\n\nThis adds a new mode of operation to etcd Values/Watchers in which a\nrange of etcd keys is watched for updates instead of a single key.\n\nThis allows the implementation of watching a collection of objects\nstored in etcd for updates, eg. the node state in the Curator.\n\nThis has been implemented within the existing API of Event Values, which\nis likely the biggest contention point of this change. An alternative\nwould be to design a separate API for multi-value use, but this should\nallow us to more easily integrate with the existing code. We make use of\nGo\u0027s options-as-varargs paradigm to not break any existing use of this\ncodebase.\n\nSome behaviour of the Get() operation in ranged context is left\nunderdefined, but none of the expected users of this codebase are\nexpected to depend on this. Once the dust settles a bit, we can attempt\nto formalize this more strongly.\n\nChange-Id: I8f84d74332765e52b9bbec04b626d00f05c23071\nReviewed-on: https://review.monogon.dev/c/monogon/+/419\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "52304a8aa84604846e316e28c955b67e68c52f34", "tree": "df8518bb50b9665af7f4897665d8aa16f4a43e7f", "parents": [ "ba7bf7dc83c15cbd94a1f71b7992df7d7fc7d752" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Oct 29 16:56:18 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Nov 03 11:36:20 2021 +0000" }, "message": "m/node: implement Port type for node ports\n\nThis allows us to use %v/%s to get a pretty port name where needed.\n\nWe also drive-by remove MasterServicePort which is a leftover from\na pre-curator cluster service implementation.\n\nChange-Id: Id8feddf87269b13dd1dad2460a015c1a7ecbc6d7\nReviewed-on: https://review.monogon.dev/c/monogon/+/418\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "6ef7f9bb94890748cc7c635f187fce7c5f497fe3", "tree": "8252a2bfde15ebc883195717762ba313978ca946", "parents": [ "da3be1bde2f7cffc518433c8f65569079a30655e" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Oct 21 13:02:40 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Oct 25 18:46:55 2021 +0000" }, "message": "m/n/core: mount efivars\n\nWe will need them for lots of upcoming things, let\u0027s mount them\nso things which need them can use them.\n\nChange-Id: I4417c370615da154bc7cb8b8804cb268d0fd617e\nReviewed-on: https://review.monogon.dev/c/monogon/+/405\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "66e589595ecbefdc1466ea5e98e9c237e3300f8e", "tree": "c5bf14131ce984dea96ee6825c12b5e3cf7a342a", "parents": [ "a1a96b454eb3c21d03b7f95f1917dd6ce1b84b8a" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:06:56 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Oct 11 13:27:02 2021 +0000" }, "message": "m/test: refactor cluster launch code, use for e2e tests\n\nThis is a light dust-off pass for the existing cluster launch code.\nNotably, we separate Metropolis-specific code into a subpackage\n(allowing us to make the package itself depend on the required\nnode/kernel images, without introducing dependency loops or unnecessary\ndependencies on the Metropolis node image).\n\nWe also make the LaunchCluster code return an already authenticated\nManagement client, and subsequent changes will use this client to add\nmore nodes to the running cluster.\n\nWe then move the E2E test to use LaunchCluster instead of LaunchNode, in\npreparation for running a multi-node cluster in the E2E test.\n\nWe also add some more log calls and clean up the existing ones to make\nit clear which subsystem (launch, launch/cluster or e2e) is respondible\nfor each message.\n\nChange-Id: I838bdc75073831fe94b9cdcef4fb3ab6bf8cba2c\nReviewed-on: https://review.monogon.dev/c/monogon/+/343\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "2f58ac0ba336ad64e5708a4bb72163e368410959", "tree": "f0047b265e47d3e934220f93147bbe663d7ac097", "parents": [ "eac8f7312382f20c17082f2871b50aea92e0a45e" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 11:47:20 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 16:07:56 2021 +0000" }, "message": "m/n/c/curator: return CA public key in GetClusterInfo\n\nThis is needed for node registration (and is generally useful data\nwhenever a caller might not be aware of the CA\u0027s public key but already\nhas access to a Management client). In theory, all callers should be\naware of the public key, but in the future some other cluster\nverification might be performed with the CA public key ignored on\nconnectivity, but used by some other logic.\n\nChange-Id: If1928435bd5606c733460eb1a4a29a6578c8c723\nReviewed-on: https://review.monogon.dev/c/monogon/+/342\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "eac8f7312382f20c17082f2871b50aea92e0a45e", "tree": "cb1e0051ef3d97a64e367c77eaaf1c1217df2fbd", "parents": [ "bf5994514f50390c64c2ae6be2371687d312850c" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 23:30:37 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 16:03:27 2021 +0000" }, "message": "m/n/core: run dedicated PID 1 reaper\n\nThis introduces minit, a tiny init implementation, written in C, built\nagainst musl. It does one thing: reap children. No support for TTY, no\nconfigurability, just the bare minimum for a working system.\n\nWe also drive-by remove some dead code from main.go.\n\nThis solves https://github.com/monogon-dev/monogon/issues/15\n\nChange-Id: I666ff2042f19639465ff918590a39b8e219ee7d6\nReviewed-on: https://review.monogon.dev/c/monogon/+/346\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "bf68fa9d8cbf6d283da8d538c1f28d8f53df0fcd", "tree": "d62cda0e060b4376dec815629f72e1661d77a73f", "parents": [ "bc671d09b9cdeb420260797c22020aa12059eb36" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:53:58 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 14:50:09 2021 +0000" }, "message": "m/n/c/roleserve: implement ClusterAgent\n\nThe ClusterAgent is a runnable that is scheduled to run on all cluster\nnodes. It\u0027s currently used to report the current node status to the\nCluster, and in the future can be used to implement hearbeat detection\nfor nodes.\n\nChange-Id: Iff394e2cc37064d1e42fd27e40884dda83d88418\nReviewed-on: https://review.monogon.dev/c/monogon/+/341\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "bc671d09b9cdeb420260797c22020aa12059eb36", "tree": "868fe4b9601c2c5c1f63106f3f0160037cb76462", "parents": [ "3be483247a07a6ebe73dd044f6ad299e19a04c7b" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:53:32 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 14:49:55 2021 +0000" }, "message": "m/n/core: implement GetClusterInfo\n\nThis implements Management.GetClusterInfo which is used to retrieve a\nClusterDirectory. This in turn will be used by nodes that wish to\nregister into a cluster.\n\nThis could\u0027ve been skipped and instead Curator.Watch could\u0027ve been used.\nHowever, the Curator service is only really (currently) intended to be\nused by node-to-node communications. To keep with the current design, we\nimplement a separate RPC, but we should maybe reconsider if this\nseparation makes sense.