)]}'
{
  "log": [
    {
      "commit": "60461b2b23eb57319525a3e00d7ae57e51598ebc",
      "tree": "17f4eb857a29b08a6e2be059279b9d88691aff09",
      "parents": [
        "3fd0977e92c3e86cdfde736debdda66af05d1015"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Oct 26 19:16:59 2023 +0200"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Mon Nov 13 21:05:16 2023 +0000"
      },
      "message": "metropolis: move curator client watches to curator/watcher\n\nThis replaces all the ad-hoc code to watch Curator node(s) with calls\nthrough the new curator/watcher library.\n\nChange-Id: Ie2a82b330e4108b9b725515cb10595916c38b323\nReviewed-on: https://review.monogon.dev/c/monogon/+/2263\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "f64f197c8039a72d82efaae6a21f725d3cd3ac7a",
      "tree": "302a5d9c6ee1d5cdf2b2c8e4abe7b0609c9a2ffa",
      "parents": [
        "54a5a053f2250c03d8476293ecb98fdb458ee5fd"
      ],
      "author": {
        "name": "Tim Windelschmidt",
        "email": "tim@monogon.tech",
        "time": "Fri Jul 28 00:00:50 2023 +0000"
      },
      "committer": {
        "name": "Tim Windelschmidt",
        "email": "tim@monogon.tech",
        "time": "Wed Oct 11 10:53:00 2023 +0000"
      },
      "message": "metropolis/node/core/metrics: fixup metrics authentication\n\nChange-Id: I67643855ab61bfdea980211ffe01e50c2409882b\nReviewed-on: https://review.monogon.dev/c/monogon/+/1979\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "65702194ea264a0fd01fb470bacaf39264b4f637",
      "tree": "3469201097b30e638f1e446655e1d23b33d90f8d",
      "parents": [
        "f551a7696824a9ddbac63191c489db8280aee0a4"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Aug 31 16:27:38 2023 +0200"
      },
      "committer": {
        "name": "Tim Windelschmidt",
        "email": "tim@monogon.tech",
        "time": "Thu Sep 14 13:43:45 2023 +0000"
      },
      "message": "workspace: rules_go, gazelle, go, gVisor update\n\nThis commit not only updates rules_go and friends, but also updates\ngVisor, removes legacy protobuf usage and switches from using\nbuild_configuration to a config flag for bazel\n\nChange-Id: Idb383f35ca0fec4cb7329e9d991f08f28cf9b1fb\nReviewed-on: https://review.monogon.dev/c/monogon/+/2129\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "90613afdf11f7831fc0a673f2fe502c28ab93729",
      "tree": "1f524cdd0e25a3dd28ff350803d2bc296c3d6fda",
      "parents": [
        "88a76b7a89b3fc81b9135b1197e1ea6fd3698121"
      ],
      "author": {
        "name": "Tim Windelschmidt",
        "email": "tim@monogon.tech",
        "time": "Thu Jul 20 14:26:18 2023 +0200"
      },
      "committer": {
        "name": "Tim Windelschmidt",
        "email": "tim@monogon.tech",
        "time": "Wed Jul 26 12:04:58 2023 +0000"
      },
      "message": "metropolis/node/kubernetes: fix mtls authentication to (controller-manager|scheduler)\n\nPreviously it wasn\u0027t possible to authenticate against the services\nas they had no CA they trusted for the sent client certificate.\n\nChange-Id: Ic7cd2419a9e3496680a9393424c7ca1780c4d38c\nReviewed-on: https://review.monogon.dev/c/monogon/+/1951\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "150f24a5421dc1449d79a801524a7c98754f7bca",
      "tree": "c4f69b7e6260a241f3d946b36eda309e2539ccba",
      "parents": [
        "901c7326fe067707812757e4e9409f756edf0e37"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Jul 13 20:11:06 2023 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Jul 19 12:17:34 2023 +0000"
      },
      "message": "metropolis/test: use localregistry\n\nThis removes everything but the preseed test image from the preseed\nimage pool, instead opting to serve all test image via localregistry.\n\nThe registry API is served from a dedicated IP inside the virtual\nnetwork and forwarded to an ephemeral listener on the host. The relevant\ninfrastructure is added to the launch package.\n\nAs it is required to add configuration to containerd for this registry\nanyways as it does not and should not have TLS we take that opportunity\nto give it a descriptive name (test.monogon.internal).\n\nVisibilities of images are also adjusted as they are now referenced much\ncloser to their point of use.\n\nAgainst main this saves 51MiB in bundle size (289MiB -\u003e 238MiB).\n\nChange-Id: I31f732eb8c4ccec486204f35e3635b588fd9c85b\nReviewed-on: https://review.monogon.dev/c/monogon/+/1927\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n"
    },
    {