\n\nChange-Id: Ie9d475731f4faafdc51a2aa51a1582ee1a259fd2\nReviewed-on: https://review.monogon.dev/c/monogon/+/340\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "3be483247a07a6ebe73dd044f6ad299e19a04c7b", "tree": "91e414202d66fd57a7064d9cd6ff975530b56143", "parents": [ "826a9e94db7345bbb1932fa51049bc6e090391e3" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:24:26 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 14:49:50 2021 +0000" }, "message": "m/n/c/curator: share locks across leader service instances\n\nThis is needed to lock access to nodes between the Curator and Managment\ninstances.\n\nChange-Id: I4609d87a961339235a13af57236f80c9976819ed\nReviewed-on: https://review.monogon.dev/c/monogon/+/339\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "27b6c4fd36a3e664cb9ed209e498404090d550a2", "tree": "bf7a7ed35c26d8c560be92e33dd0ab09a82c4a5a", "parents": [ "2893e980368c0bbb843aa422386462a964623b40" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 18:55:46 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:37:21 2021 +0000" }, "message": "m/n/c/curator: use UnimplementedXXX stubs for follower unimplemented code\n\nChange-Id: Iecf9adf91c8ae4c6af5854e35dbf3362b1b31865\nReviewed-on: https://review.monogon.dev/c/monogon/+/344\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "2893e980368c0bbb843aa422386462a964623b40", "tree": "0e95252b16a85991de6f0901bc7dcaf2ac566145", "parents": [ "96043bc1cb55b1271b21309b2011d64d2361a0fd" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 09 13:06:16 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:29:42 2021 +0000" }, "message": "m/n/c/curator: add UpdateStatus\n\nThis implements Curator.UpdateStatus, which lets nodes self-report some\nstatus items. Currently this is their external IP address, which is\nneeded to generate a Cluster Directory which is in turn needed to\nregister into a cluster.\n\nChange-Id: Ib5464ca78ee3466d9b9f89b7af8b40f613ae8dcc\nReviewed-on: https://review.monogon.dev/c/monogon/+/332\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "96043bc1cb55b1271b21309b2011d64d2361a0fd", "tree": "b4db59595d8635154de74b0a244a6bb28bc52d2d", "parents": [ "3379a5d0ffcd652031c135f2ffe7600272fa0093" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 12:10:13 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:29:16 2021 +0000" }, "message": "*: import reformats\n\nAs caused by my IntelliJ/gofmt locally. We really need to do gofmt\nchecks in CI, especially now that we nearly have the tooling ready for\nit.\n\nChange-Id: Id105ba9ad8a34b8b8e883d52d621d47b0ea888d7\nReviewed-on: https://review.monogon.dev/c/monogon/+/338\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "3379a5d0ffcd652031c135f2ffe7600272fa0093", "tree": "6c771e39336d5df9f7d956fadb9578b94b25b174", "parents": [ "6adf8840e846b15b7b34151c3432c886b540f420" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 09 12:56:40 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:13:53 2021 +0000" }, "message": "m/n/core: factor out gRPC/TLS into rpc and identity libraries\n\nThis is an annoying large change, which started its life as me pulling\nthe \u0027let\u0027s add tests for authentication\u0027 thread, and ended up in\nunifying a whole bunch of dispersed logic under two new libraries.\n\nNotable changes:\n\n - m/n/core/identity now contains the NodeCertificate (now called Node)\n and NodeCredentials types. These used to exist in the cluster code,\n but were factored out to prevent loops between the curator, the\n cluster enrolment logic, and other code. They can now be shared by\n nearly all of the node code, removing the need for some conversions\n between subsystems/packages.\n - Alongside Node{,Credentials} types, the identity package contains\n code that creates x509 certificate templates and verifies x509\n certificates, and has functions specific to nodes and users - not\n clients and servers. This allows moving most of the rest of\n certificate checking code into a single set of functions, and allows\n us to test this logic thoroughly.\n - pki.{Client,Server,CA} are not used by the node core code anymore,\n and can now be moved to kubernetes-specific code (as that was their\n original purpose and that\u0027s their only current use).\n - m/n/core/rpc has been refactored to deduplicate code between the\n local/external gRPC servers and unary/stream interceptors for these\n servers, also allowing for more thorough testing and unified\n behaviour between all.\n - A PeerInfo structure is now injected into all gRPC handlers, and is\n unified to contain information both about nodes, users, and possibly\n unauthenticated callers.\n - The AAA.Escrow implementation now makes use of PeerInfo in order to\n retrieve the client\u0027s certificate, instead of rolling its own logic.\n - The EphemeralClusterCredentials test helper has been moved to the rpc\n library, and now returns identity objects, allowing for simplified\n test code (less juggling of bare public keys and\n {x509,tls}.Certificate objects).\n\nChange-Id: I9284966b4f18c0d7628167ca3168b4b4037808c1\nReviewed-on: https://review.monogon.dev/c/monogon/+/325\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "2f9f3876dd51d6a3031220d578a18c98270c74a8", "tree": "2174a0aacd26955d17d7ac462c00769001226469", "parents": [ "5d40c67126d51ab1d78f44f51ec23cb75e9887fc" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Sep 29 19:48:08 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Oct 04 15:04:34 2021 +0000" }, "message": "m/n/b/unifiedefi: add bazel rule for EFI unified kernel images\n\nThis adds a new Bazel rule for generating EFI unified kernel images.\nIt also wraps the current Metropolis kernel in one for future use\nand as a cheap test.\n\nChange-Id: I74d7a25cc3c12d5f240eb218fbbd8ba09db1333a\nReviewed-on: https://review.monogon.dev/c/monogon/+/336\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "bc7614ee942aee814865a5967c642802040476ed", "tree": "12573dc1932f0477dffec7a21cf635f8b3ea140a", "parents": [ "356b896eb4c3db9608d637c775845a09fc20fd07" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 09 13:07:09 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 29 13:04:33 2021 +0000" }, "message": "m/n/c/curator: fix watch fail on context timeout\n\nFixes https://github.com/monogon-dev/monogon/issues/75.\n\nChange-Id: Iefb772fa55499271e85fec500f50e6c77e49d05a\nReviewed-on: https://review.monogon.dev/c/monogon/+/326\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "356b896eb4c3db9608d637c775845a09fc20fd07", "tree": "af30addfbc8caba5275febf71847196f13aba8a5", "parents": [ "116c4a69dc90827d82023c362cbc26a17e188787" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Aug 10 17:27:15 2021 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Sep 28 12:14:43 2021 +0000" }, "message": "m/n/b/mkverity: refactor into VerityEncoder\n\nThe implementation was refactored into a stream-oriented VerityEncoder and exposed for use outside the mkverity tool. In addition, end-to-end tests were provided.