      "commit": "d1c392a788043f2bd82d936a334bd01e1be97421",
      "tree": "1bdf2d7a4d7a54b2d8bda0c3c729eb2c9eef90a4",
      "parents": [
        "0553f885b84ca97384ffdb942b30c67d23166a16"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Jul 06 19:10:56 2023 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Tue Jul 11 10:48:05 2023 +0000"
      },
      "message": "m/n/kubernetes: fix CSI local PV publishing\n\nExperimentally confirmed to fix pods stuck in creating because the\nmount syscall failed with ENOENT because the target directory did not\nexist. The current CSI spec now explicitly says that creation of\ntarget_path is the responsibility of the storage plugin, so let\u0027s\nactually create that directory.\n\nChange-Id: I57d8086f2e70040095206c36e4302b352d06bb84\nReviewed-on: https://review.monogon.dev/c/monogon/+/1914\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n"
    },
    {
      "commit": "0300077941db0edfdcac0ae42e4a5dad3e8d3fd7",
      "tree": "979cfc5f4269d3428b725acd79b9a216db8a6f82",
      "parents": [
        "a2ee88d585b9b8603f47544c95f09b380b92b5e2"
      ],
      "author": {
        "name": "Tim Windelschmidt",
        "email": "tim@monogon.tech",
        "time": "Mon Jul 03 02:19:28 2023 +0200"
      },
      "committer": {
        "name": "Tim Windelschmidt",
        "email": "tim@monogon.tech",
        "time": "Tue Jul 04 18:58:49 2023 +0000"
      },
      "message": "metropolis/node: allow all ports as NodePorts except special ones\n\nAs we dont have hostPort implemented we can only  provide NodePorts to\napplications. To allow apps to use all ports we have to increase the range\nbut have to prevent them from using reserved metropolis ones. This is\ncurrently prevented by patching the allocator and hardcode all of them.\n\nChange-Id: I7c0e8b17643d1ec03e1a1b678bc6276881b1c5e5\nReviewed-on: https://review.monogon.dev/c/monogon/+/1884\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "4599aa2dfa42a7b694ad295bc700db03de96d7f5",
      "tree": "411035d2b647dcb1adc68db8f22c4384befa8294",
      "parents": [
        "6f5995153827f2b191cc2faebe21ca58764af33b"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Jun 28 13:09:32 2023 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Jun 28 12:20:57 2023 +0000"
      },
      "message": "m/n/k8s: fix start after unclean shutdown\n\nBoth the kvmdevice as well as the CSI runnables listen on Unix sockets.\nThese are normally removed on close (this is actually the default for\nsockets opened wiht ListenUnix, thus drop setting this), but when an\nunclean shutdown occurs they persist. Since one cannot listen on an\nalready-existing socket, opportunistically remove them before listening.\n\nChange-Id: I11d986a2816fde3d7ffef0817ae3bbf39bba4faf\nReviewed-on: https://review.monogon.dev/c/monogon/+/1867\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n"
    },
    {
      "commit": "2f7e0a281e72ae45fff6c4d79934442367475b81",
      "tree": "4dcd2233a274bef4645c4bfbbbd62f072d11481a",
      "parents": [
        "c49b207a66a994ccda382d685022d08cbd9ee582"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Jun 22 16:56:13 2023 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Jun 22 16:36:33 2023 +0000"
      },
      "message": "m/node: enlarge K8s networks\n\nFor bigger clusters, the current 10.0.0.0/16 subnet is far too small.\nSwitch to 10.192.0.0/11 which should be out of the way of most of our\ntest infra and is large enough for 8192 nodes with 253 pods which is\nbig enough for the time being. Also migrate the service network\nto 10.224.0.0/16 and make it much bigger. It does not need to be in the\npod CIDR, so move it out of there.\nBut for large clusters this will continue to be a problem until we have\na better allocation algorithm or switch to IPv6 with 464xlat (which\nis not supported on Linux currently however).\n\nChange-Id: Ib3a019fffacec2172721f04c01133b44bffba73b\nReviewed-on: https://review.monogon.dev/c/monogon/+/1848\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "51a3ed59a1408fe5d8103dca5b6a04dbaa4e5b6a",
      "tree": "b17dd748b088b4c7899c4aee0a1ab862a59509b4",
      "parents": [
        "186109c55db3121749311fc2e954be0eaccdf249"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Jun 21 16:45:15 2023 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Jun 22 12:33:31 2023 +0000"
      },
      "message": "m/n/k/containerd: change default runtime to runc\n\nFor high-security usecases it might still make sense to force gVisor,\nbut generally people expect runc as the default runtime. gVisor can\nstill be used by specifying a runtimeclass in the pod.\n\nChange-Id: Idc02275fd00c2a7dff3ce6949268294afa5644eb\nReviewed-on: https://review.monogon.dev/c/monogon/+/1839\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n"
    },
    {
      "commit": "0e291a193cbfd0b169e749e7f28adc954a58f560",
      "tree": "01b7ad51279b9060c3c967a0061826d37dbfaf01",
      "parents": [
        "4264b8c641109c05c4828b40cd2e01e686890903"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Jun 01 12:22:45 2023 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Tue Jun 13 13:03:53 2023 +0000"
      },
      "message": "m/node: clean up DNS service\n\nThe primary change in here is that CoreDNS now only listens on the\nloopback interface by default.\nThis fixes #217 as it cannot be accessed from the outside anymore.\nSince the containers do not share the host network namespace, they can\nnow no longer access the DNS service. This is solved by introducing a\nnew Network Service API to add listener IPs and using a link-local IP,\n169.254.77.53 for the container DNS.\nWhile at it, I cleaned up various parts of the DNS code.\n\nChange-Id: Id7b618f62690032db335e8478b9de84410c210a1\nReviewed-on: https://review.monogon.dev/c/monogon/+/1759\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "2cfafc9a4c34152dd93b58aa82df1720fb4dd6d6",
      "tree": "7a944999ab576f4b421651c2c4d513b0b572a1be",
      "parents": [
        "d0be371ea905c3729f98d91d255d775b7c5193d3"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 21 16:42:47 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Apr 13 14:03:02 2023 +0000"
      },
      "message": "metropolis/node/kubernetes: move worker services to KubernetesWorker nodes\n\nThis finalizes the Big Split. After this change, nodes will only run a\nkubelet (and related services) if they have a KubernetesWorker role\nattached.\n\nThe first node in a new cluster now starts out with KubernetesController\nand ConsensusMember. All joined nodes start with no roles attached.\n\nChange-Id: I25a059318450b7d2dd3c19f3653fc15367867693\nReviewed-on: https://review.monogon.dev/c/monogon/+/1380\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "b565cc679cd5af598dc863890a3e1cce98eb1c57",
      "tree": "eddf2b4b5636b0c5086cf8fb874927cdc73659c1",
      "parents": [
        "9104e381ab7a2c90087843de00204eed9ed7cf99"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Mar 30 18:43:51 2023 +0200"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Apr 06 14:19:17 2023 +0000"
      },
      "message": "m/n/core/clusternet: grab external IP address prefix from network service\n\nThis moves the logic for merging the node IP and node prefixes from the\nsubmitter of the prefixes into the clusternet logic itself.\n\nThis means clusternet now has two independent sources of prefix data:\nthe network service\u0027s external IP address, and the kubelet\u0027s node\nprefixes.\n\nThis simplifies use in a worker/controller split, where a controller\nnode normally doesn\u0027t submit any prefixes as it\u0027s not running a kubelet\nor kubelet-adjacent prefixes - but we still want it to submit its\nexternal IP address.\n\nChange-Id: I46c9430228ce966426d3a8d33a765ecfdfca0d29\nReviewed-on: https://review.monogon.dev/c/monogon/+/1479\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "7920852953a4b0846ddb16cb82a038b064ba473a",
      "tree": "afa919bc332a93bd0666714843632cffa1095170",
      "parents": [
        "4e6eae2bec769a565eece47438fcb594e7da2765"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 28 20:14:58 2023 +0200"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Wed Apr 05 14:14:44 2023 +0000"
      },
      "message": "m/n/kubernetes: use node clusternet to submit cluster networking routes\n\nThis completes the work on using the new cluster networking service from\nKubernetes, thereby allowing non-worker nodes to participate in cluster\nnetworking.\n\nChange-Id: I7f3759186d7c8cc49833be29963f82a1714d293e\nReviewed-on: https://review.monogon.dev/c/monogon/+/1418\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "6d6ed31da287a055b18dedaa1fd70420994c66ae",
      "tree": "59de543dc0ad9bed120c29c62fdf19508b1ce341",
      "parents": [
        "1fdab13a2ea1411b332f67cfa9b1216753b9eb11"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Mon Mar 27 11:04:14 2023 +0200"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Mon Apr 03 14:02:00 2023 +0000"