\n\nChange-Id: I2d009ca8030d6a86e9d6dbe6d6ae60a3b84d2d74\nReviewed-on: https://review.monogon.dev/c/monogon/+/314\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "c72aa433ff68b76317233ba8805d55845e9efd1a", "tree": "ecdcb336a19c6cca8bbd426870b2ca023ec55207", "parents": [ "080f7ff710e359f2dab0d8ace98f0aa8e443d98d" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 22 09:35:16 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Sep 27 18:54:36 2021 +0000" }, "message": "m/n/k/containerd: less verbose runsc logging\n\nThis disables debug logging on non -c dbg builds of Metropolis, making\nthe console output less verbose.\n\nThis should maybe just be \u0027fixed\u0027 by making logtree -\u003e console smarter,\nie. implement log output filters, but this will do for now - and I think\nin general we don\u0027t want to have super verbose per-syscall logging\nenabled unless necessary.\n\nThe implementation picks between two runsc .tomls to build the node\nimage with, which works for now but we might have to move to a\nfull-blown config generator (build-time or runtime) when we also start\nhaving differences between containerd.toml.\n\nChange-Id: I5539ca6f4763a769e879f7d50637aa36f3ffd29b\nReviewed-on: https://review.monogon.dev/c/monogon/+/327\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "080f7ff710e359f2dab0d8ace98f0aa8e443d98d", "tree": "f515ece2d0503d897d2c09e18d9fcb5e2f57cee3", "parents": [ "44d6b832490adc28d787f392db1c9e40c9ff3438" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 09 13:01:00 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Sep 21 08:41:43 2021 +0000" }, "message": "m/n/core/curator: add thin etcd storage abstraction\n\nThis implements etcdPrefix, a more formalized way to represent objects\nstored within etcd under some unique ID key.\n\nThis ensures any time objects are retrieved by key they are not\naccidentally traversing /-delimited \u0027path\u0027 elements, and implements the\nmildly complex range start/end computation operation for when all\nobjects from within a prefix must retrieved.\n\nChange-Id: Ib095f466faaf453b5f61a35642df6b0c1076ae05\nReviewed-on: https://review.monogon.dev/c/monogon/+/322\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "44d6b832490adc28d787f392db1c9e40c9ff3438", "tree": "f04b490de46c451931df9e078969eb550632e937", "parents": [ "e306d780504ae3ddfad3eb852c7adc5ec9757d89" ], "author": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Mon Sep 06 22:02:04 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Wed Sep 08 12:21:08 2021 +0000" }, "message": "Use a temporary ntp.monogon.dev CNAME instead of pool.ntp.org\n\nWe\u0027re currently trying to get a vendor zone assigned\n(monogon-dev/monogon#72). Meanwhile, use a CNAME pointing\nto pool.ntp.org to avoid a freak accident where someone uses\na WIP version of Metropolis to deploy a million plastic routers.\n\nChange-Id: Ib39006c65a23d2df3a1230c28b0b7245b9e3e3c4\nReviewed-on: https://review.monogon.dev/c/monogon/+/320\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "e306d780504ae3ddfad3eb852c7adc5ec9757d89", "tree": "3e8e2c7a21430777db525c9ed4717a2cab1c114a", "parents": [ "d7d6e0284de38cbeeb185ca17c0853b4b2c10ee9" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Sep 01 13:01:06 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Sep 06 09:05:40 2021 +0000" }, "message": "m/n/time: add time service\n\nThis adds a bare-minimum time service based on chrony/NTP for keeping\nthe system clock and RTC on Metropolis nodes accurate.\n\nIt also introduces a UID/GID registry in the Metropolis node code\nas this is the first unprivileged service to run on the node itself.\n\nIt does not yet use a secure time source, this is tracked as #73.\n\nChange-Id: I873971e6d3825709bc8c696e227bece4cfbda93a\nReviewed-on: https://review.monogon.dev/c/monogon/+/319\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "d7d6e0284de38cbeeb185ca17c0853b4b2c10ee9", "tree": "37e0b443caf904f0b78d423ba6580c1416f5bc11", "parents": [ "9ffa1f9577003ab70a6b483475874f3552d1ccc3" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 15:03:06 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Fri Sep 03 11:15:40 2021 +0000" }, "message": "m/n/core/rpc: create library for common gRPC functions\n\nThis is the beginning of consolidating all gRPC-related code into a\nsingle package.\n\nWe also run the Curator service publicly and place it behind a new\nauthorization permission bit. This is in preparation for Curator\nfollowers needing access to this Service.\n\nSome of the service split and authorization options are likely to be\nchanged in the future (I\u0027m considering renaming Curator to something\nelse, or at least clearly stating that it\u0027s a node-to-node service).\n\nChange-Id: I0a4a57da15b35688aefe7bf669ba6342d46aa3f5\nReviewed-on: https://review.monogon.dev/c/monogon/+/316\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "9ffa1f9577003ab70a6b483475874f3552d1ccc3", "tree": "a688d02424e8601ed830d12021b5867688d31438", "parents": [ "6bd415920b84bd695038caeb386f1e97184f0c51" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 15:42:23 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 02 10:38:15 2021 +0000" }, "message": "m/n/core/curator: authenticated RPC\n\nThis adds authentication middleware (server interceptors) for gRPC\nservices running on the public curator listener.\n\nMost of this code is testing harnesses to start up just the curator\nlistener with enough of a PKI infrastructure copy from a real Metropolis\ncluster to be able to start running tests against GetRegisterTicket.\n\nChange-Id: I429ff29e3c1233d74e8da619ddb543d56bc051b9\nReviewed-on: https://review.monogon.dev/c/monogon/+/311\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "6bd415920b84bd695038caeb386f1e97184f0c51", "tree": "60a125e0a299663c392218ed8b80cf33ea31aabd", "parents": [ "68dcee136984e2e16b7682e0c0758c1df831a84c" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Aug 23 13:18:37 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 12:56:15 2021 +0000" }, "message": "m/node: add Management service, implement GetRegisterTicket RPC\n\nThis follows the Cluster Lifecycle design document.\n\nDO NOT MERGE: this needs a stacked CL on top which implements\nauthentication for the Management service.\n\nChange-Id: I19422a63b9dbf2fc0c7f4cbe204851af35b4dbdf\nReviewed-on: https://review.monogon.dev/c/monogon/+/307\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "c1bf6aa7ac83513659d56756009d572deffa7177", "tree": "fafe3258a74a97171a9d11d917a19c2e7387db73", "parents": [ "1f9a03b3f952320824b1ae49e56da3cb814cd5b0" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Aug 23 13:05:24 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Aug 24 17:26:35 2021 +0000" }, "message": "m/n/core/curator: fix listener stuckness on restarts\n\nThis makes both gRPC listener runnables (local and public) manage their\nown listening sockets, allowing them to restart independently of\neachother, and making sure that any listening sockets are cleaned up.