      },
      "message": "m/n/kubernetes/{clusternet,nfproxy}: log informer errors\n\nChange-Id: I9ea1444c7042dd25c25cecc6b6da054554010a85\nReviewed-on: https://review.monogon.dev/c/monogon/+/1447\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "fe39cc21b69bb9fd9f641dfc6b3514386cbb0d4c",
      "tree": "2c4ff1bc567bb6b5e276bef2028fc196cbc37f2b",
      "parents": [
        "e88ffe9af09b2740bfe0c47ec1efae0380d4f706"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 21 14:21:54 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Mar 23 12:21:21 2023 +0000"
      },
      "message": "m/n/c/curator: implement IssueCertificate for Kubernetes Workers\n\nThis is not yet used in this change, but will be very soon.\n\nChange-Id: I0283941f15211515537d2b23e0c8cd72dc2d77c5\nReviewed-on: https://review.monogon.dev/c/monogon/+/1378\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "e88ffe9af09b2740bfe0c47ec1efae0380d4f706",
      "tree": "da2fac1e9bd4343250bc01c1bff81062d7ee60a7",
      "parents": [
        "e6719b379b19ad4439b5fd38da035a3043008d97"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 21 13:38:46 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Mar 23 12:04:17 2023 +0000"
      },
      "message": "m/n/kubernetes: factor out generating KPKI, support multiple endpoints in Kubeconfig\n\nChange-Id: I0e648c24ffa134314a03715575d1af1b925fd450\nReviewed-on: https://review.monogon.dev/c/monogon/+/1377\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "d85a40ab6fa79efca11b02522b89855952226f33",
      "tree": "408907867ea99dbc07a5d61ec70b2c8478a57414",
      "parents": [
        "d6fee31d519a22720ae0342e02ccdba405b62ded"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Wed Mar 22 11:14:08 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Wed Mar 22 11:57:36 2023 +0000"
      },
      "message": "m/n/kubernetes/service: only note lack of reconciliation every 10 seconds\n\nChange-Id: I6e070325daa265e2e0a65bc5f5e69cc5c9869a04\nReviewed-on: https://review.monogon.dev/c/monogon/+/1384\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n"
    },
    {
      "commit": "6fdca3f2e8b60f53f69c8cd39a02109cc47059ac",
      "tree": "f875b3e103037078ece4842fcdd77cbb87d7a6cf",
      "parents": [
        "f71fe9278055d5a892448554aa7c59862256db7d"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Mon Mar 20 17:47:07 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Wed Mar 22 11:33:51 2023 +0000"
      },
      "message": "m/n/kubernetes: start splitting, run apiproxy\n\nThis begins the process to split the Kubernetes service into a\ncontroller and a worker service.\n\nFirst, we rename the existing service to a Controller, create a Worker\nservice, and make the Worker service run our new tinylb-based apiserver\nloadbalancer.\n\nWe also make the roleserver aware of this change by making it spawn both\nthe controller and worker services according to roles.\n\nWe will move services to the Worker in follow up change requests.\n\nChange-Id: I76e98baa0603ad5df30b5892dd69154b895b35fa\nReviewed-on: https://review.monogon.dev/c/monogon/+/1374\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "ce19acc9d66055d912287d9f1f26c08d3df55aa8",
      "tree": "6aedbe2ab0aef40955f3d416013ff59e1aec0139",
      "parents": [
        "1f8cad7568ad2e8e539fe44f1b2d51e1f2a19fd5"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 21 16:28:07 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 21 17:56:08 2023 +0000"
      },
      "message": "m/n/kubernetes: make CSI provisioner more debuggable\n\nChange-Id: I22292e627ceac0d41a7711964517a53e63636c3e\nReviewed-on: https://review.monogon.dev/c/monogon/+/1379\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "356cbf3e49af75d9cccf92fd8d0a3236727f6761",
      "tree": "a8865bc1422fdde0d8f5a63f8e7e100156dccfeb",
      "parents": [
        "f9bdf3126488a2728e265a2b28cba564c8072e04"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Mar 16 17:52:20 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Mar 16 21:22:24 2023 +0000"
      },
      "message": "m/n/kubernetes: run reconciler before starting more services\n\nThis makes sure we successfully ran the reconciler at least once before\nattempting to running more than the apiserver. It saves us from a whole\nbunch of services complaining about not having the right permissions to\n(yet) access the cluster.\n\nChange-Id: I605eae9d6bbcc16a9dcb971caa26ee56a06e5d5b\nReviewed-on: https://review.monogon.dev/c/monogon/+/1358\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n"
    },
    {
      "commit": "b033b380387a999b7ad19f9d001c42ec570c8945",
      "tree": "6093a955f5c08f29e6590fb71781849d100a3e0e",
      "parents": [
        "d8290c8082f752f52d0ba1c765f668e2992bc5d4"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 07 20:06:36 2023 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Mar 07 22:29:46 2023 +0000"
      },
      "message": "*: fix gomodproxy compatibility\n\nThis is necessary for the source to be fetchable from third-party Go\nprojects (currently via a replace directive, as source.monogon.dev isn\u0027t\ngo-getable). Otherwise, `go mod tidy` complains:\n\nreading https://sum.golang.org/lookup/github.com/monogon-dev/monogon@v0.0.0-20230223122556-665b10937eb8: 404 Not Found\n\tserver response:\n\tnot found: create zip: build/analysis/BUILD.bazel: case-insensitive file name collision: \"BUILD\" and \"build\"\n\tbuild/analysis/importsort/BUILD.bazel: case-insensitive file name collision: \"BUILD\" and \"build\"\n\tbuild/analysis/importsort/classify.go: case-insensitive file name collision: \"BUILD\" and \"build\"\n\tbuild/analysis/importsort/importsort.go: case-insensitive file name collision: \"BUILD\" and \"build\"\n\tbuild/analysis/importsort/importsort_test.go: case-insensitive file name collision: \"BUILD\" and \"build\"\n\tbuild/analysis/importsort/testdata/README.md: case-insensitive file name collision: \"BUILD\" and \"build\"\n\t[Truncated: too long.]\n\nChange-Id: If5947be74f7dfcf4ba4bd79c4dc37589f324b891\nReviewed-on: https://review.monogon.dev/c/monogon/+/1223\nTested-by: Leopold Schabel \u003cleo@monogon.tech\u003e\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n"
    },
    {
      "commit": "98206b93355539404dccd04bd0882aa59ec8cd8b",
      "tree": "b48ea9471e0451dd88e4606ba77eef5164fb3694",
      "parents": [
        "aaa4d45a0a88e69137f4b946f26f3ce5f8ad0642"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Jun 22 16:21:50 2022 +0000"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Jun 23 15:31:12 2022 +0000"
      },
      "message": "mn/n/kubernetes: fix warnings\n\nThis fixes a warning that we do not explicitly set the root cgroup and\none that we specify the container runtime type explicitly; in 1.24\neverything other than \"remote\" has been dropped.\n\nChange-Id: I7beb0fbbbd5e38715b8b1e76dac99d2d7c4275d5\nReviewed-on: https://review.monogon.dev/c/monogon/+/785\nTested-by: Jenkins CI\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "78cefcafa315af20d9f603fefd1423fe7bab7483",
      "tree": "b5d8ab0ce4652e30ace81c0cedf64b847260612d",
      "parents": [
        "4025c9bf83aa038c8858c82bc80bd65acecd7210"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Mon Jun 20 12:59:55 2022 +0000"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Tue Jun 21 11:44:25 2022 +0000"
      },
      "message": "m/n/kubernetes: factor out cluster domain\n\nThis removes the hardcoded Kubernetes cluster domain and pushes it out\nto a single place at the root of the Kubernetes supervisor tree.\nThis will later be aligned with the cluster domain specified in the\nidentity design document, currently this does not change any behavior.\n\nIt also removes a bogous SAN from the Kubernetes API server certificate\n(kubernetes.default.svc.cluster) for which there is no corresponding\nsearch path.\n\nChange-Id: I30b8907a7b846415f5002c09a24d2d37930a9cd1\nReviewed-on: https://review.monogon.dev/c/monogon/+/773\nTested-by: Jenkins CI\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "83d793ddcd4f75b3653255df5dac154ac3de4e87",
      "tree": "d79840465c92dddb048f6483c2e1d824784ee8d7",
      "parents": [
        "83a28c93a0e48f500db619492f24f96938cb9b00"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Mon Apr 25 11:17:47 2022 +0200"
      },
      "committer": {
        "name": "Sergiusz Bazanski",
        "email": "serge@monogon.tech",
        "time": "Mon Apr 25 19:26:50 2022 +0000"
      },
      "message": "m/n/kubernetes: remove --port flag from services\n\nFrom logs:\n\n  Flag --port has been deprecated, This flag has no effect now and will be removed in v1.24.\n\nSo that\u0027s what we do. We had this flag only set to disable insecure\nserving, and insecure serving has been removed in upstream, thereby\nrendering the use of this flag a no-op.\n\nController-manager PR: https://github.com/kubernetes/kubernetes/pull/96216\nScheduler PR: https://github.com/kubernetes/kubernetes/pull/96345\n\nChange-Id: If9009aa6f7c72a5ec8b7baf2326964167059c0a1\nReviewed-on: https://review.monogon.dev/c/monogon/+/665\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "d13c1c64387ca9a83bb832a3faa5c4b07268d265",