\n\nWe also fix the existing curator test (which does not exercise the\nlisteners, just leadership election) to place the curators and their\nlocal sockets in /tmp instead of the default bazel tempdir (as a path\nbased on that is longer than the maximum domain socket path). This makes\nthese tests slightly less noisy (as they kept crashing while not being\nable to listen to the local socket).\n\nThis should\u0027ve been caught by a curator listener test, if we had one\n(other than the e2e test). I\u0027m growing keen on spending some time\nwriting enough of a harness to actually do that. Maybe once we have a\nfollower implementation ready…\n\nChange-Id: I0267292781b6ee8aff1d0557d420bbaa3c3d79f6\nReviewed-on: https://review.monogon.dev/c/monogon/+/304\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "b9044c888097757c36933062f27b5f5ee103ee5f", "tree": "b07722231a9cf0fd3c0b81486bd637e11cbd7b6b", "parents": [ "3bb23219009a98643a562b1e59e3a4080f422c51" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Aug 24 11:59:47 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Aug 24 16:12:52 2021 +0000" }, "message": "m/p/devicemapper: make parameter encoding part of package\n\nThe DM kernel interface gets a single parameter string for each DM\ntarget in a table but internally the kernel immediately decodes it into\nan argv-style list of string arguments. Because everything needs to do\nit and it can be quite hard to get right, let\u0027s make it part of the\ndevicemapper package. Properly encoding this also means you get\nactionable errors when you pass invalid data instead of weird kernel\nerrors or misbehavior.\n\nChange-Id: I8060871a7459183c0395e5e4e8aac517544b2e87\nReviewed-on: https://review.monogon.dev/c/monogon/+/309\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "41d275a63864e67deacad5b2ec0b435b01984034", "tree": "b5acf06483c0c33f0e988c82cbb25db4ceea777f", "parents": [ "5b2ae5500a90dc48b9713095e5f1580b9c9646d9" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Aug 17 13:09:43 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Aug 24 13:18:12 2021 +0000" }, "message": "m/n/c/curator: implement AAA.Escrow for initial owner pubkey\n\nThis finally implements AAA.Escrow in Metropolis.\n\nWe\u0027re not yet implementing multi-user support, so this currently only\nimplements retrieving an Owner certificate using the owner public key\nspecified in NodeParameters.cluster_bootstrap.\n\nChange-Id: I64a7ba025a8069d82b3c804ca3e2a706de2b0fbf\nReviewed-on: https://review.monogon.dev/c/monogon/+/289\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "5b2ae5500a90dc48b9713095e5f1580b9c9646d9", "tree": "1f6efbed2aa20716c18772bb30dbafacd6f07db3", "parents": [ "03758714f4b7be2a712831beecfdfcbf151b4c66" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Aug 17 13:00:14 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Aug 23 12:26:16 2021 +0000" }, "message": "m/n/c/curator: listen on public gRPC\n\nThis enables listening on CuratorPort (which was called\nNodeServicePort) using TLS node certificates. No service is yet running\non the new gRPC listener.\n\nChange-Id: I436ac1ae9cbdb257419ad114262fc2a7516396b1\nReviewed-on: https://review.monogon.dev/c/monogon/+/288\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "03758714f4b7be2a712831beecfdfcbf151b4c66", "tree": "1a7e2f3096a130897f53c28d4f9b72ea871264d0", "parents": [ "8ff4b7c6f20c9dda91c0eefc524e9bb6c3bff52d" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Aug 17 12:52:11 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Fri Aug 20 09:03:18 2021 +0000" }, "message": "m/n/core: save owner public key in etcd\n\nThis is an early implementation of storing user credentials. It\ncurrently does not support more then the owner credentials.\n\nThese are not yet used anywhere, but will be in a follow-up CL.\n\nChange-Id: Ib876f7aaff44531dcae5a27875a960aaa9ec029f\nReviewed-on: https://review.monogon.dev/c/monogon/+/287\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "158e9a415a72bfacfdf9f46eb06b30486680299f", "tree": "ef5884479bc8da914cb69f7c111d06e32cbe2a1e", "parents": [ "a41caacc71418f7307d851fad95991cf80bdcb41" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Aug 17 17:04:54 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Aug 19 11:52:17 2021 +0000" }, "message": "m/n/core: reformat\n\nWe should get this into CI, as my IntelliJ keeps finding Go files that\naren\u0027t properly reformatted.\n\nChange-Id: I7ea736994bea13ccebc787548fadf3da984e334e\nReviewed-on: https://review.monogon.dev/c/monogon/+/291\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "a41caacc71418f7307d851fad95991cf80bdcb41", "tree": "cbcf9af76f29ccb94b7c2b94d75f1e8eb39cfb3d", "parents": [ "5253884d51cb64c1d1afcb2d7b969f7c2b50b302" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Aug 12 17:00:55 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Aug 19 10:20:55 2021 +0000" }, "message": "m/pkg/pki: forbid External/Managed certificates without name\n\nThis ensures any stored certificates must have a name set - otherwise\nthey end up being created with an empty string as a name, and end up\ncolliding with eachother.\n\nChange-Id: I9e415b6ff89dbda179526920d58e33e638a28cec\nReviewed-on: https://review.monogon.dev/c/monogon/+/286\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "5253884d51cb64c1d1afcb2d7b969f7c2b50b302", "tree": "10a6bf03472e9c14da2515ea7755d74bb3f660e6", "parents": [ "99f477412a2e701f89f7698be1dd432adcfff17c" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Aug 11 16:22:41 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Aug 19 10:20:55 2021 +0000" }, "message": "m/pkg/pki: refactor, allow for external certificates\n\nThe pki library supported managing certificates in two modes:\n\n - default, when name !\u003d \"\"\n - volatile/ephemeral, when name \u003d\u003d \"\"\n\nThe difference between the two being that default certificates were\nfully stored in etcd (key and x509 certificate), while volatile\ncertificates weren\u0027t stored at all. However, both kinds needed private\nkeys passed to the pki library.\n\nWe want to be able to emit certificates without having private keys for\nthat certificate, so we end up a third mode of operation: \u0027external\ncertificates\u0027. These are still stored in etcd, but without any\ncorresponding private key.\n\nIn the future we might actually get rid of ephemeral certificates by\nexpanding the logic of external certificates to provide a full audit log\nand revocation system, instead of matching by Certificate Name. But this\nwill do for now.\n\nWe also use this opportunity to write some simple tests for this\npackage.\n\nChange-Id: I193f4b147273b0a3981c38d749b43362d3c1b69a\nReviewed-on: https://review.monogon.dev/c/monogon/+/263\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "99f477412a2e701f89f7698be1dd432adcfff17c", "tree": "43c088e34cfa9171a5587573f4d824f9d09e0a69", "parents": [ "9d6c4c78bca9da0db7e40e5de776528f3d83a7dd" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Aug 04 20:21:42 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Aug 19 10:20:55 2021 +0000" }, "message": "curator: provisions for implementing multiple gRPC services\n\nWe want to run some other gRPC services on the Curator leader/follower\nimplementations other than just the Curator gRPC service.\n\nThis decouples the local types from implementing a particular gRPC\nservice (instead proxying through an interface) and splits out the\nimplementation of the Curator gRPC service from the main leader objects.\n\nThis should allow us to add an implementation of eg. a Management gRPC\nservice in a testable manner (the only thing we have to dependency\ninject is the leadership struct, and that\u0027s trivial to do with a simple\netcd test server).\n\nChange-Id: Ia0ea65e40a775bf49661d0b99c0185aa83547ed0\nReviewed-on: https://review.monogon.dev/c/monogon/+/260\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "9d6c4c78bca9da0db7e40e5de776528f3d83a7dd", "tree": "71cba058637a866b7c87e3f296dd4995d0171cfe", "parents": [ "257acab41f5a35575ca0f2dbc9568b1bd75d2570" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Jul 20 21:16:27 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Aug 11 15:38:58 2021 +0000" }, "message": "Support injecting container images for development\n\nThis adds the LoadImage RPC and an accompanying subcommand\nto the debug API which allows loading images into\nan existing Metropolis node for\ndevelopment or testing.\n\nChange-Id: I51d802630ae4c95fb874e01bfb6510ab69c322e1\nReviewed-on: https://review.monogon.dev/c/monogon/+/219\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "257acab41f5a35575ca0f2dbc9568b1bd75d2570", "tree": "fdc41d8de424f74525b7a92024c12f00ed8928fa", "parents": [ "1445396219351e711f82d4cebad6e84a46553bda" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Aug 10 12:36:17 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Aug 11 11:28:06 2021 +0000" }, "message": "m/p/devicemapper: Support creating read-only devices\n\nI originally thought this is not going to be needed as R/W control can be done through devicemapper itself, but verity requires a read-only table.\n\nWhile we\u0027re here let\u0027s also add some doc comments to the Target struct.\n\nExisting functionality is covered by existing tests, read-only functionality will be exercised by verity tests once they land.\n\nChange-Id: Ib76bcffb14b5fe40d8d77bd9731b591d0d8cf22f\nReviewed-on: https://review.monogon.dev/c/monogon/+/262\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "1445396219351e711f82d4cebad6e84a46553bda", "tree": "798347e10dba644f861fd9dbf55fe59cef9fb82f", "parents": [ "6767e052c761f2b19a4966f707c65d8bc08c3c3c" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Fri Jul 23 16:58:02 2021 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Aug 10 14:39:14 2021 +0000" }, "message": "m/n/b/mkverity: implement a dm-verity hash image generator\n\nBackground: https://github.com/monogon-dev/monogon/issues/57\n\nThe piece of code included implements a subset of veritysetup\nfunctionality (see: dm-verity). It was written in an attempt to\nminimize projected higher maintenance cost of packaging cryptsetup\nfor metropolis in the long term.\n\nThe implementation was verified with the original veritysetup tool:\n\u003e$ ./go-veritysetup format file1 file2\n\u003e33359c1f1bdd25e7afc2e98cd27c440e7af9ef2fb55462ce562a1b8254bf02e4\n\u003e$ veritysetup --debug --verbose verify file1 file2 33359c1f1bdd25e7afc2e98cd27c440e7af9ef2fb55462ce562a1b8254bf02e4\n\nKtest-based tests and buildsystem integration are still pending.\n\nCompatibility with the original cryptsetup tool might be dropped\neventually, if it\u0027s found beneficial to do so.\n\nChange-Id: I5a6e1b18b692b1701e405013f132f6f2711b2c96\nReviewed-on: https://review.monogon.dev/c/monogon/+/250\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "439b95eb515c86ba8ce9917da258c0875f36f038", "tree": "b7590aaac27700868ca1638af4d2e84bfb1a975f", "parents": [ "f9edf520bd3fa049b8f1d5f09f0ee727864ca8c7" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Wed Jun 30 23:16:13 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Tue Jul 20 14:43:28 2021 +0000" }, "message": "m/n/c/{cluster,curator}: move NodeCredentials to cluster\n\nThis keeps the NodeCredentials/NodeCertificate logic types near their\nconsumer, the cluster bootstrap code. It also rewrites these structures\nto be centered around the x509 data itself.\n\nThis is a followup to https://review.monogon.dev/c/monogon/+/186 .\nAttempting to introduce it into that change was too complex due to the\nsurrounding cluster/curator refactoring.\n\nWe also take this opportunity to write some simple tests for the\ncredential validation logic.\n\nChange-Id: Iead3cfdd5778274508d79799f4750f5fdf9385bc\nReviewed-on: https://review.monogon.dev/c/monogon/+/197\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "f9edf520bd3fa049b8f1d5f09f0ee727864ca8c7", "tree": "1fd016dcbeccbc7b8bbfc32960c43bd0dbaffe5f", "parents": [ "a959cbd12c29b62045f02b1d22cdf1e36c0261a4" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 15:57:13 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Tue Jul 20 14:42:45 2021 +0000" }, "message": "metropolis/node/core: use curator\n\nThis finally switches over the node startup code to use the full Cluster\nManager / Curator / Role Server chain to bring up the node.\n\nChange-Id: Iaf6173671aed107a67b4201d9d1ad8bb33baa90f\nReviewed-on: https://review.monogon.dev/c/monogon/+/189\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "a959cbd12c29b62045f02b1d22cdf1e36c0261a4", "tree": "7f44cdf24c3c02f7d9ba866a2d37275673a0dd11", "parents": [ "0d93777cf32dd0d0f6f8d75d8396f7140cff9d13" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 15:56:51 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Tue Jul 20 12:02:29 2021 +0000" }, "message": "metropolis/node/core/cluster: use curator\n\nThis refactors the cluster manager. It removes all etcd storage\nfunctionality (which now lives in the curator) and otherwise dusts\nthings off slightly (some file renames, some comments to reflect the now\nclarified and limited scope of the cluster manager).\n\nChange-Id: Ic62d8402c0618fb5e0e65966b0d732a2cab564e0\nReviewed-on: https://review.monogon.dev/c/monogon/+/188\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "0d93777cf32dd0d0f6f8d75d8396f7140cff9d13", "tree": "f6abee66c82ba141ad449575a6d35d06408c6ed4", "parents": [ "963c4090f74341d8efc61b49ba5934a18434371c" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 15:54:40 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Tue Jul 20 12:02:29 2021 +0000" }, "message": "m/n/core/roleserver: implement\n\nThis implements the Role Server, which is the new service responsible\nfor actually running Metropolis workloads like the Kubernetes services.\n\nThis decouples starting Kubernetes from node startup code, and handles\ncases like nodes changing roles at runtime.