      "tree": "0c0f534db4726e4400486aad25235e8c573d455e",
      "parents": [
        "79a1a8f9dd49afe8e0a2364c4586b8f39525b204"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Mar 30 19:58:58 2022 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Tue Apr 05 10:35:29 2022 +0000"
      },
      "message": "treewide: switch to gomod and bump everything\n\nThis switches version resolution from fietsje to gomod and updates\nall Go dependencies. It also bumps rules_go (required by gVisor) and\nswitches the Gazelle naming convention from go_default_xxx to the\nstandard Bazel convention of the default target having the package\nname.\n\nSince Kubernetes dropped upstream Bazel support and doesn\u0027t check in\nall generated files I manually pregenerated the OpenAPI spec. This\nshould be fixed, but because of the already-huge scope of this CL\nand the rebase complexity this is not in here.\n\nChange-Id: Iec8ea613d06946882426c2f9fad5bda7e8aaf833\nReviewed-on: https://review.monogon.dev/c/monogon/+/639\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\n"
    },
    {
      "commit": "79a1a8f9dd49afe8e0a2364c4586b8f39525b204",
      "tree": "2bf599ded06a18c5850cbf513e94fd0cf7ba3776",
      "parents": [
        "a8e23543e792505ea8a40bf544d857163696a25b"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Mar 31 17:19:07 2022 +0200"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Mon Apr 04 19:45:00 2022 +0000"
      },
      "message": "m/n/k/authproxy: make use of SPDY through proxy work\n\nKubernetes still uses SPDY for interactive/streaming-type calls (like\nexec or port-forward). Our proxy uses a HTTP/2 backend connection to\nKubernetes\u0027s API server. A HTTP/2 stream cannot be upgraded to SPDY\nmeaning these API requests all fail. This implements a slightly ugly\nworkaround by using two HTTP transports, a regular transport which\nsupports HTTP/2 and a fallback transport which does not. The proxy\nselects the fallback transport if it detects that the request is trying\nto upgrade to SPDY.\n\nChange-Id: Idd44f58d07ec5570ddf8941ae7595225f47f254d\nReviewed-on: https://review.monogon.dev/c/monogon/+/645\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "cc078df2124306799c66786833746999259ea792",
      "tree": "43807fcfec2196430b4bd4def124dad2231451db",
      "parents": [
        "8c2c771a750f30b3edf240fc8352e777795e989b"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Thu Dec 23 11:51:55 2021 +0100"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Feb 02 14:07:37 2022 +0000"
      },
      "message": "m/n/kubernetes: implement Metropolis authenticating proxy\n\nThis implements an authenticating proxy for K8s which can authenticate\nMetropolis credentials and passes the extracted identity information\nback to the Kubernetes API server. It currently only handles user\nauthentication, machine-to-machine authentication is still done by the\nAPI server itself. It also adds a role binding to allow full access\nto the owner as we do not have an identity system yet.\n\nChange-Id: I02043924bb7ce7a1acdb826dad2d27a4c2008136\nReviewed-on: https://review.monogon.dev/c/monogon/+/509\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "1de8b1845e75dc1e020df21b997b2d6fc66fb65e",
      "tree": "4a41005b1931aa13c3ed4a1b0732de31482a6eb8",
      "parents": [
        "367f759f54e59b24b55024c8070513f9f7e6f4c1"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Tue Dec 21 17:15:18 2021 +0100"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Wed Dec 22 15:57:16 2021 +0000"
      },
      "message": "m/node: pass node identity into k8s\n\nThis plumbs through the node identity to K8s as an identity.Node\nobject and gets rid of the os.Hostname invocation that passed around\nthis data out-of-band. It also changes everything in its path to use\nthe newer identity.Node object instead of a plain string so that the\nMetropolis Identity CA is more accessible.\n\nChange-Id: I6db8e1db7e333c0ea364aefd61c27bf50acc25f3\nReviewed-on: https://review.monogon.dev/c/monogon/+/505\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "764a2de7911a42d57720911332a12895f0aad707",
      "tree": "dd0e31cee8fb5c753a762462e9eb16f776c3ec73",
      "parents": [