\n\nChange-Id: Ie5f7f2c30b05fe74ca003805532dba50bf3821d0\nReviewed-on: https://review.monogon.dev/c/monogon/+/187\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "963c4090f74341d8efc61b49ba5934a18434371c", "tree": "65e0e58e997e155290118e53aebfc228aa3e20be", "parents": [ "2098b98c7deaf9115742cf73071f888e0513cf2f" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Jul 05 18:50:08 2021 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Jul 19 10:52:16 2021 +0000" }, "message": "m/n/c/consensus_test: move timeout handling to Bazel\n\nThe test regularly exceeds timeout on slower machines, and besides,\nthat\u0027s the proper way to do it.\n\nChange-Id: Ic4a8ac717bd7f6e70d4d4ac0b156f42ff5addef8\nReviewed-on: https://review.monogon.dev/c/monogon/+/215\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\nReviewed-by: Sergiusz Bazanski \u003cserge@nexantic.com\u003e\n" }, { "commit": "79fc1e9fd6ee8777f097ab251b828d82e33b7bad", "tree": "a1c50daa06f2ea66fb5fcf14e85331385facdb68", "parents": [ "50009e024b50eda2c69b884600d0850c73d62b6d" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Jul 06 16:25:22 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Wed Jul 07 13:49:55 2021 +0000" }, "message": "metropolis/*: move tests to supervisor harness\n\nThis somewhat simplifies test code (barely), but more importantly pipes\nlogs from runnables into test stdout, thereby making debugging much\neasier.\n\nChange-Id: I3e597bbac8497bea3477afd54f61b592a0d08355\nReviewed-on: https://review.monogon.dev/c/monogon/+/206\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\n" }, { "commit": "50009e024b50eda2c69b884600d0850c73d62b6d", "tree": "28ee724fd39c537e09a755fbd593dc15d31e288e", "parents": [ "ebe025936fc86f53e7316f894f54dd6ef9b0a9d7" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Wed Jul 07 14:35:27 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Wed Jul 07 13:48:54 2021 +0000" }, "message": "m/n/core/consensus: parse etcd server logs\n\nThis finally gives us easy to read etcd logs instead of raw JSON dumps\ninto stdout. Instead of simply parsing them as raw logs, we convert them\ninto leveled logs.\n\nChange-Id: I7cfe18b9c4e24d7742a01a77f5d9c6ddee647493\nReviewed-on: https://review.monogon.dev/c/monogon/+/209\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\n" }, { "commit": "f0b4da54afc17f4b2b1c31ddb9433ee888aea699", "tree": "a4ef4b8154c4024714209710696310bfd7bc2764", "parents": [ "35e43d133a16750adfa1683473f5c2648a010b1a" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Jun 21 20:05:59 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Wed Jul 07 13:31:45 2021 +0000" }, "message": "m/n/core/curator: implement leader and Node/PKI state\n\nThis implements actual Curator logic for nodes and PKI. These will\nreplace the cluster manager\u0027s equivalent logic.\n\nThere are two entry points to this logic:\n\n - the gRPC service\u0027s Watch method for accessing node status\n - bootstrap logic to create a node when the cluster manager bootstraps\n the cluster.\n\nTest plan: a followup CR will introduce tests for the Curator - more\ngranular than the full E2E suite. DO NOT MERGE UNTIL THEN, as this is\ncritical code.\n\nChange-Id: I8c40a821b846012b90cf9a5df27901d1b49f388c\nReviewed-on: https://review.monogon.dev/c/monogon/+/186\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "3c885deeda9ab560ee29e94159782ce4323af80e", "tree": "5d6a18c0b822accc5c279240c0d7e52ca071a361", "parents": [ "aad79488d417eefafd4102bda9bd10d6473cf6c7" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 17:21:00 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Mon Jul 05 18:19:36 2021 +0000" }, "message": "m/n/core/curator: implement gRPC listener\n\nThis implements the Curator listener and listener dispatcher, two\nrunnables responsible for maintaining an active Curator RPC\nimplementation (either leader or follower) and switching over\nappropriately as the election status changes.\n\nThis might be overengineered. The implementation switchover logic and\ncontext joining could possibly be ripped out and replaced by plain gRPC\nsocket close and re-open on switchover.\n\nTesting plan: implements unit tests for switching/dispatching.\n\nChange-Id: Ib62195b336d0754d99865d7a2a32ba2ffa3543ce\nReviewed-on: https://review.monogon.dev/c/monogon/+/185\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "76003f807b24a22476b14bc308939fc62e1ad6a2", "tree": "24fc636b5c47569aa8e64119bd4b1f81a794c9ab", "parents": [ "e30d7d08548fe233cacff5870971f08318ff9646" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 16:39:01 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Wed Jun 30 12:29:59 2021 +0000" }, "message": "m/n/core/curator: implement leader election\n\nThis implements the leader election functionality subset of the curator.\nIt does not yet implement any business logic, just the switchover\nbetween acting as a leader and a follower.\n\nTest plan: implements an integration test for the leader election with\nan in-memory etcd cluster.\n\nChange-Id: Id77ecc35a9f2b18e716fffd3caf2de193982d676\nReviewed-on: https://review.monogon.dev/c/monogon/+/184\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "e30d7d08548fe233cacff5870971f08318ff9646", "tree": "be4b12585cf856db8fc74746f5bfed69748195cd", "parents": [ "db77e82767ff620de89d75a7f3e9a6c37b1d0973" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Wed Jun 23 18:50:19 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 24 09:08:20 2021 +0000" }, "message": "m/n/core/consensus/client: add context to ThinClient\n\nThis context ends up in the returned clientv3.Client structure and is\naccessible under .Ctx(). This is used by some library code, and all\netcd clients by default have a context, so that library code will fail\nif none is set.\n\nChange-Id: If2b9fb0720725d623c05ea4947fdf99fe6d5d1d0\nReviewed-on: https://review.monogon.dev/c/monogon/+/195\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "d98ad45e64b542f9945939d35cba9ebd352ff913", "tree": "cd8fa82c4ccd2bf0616986615f3eb2d7c4798f30", "parents": [ "7f17d9b41f248f4b009f5d702622616f62d0a2fa" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 15:55:17 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Tue Jun 22 12:05:20 2021 +0000" }, "message": "metropolis/n/kubernetes/pki: remove verbose \u0027ensure\u0027 cert logging\n\nChange-Id: Ie12f12a2966282d364730a1c7a148fae78ab236d\nReviewed-on: https://review.monogon.dev/c/monogon/+/190\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "7f17d9b41f248f4b009f5d702622616f62d0a2fa", "tree": "fdb69964144f9b654a746d15e86d34f0bf1b108b", "parents": [ "63fabd954a5303f6bba41557da55b1940198058f" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 16:11:40 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Tue Jun 22 12:05:16 2021 +0000" }, "message": "m/n/core/localstorage: add curator ephemeral directory\n\nThis is where the curator will listen for local gRPC connections from\nthe rest of the node code.