        "e65731049afb6fd49da80f064fa40a28c9d5741d"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Mon Nov 22 16:26:36 2021 +0100"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@monogon.tech",
        "time": "Mon Nov 22 20:39:51 2021 +0000"
      },
      "message": "tree-wide: rewrite ioutil functions to their replacements\n\nThe ioutil package has been deprecated in Go 1.16 [1]. This CL removes\nall our own users of that package and rewrites them to use their\nreplacements in the os package. I initially wanted to do this with a\ngofix but because all replacements were signature-compatible I just\ndid it with a few string replaces and then ran goimports to fix up the\nimports.\n\nI intentionally didn\u0027t rewrite the patches as that would require a\ndifferent process and is IMO of less value.\n\n[1] https://github.com/golang/go/issues/42026\n\nChange-Id: Iac6663a1f1ee49f9b1c6e4b3d97e73f2c3b54a13\nReviewed-on: https://review.monogon.dev/c/monogon/+/449\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n"
    },
    {
      "commit": "52304a8aa84604846e316e28c955b67e68c52f34",
      "tree": "df8518bb50b9665af7f4897665d8aa16f4a43e7f",
      "parents": [
        "ba7bf7dc83c15cbd94a1f71b7992df7d7fc7d752"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Fri Oct 29 16:56:18 2021 +0200"
      },
      "committer": {
        "name": "Sergiusz Bazanski",
        "email": "serge@monogon.tech",
        "time": "Wed Nov 03 11:36:20 2021 +0000"
      },
      "message": "m/node: implement Port type for node ports\n\nThis allows us to use %v/%s to get a pretty port name where needed.\n\nWe also drive-by remove MasterServicePort which is a leftover from\na pre-curator cluster service implementation.\n\nChange-Id: Id8feddf87269b13dd1dad2460a015c1a7ecbc6d7\nReviewed-on: https://review.monogon.dev/c/monogon/+/418\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "96043bc1cb55b1271b21309b2011d64d2361a0fd",
      "tree": "b4db59595d8635154de74b0a244a6bb28bc52d2d",
      "parents": [
        "3379a5d0ffcd652031c135f2ffe7600272fa0093"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Oct 05 12:10:13 2021 +0200"
      },
      "committer": {
        "name": "Sergiusz Bazanski",
        "email": "serge@monogon.tech",
        "time": "Tue Oct 05 17:29:16 2021 +0000"
      },
      "message": "*: import reformats\n\nAs caused by my IntelliJ/gofmt locally. We really need to do gofmt\nchecks in CI, especially now that we nearly have the tooling ready for\nit.\n\nChange-Id: Id105ba9ad8a34b8b8e883d52d621d47b0ea888d7\nReviewed-on: https://review.monogon.dev/c/monogon/+/338\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n"
    },
    {
      "commit": "c72aa433ff68b76317233ba8805d55845e9efd1a",
      "tree": "ecdcb336a19c6cca8bbd426870b2ca023ec55207",
      "parents": [
        "080f7ff710e359f2dab0d8ace98f0aa8e443d98d"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Wed Sep 22 09:35:16 2021 +0200"
      },
      "committer": {
        "name": "Sergiusz Bazanski",
        "email": "serge@monogon.tech",
        "time": "Mon Sep 27 18:54:36 2021 +0000"
      },
      "message": "m/n/k/containerd: less verbose runsc logging\n\nThis disables debug logging on non -c dbg builds of Metropolis, making\nthe console output less verbose.\n\nThis should maybe just be \u0027fixed\u0027 by making logtree -\u003e console smarter,\nie. implement log output filters, but this will do for now - and I think\nin general we don\u0027t want to have super verbose per-syscall logging\nenabled unless necessary.\n\nThe implementation picks between two runsc .tomls to build the node\nimage with, which works for now but we might have to move to a\nfull-blown config generator (build-time or runtime) when we also start\nhaving differences between containerd.toml.\n\nChange-Id: I5539ca6f4763a769e879f7d50637aa36f3ffd29b\nReviewed-on: https://review.monogon.dev/c/monogon/+/327\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n"
    },
    {
      "commit": "5253884d51cb64c1d1afcb2d7b969f7c2b50b302",
      "tree": "10a6bf03472e9c14da2515ea7755d74bb3f660e6",
      "parents": [
        "99f477412a2e701f89f7698be1dd432adcfff17c"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@monogon.tech",
        "time": "Wed Aug 11 16:22:41 2021 +0200"
      },
      "committer": {
        "name": "Sergiusz Bazanski",
        "email": "serge@monogon.tech",
        "time": "Thu Aug 19 10:20:55 2021 +0000"
      },