\n\nChange-Id: Id0ea2e4e05d04bbea4b3b88dd51122d394317578\nReviewed-on: https://review.monogon.dev/c/monogon/+/183\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "63fabd954a5303f6bba41557da55b1940198058f", "tree": "547628727ea80a09eced09a402945d81263f6778", "parents": [ "30653eeb3adcbebfecb4216569dc247b51cfb464" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 15:47:22 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Mon Jun 21 09:12:58 2021 +0000" }, "message": "m/n/c/curator/proto: add API proto\n\nThis is the initial API of the curator service we\u0027re about to implement.\nThe TODO comments already reflect the state of the implementation as is\nnow, and as will be stacked on top of this change.\n\nTesting Plan: proto change only, no logic yet.\n\nChange-Id: I2c11b0d5f2112b7872ea348815d81ded4be874bd\nReviewed-on: https://review.monogon.dev/c/monogon/+/162\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "b9013af7fa0247191099ec1f471a2d751537f545", "tree": "dec4a8c6e2ccefe41c2269f7938004a10d3792e1", "parents": [ "4166a71f51d9546c1dfd9f99b5fdffcb9301b57b" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Apr 29 16:47:56 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Tue Jun 08 10:23:53 2021 +0000" }, "message": "m/n/core/consensus/client: implement ThinClient()\n\nSummary:\nThis implements a ThinClient function on Namespaced which returns an\nclientv3.Client. These can be useful when dealing with existing code\nwhich expects this type, but only uses non-management APIs. For example,\nthe clientv3 concurrency library.\n\nTest Plan: To be used by future code, and basic enough that it IMO does not warrant unit tests?\n\nChange-Id: Ic6e38ff654bafd8bb385cf108637f8ed058015dc\nReviewed-on: https://review.monogon.dev/c/monogon/+/121\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "216fe7b3ae949376467f626f339423a31ea7da97", "tree": "b0fe587b671a76bf6229339825d2a61df7fc847b", "parents": [ "6ebdc418f3c4799c12368e34ea78dc9c9757fb54" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Fri May 21 18:36:16 2021 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Fri May 28 17:54:03 2021 +0200" }, "message": "*: reflow comments to 80 characters\n\nThis reformats the entire Metropolis codebase to have comments no longer\nthan 80 characters, implementing CR/66.\n\nThis has been done half manually, as we don\u0027t have a good integration\nbetween commentwrap/Bazel, but that can be implemented if we decide to\ngo for this tool/limit.\n\nChange-Id: If1fff0b093ef806f5dc00551c11506e8290379d0\n" }, { "commit": "99d210d48afc2207ffb4064c58068faa9449a981", "tree": "781a73c0e5bf7e9ff586653eef0cce594b90def0", "parents": [ "4e0dba61375bcb989d86cacf18cf00ebfe6303b4" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Mon May 17 15:29:18 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue May 18 14:06:11 2021 +0200" }, "message": "m/n/k/plugins/kvmdevice: export resource name variable for easier consumption\n\nTrivial change to consume the resource name of this device plugin as\na variable.\n\nTest Plan: Trivial change\n\nX-Origin-Diff: phab/D791\nGitOrigin-RevId: d71d878f87be1da5a547e17b9965f92e737b644c\n" }, { "commit": "68ca5eebd0ccd00a2d60eb42289c64357fb2e83f", "tree": "5706f5b4fa8dc44775dbabe24cd577f1d37a0422", "parents": [ "93bba15a0059da200a5d09a2bd7ec5ed5a667c60" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Apr 27 16:09:16 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue May 11 12:09:33 2021 +0200" }, "message": "m/pkg/event: move MemoryValue to subpackage\n\nThis keeps metropolis/pkg/event as a pure interface package, and\nmoves the memory-backed implementation to a subpackage.\n\nTest Plan: Refactor, coevered by tests.\n\nX-Origin-Diff: phab/D764\nGitOrigin-RevId: 1337bf55a7752293791b3efe8648bbf5f6e6e9e1\n" }, { "commit": "f055a7fce0263a30fd2c853b5ed002a765fc23e8", "tree": "de2dc0daeebfc7ecce2b1987ffb13eb4f2475088", "parents": [ "2666513457e8d7a282560a7090f35439ab9695ce" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Apr 13 16:22:33 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Wed Apr 14 14:35:09 2021 +0200" }, "message": "third_party/linux: build using unhermetic rule\n\nThis replaces ad-hoc genrules (for the node Linux image and the ktest\nimage) with a real Bazel rule with an attached transition which ensures\nwe end up with the same-ish configurations for all builds of an image.\n\nThis reduces rebuilds of the ktest Linux kernel, from three down to one.\n\nBefore: https://drive.google.com/file/d/1c6VmY2bqx9Pgs61TOUfgMi8Sn0WQeobu/view\n\nAfter: https://drive.google.com/file/d/13eO1rLhoBCMMRUKrmJz8QnhdAR3ctIGb/view\n\nWe also drive-by fix the Kubernetes CTS test suite to run on a single-node\nCluster (instead of failing early due to that being currently reworked).\n\nTest Plan: Build system refactor, following existing test.\n\nX-Origin-Diff: phab/D761\nGitOrigin-RevId: b5545ac5fd402fbf0340d941a90b9ea6ea0b6d43\n" }, { "commit": "2666513457e8d7a282560a7090f35439ab9695ce", "tree": "328d8f62ddb665b6cd057272f7cae2713aa247ad", "parents": [ "a105db57640d6abf6de368ec0c33a3a5b4f93893" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Apr 13 16:55:59 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 19:51:33 2021 +0200" }, "message": "Fix TCP BBR setting\n\nI previously set the TCP queuing discipline to BBR without actually compiling in BBR.\nSee T943. This actually builds in BBR and sets it as default in the kernel config, thus removing\nthe need to manually set it in userspace.\n\nTest Plan: CI\n\nBug: T943\n\nX-Origin-Diff: phab/D760\nGitOrigin-RevId: 779a709e4298ec59bfdcf462fe2f3563952204b6\n" }, { "commit": "a105db57640d6abf6de368ec0c33a3a5b4f93893", "tree": "dc96244d0b2922768d7f29431bab2a9ac581a1a6", "parents": [ "c75c9d4f30174c089cce47c608683bf09396fa30" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Apr 12 19:57:46 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 19:51:13 2021 +0200" }, "message": "m/n/core/cluster: migrate to events and etcd namespaced client\n\nThis moves the status of the cluster manager to use a local event\nvariable. Watchers (like the node startup code) can now use this to get\nupdates on the state of the node and its cluster membership in a way\nthat\u0027s more abstracted from a sequential startup. This will permit us to\nmove a lof othe startup code into code common across different node\nlifecycle paths.\n\nTest Plan: Refactor, exercised by e2e.\n\nX-Origin-Diff: phab/D757\nGitOrigin-RevId: 31a3600ad2aab90a1e7f84d741e7ea40a0422724\n" }, { "commit": "c75c9d4f30174c089cce47c608683bf09396fa30", "tree": "a3d34c7ac52f16650de55ba28d3621add81e5f99", "parents": [ "886d2892d1717bc130cfa008742c06c29f7ff186" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Apr 13 16:40:14 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 19:51:11 2021 +0200" }, "message": "m/n/c/consensus: add client\n\nThis implementes a thin wrapper around etcd\u0027s clientv3.Client, with the\nfollowing advantages:\n\n - Only implements KV, Watcher and Lease interfaces, ie. unprivileged\n namespaceable interfaces - not cluster management interfaces. These\n will be available to both remote and local etcd connections.\n - Adds recursive namespacing functionality, which permits different\n parts of the subsystem to receive their own somewhat-sandboxed etcd\n subtree. This not only makes the etcd keyspace layout more strict,\n but also simplifies passing around etcd clients, as major components\n (like the kubernetes subsystem) can hand out its own sub-clients,\n instead of them having to be globally declared ahead of time.\n\nTest Plan: Exercised by tests.\n\nX-Origin-Diff: phab/D756\nGitOrigin-RevId: 03fead9a89c301a2e70df8a007b7ecb60b2364c7\n" }, { "commit": "0565ea3191d445bdaab647213d59ed3d7218630a", "tree": "fd5f395dd2f54a1582538e7b5ac2b724db987625", "parents": [ "09c275bc489bc1de406be9a2e8f158eaa87b7c61" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Apr 13 11:52:00 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 19:51:06 2021 +0200" }, "message": "m/n/core/cluster: factor out bootstrap into separate file\n\nTest Plan: Refactor.\n\nX-Origin-Diff: phab/D753\nGitOrigin-RevId: 2e39db6673b2a0a6c1d7593f230fa691643e4c06\n" }, { "commit": "09c275bc489bc1de406be9a2e8f158eaa87b7c61", "tree": "31c62a93e37f6052aa99e2addacef6c060d75e85", "parents": [ "37050126ef89ec30cc677c272471debe55ec0d69" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Mar 30 12:47:09 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 11:04:05 2021 +0200" }, "message": "Add ftrace support to DebugService\n\nThis allows us to do ad-hoc kernel-level tracing on a running Metropolis node.\nUseful for tracking down complex bugs.\n\nExample: `bazel run //metropolis/cli/dbg -- trace -function_graph_filter blkdev_* function_graph`\n\nTest Plan: Debug utility, manually tested\n\nX-Origin-Diff: phab/D748\nGitOrigin-RevId: 924eb795250412a73eb30c0eef4a8c1cc726e5fd\n" }, { "commit": "37050126ef89ec30cc677c272471debe55ec0d69", "tree": "c64a64a622ec1c3e1e72fc12a6d4252c0e803cc1", "parents": [ "2999427c182463840a339cf0e82885d8a3b6e79f" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Mar 30 14:00:27 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 11:04:01 2021 +0200" }, "message": "Implement Block PVCs in our storage backend\n\nThis implements full support for Block PVCs in our Kubernetes storage backend.\nThe block PVCs are backed by files made available to the pods using loop devices and\nhave read-only and online expansion support.\n\nThis also requires a Kubernetes patch because they call losetup if block PVCs are used\nwith CSI to establish a form of lock on the backing block device. This lock is not\nexclusive and does absolutely nothing for our use case and could get very expensive\non dense machines so I removed it.\n\nTest Plan: Comes with E2E tests\n\nX-Origin-Diff: phab/D746\nGitOrigin-RevId: 430d3f445286c0d3498b2153df333a19f3fcab89\n" }, { "commit": "30167f5cf55829d38f9d480466d7b5742c62a5fc", "tree": "fd89a3bb8a1c08b10d870a6b185b2deffa131cac", "parents": [ "9956e72c6c0b4f6436dc9493bc213965ee0cc191" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Wed Mar 17 17:49:01 2021 +0100" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 11:03:56 2021 +0200" }, "message": "Add VM infrastructure smoke test\n\nThis adds an E2E test which exercises the VM infrastructure (Kubernetes, KVM device plugin and QEMU).\nThis test should ensure that nobody breaks the core infrastructure Metropolis VMs rely on.\n\nTest Plan: This is a test\n\nX-Origin-Diff: phab/D740\nGitOrigin-RevId: ddf629725dfb664ace5a50efee9ed9442962d6f7\n" }, { "commit": "42e61c6a3601d7f63176af3f53a3ac9c53120099", "tree": "2fd6e86b1a0dee6b4928f04ac359b4b262806d73", "parents": [ "34fe8c666811c63f33ba970ba0e39d25804ab4a3" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Mar 18 15:07:18 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Mar 18 15:07:18 2021 +0100" }, "message": "m/n/core/cluster: rewrite bootstrap to conform to cluster lifecycle DD\n\nThis removes the existing cluster/manager code and reimplements it from\nscratch, finally implementing the cluster lifecycle design document for\ncluster bootstrap.\n\nTest Plan:\nE2e should cover this. Maybe we could unit test the manager? But that would\nrequire a ton of DI work. Not sure if it\u0027s worth it.\n\nX-Origin-Diff: phab/D735\nGitOrigin-RevId: b00c97b0a102a21605d16086df82a6ece6eb7f4d\n" }, { "commit": "34fe8c666811c63f33ba970ba0e39d25804ab4a3", "tree": "fce90696e07eb76efea1436047393ad66ac04404", "parents": [ "3ea1a3a30d41980a8a5b5f321b3e7bc8af96dc29" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:20:09 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:20:09 2021 +0100" }, "message": "m/node/core/consensus: always use member name as address\n\nInstead of explicitly giving the consensus service an address to listen\non, we now just give it a hostname. Etcd will resolve the name itself on\nstartup. It\u0027s not yet known if it will re-resolve it and handle changes.\nIf that\u0027s not the case, we will have to implement a restarting\nbabysitter process instead.\n\nTest Plan: E2e tests should cover this.\n\nX-Origin-Diff: phab/D734\nGitOrigin-RevId: c2255b2956137e2bbd705ac1965418c0540d0046\n" }, { "commit": "3ea1a3a30d41980a8a5b5f321b3e7bc8af96dc29", "tree": "0d4ab65ff6af76e3115ac8a82452216301aebce4", "parents": [ "72068da814af80568cb106b877ef8f5e526e684c" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:17:33 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:17:33 2021 +0100" }, "message": "m/node/core/conensus: handle etcd restarts\n\nThis makes the etcd service more reliable in case of transient failures\nwhen starting in a new cluster. Previously, any restart of etcd on the\nfirst (bootstrapping) node would cause etcd to get stuck and never start\nagain (as certificates were already created). This changes the logic to\nallow existing certificates.\n\nThis also handles the case of etcd attempting to start as the network is\nreconfigured, and eg. the external hostname is not yet resolvable.\n\nTest Plan:\nNo tests yet. This should be tested by a more comprehensive e2e test where we\nrandomly kill some runnables (see: T872).\n\nX-Origin-Diff: phab/D733\nGitOrigin-RevId: 8ac426f9423ec2353537eec651071e99a5e5ec53\n" }, { "commit": "d8af5bf4c14a5c53d1736695a1210b6eea4d246e", "tree": "83e4c35e105d8fb0e5bf71ac8c93bbd3e7f964b4", "parents": [ "4e090357c4f1f3bae53a5f2feaf20ea5e1bbbe61" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:38:29 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:38:29 2021 +0100" }, "message": "metropolis/node: use Event Value for network status\n\nThis moves over the GetIP API to use our fancy new event/value library.\nThe consumers of this data are currently the cluster manager and the\nkubernetes root service. Both are migrated over.\n\nTest Plan: Refactor, covered by E2E tests.\n\nX-Origin-Diff: phab/D711\nGitOrigin-RevId: 8a1e0dd35236d55492722f4439323cb2ee9574fc\n" } ], "next": "4e090357c4f1f3bae53a5f2feaf20ea5e1bbbe61" }