      "message": "m/pkg/pki: refactor, allow for external certificates\n\nThe pki library supported managing certificates in two modes:\n\n - default, when name !\u003d \"\"\n - volatile/ephemeral, when name \u003d\u003d \"\"\n\nThe difference between the two being that default certificates were\nfully stored in etcd (key and x509 certificate), while volatile\ncertificates weren\u0027t stored at all. However, both kinds needed private\nkeys passed to the pki library.\n\nWe want to be able to emit certificates without having private keys for\nthat certificate, so we end up a third mode of operation: \u0027external\ncertificates\u0027. These are still stored in etcd, but without any\ncorresponding private key.\n\nIn the future we might actually get rid of ephemeral certificates by\nexpanding the logic of external certificates to provide a full audit log\nand revocation system, instead of matching by Certificate Name. But this\nwill do for now.\n\nWe also use this opportunity to write some simple tests for this\npackage.\n\nChange-Id: I193f4b147273b0a3981c38d749b43362d3c1b69a\nReviewed-on: https://review.monogon.dev/c/monogon/+/263\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n"
    },
    {
      "commit": "d98ad45e64b542f9945939d35cba9ebd352ff913",
      "tree": "cd8fa82c4ccd2bf0616986615f3eb2d7c4798f30",
      "parents": [
        "7f17d9b41f248f4b009f5d702622616f62d0a2fa"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Thu Jun 17 15:55:17 2021 +0200"
      },
      "committer": {
        "name": "Sergiusz Bazanski",
        "email": "serge@nexantic.com",
        "time": "Tue Jun 22 12:05:20 2021 +0000"
      },
      "message": "metropolis/n/kubernetes/pki: remove verbose \u0027ensure\u0027 cert logging\n\nChange-Id: Ie12f12a2966282d364730a1c7a148fae78ab236d\nReviewed-on: https://review.monogon.dev/c/monogon/+/190\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n"
    },
    {
      "commit": "216fe7b3ae949376467f626f339423a31ea7da97",
      "tree": "b0fe587b671a76bf6229339825d2a61df7fc847b",
      "parents": [
        "6ebdc418f3c4799c12368e34ea78dc9c9757fb54"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Fri May 21 18:36:16 2021 +0200"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Fri May 28 17:54:03 2021 +0200"
      },
      "message": "*: reflow comments to 80 characters\n\nThis reformats the entire Metropolis codebase to have comments no longer\nthan 80 characters, implementing CR/66.\n\nThis has been done half manually, as we don\u0027t have a good integration\nbetween commentwrap/Bazel, but that can be implemented if we decide to\ngo for this tool/limit.\n\nChange-Id: If1fff0b093ef806f5dc00551c11506e8290379d0\n"
    },
    {
      "commit": "99d210d48afc2207ffb4064c58068faa9449a981",
      "tree": "781a73c0e5bf7e9ff586653eef0cce594b90def0",
      "parents": [
        "4e0dba61375bcb989d86cacf18cf00ebfe6303b4"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Mon May 17 15:29:18 2021 +0200"
      },
      "committer": {
        "name": "Leopold Schabel",
        "email": "leo@nexantic.com",
        "time": "Tue May 18 14:06:11 2021 +0200"
      },
      "message": "m/n/k/plugins/kvmdevice: export resource name variable for easier consumption\n\nTrivial change to consume the resource name of this device plugin as\na variable.\n\nTest Plan: Trivial change\n\nX-Origin-Diff: phab/D791\nGitOrigin-RevId: d71d878f87be1da5a547e17b9965f92e737b644c\n"
    },
    {
      "commit": "37050126ef89ec30cc677c272471debe55ec0d69",
      "tree": "c64a64a622ec1c3e1e72fc12a6d4252c0e803cc1",
      "parents": [
        "2999427c182463840a339cf0e82885d8a3b6e79f"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Tue Mar 30 14:00:27 2021 +0200"
      },
      "committer": {
        "name": "Leopold Schabel",
        "email": "leo@nexantic.com",
        "time": "Tue Apr 13 11:04:01 2021 +0200"
      },
      "message": "Implement Block PVCs in our storage backend\n\nThis implements full support for Block PVCs in our Kubernetes storage backend.\nThe block PVCs are backed by files made available to the pods using loop devices and\nhave read-only and online expansion support.\n\nThis also requires a Kubernetes patch because they call losetup if block PVCs are used\nwith CSI to establish a form of lock on the backing block device. This lock is not\nexclusive and does absolutely nothing for our use case and could get very expensive\non dense machines so I removed it.\n\nTest Plan: Comes with E2E tests\n\nX-Origin-Diff: phab/D746\nGitOrigin-RevId: 430d3f445286c0d3498b2153df333a19f3fcab89\n"
    },
    {
      "commit": "d8af5bf4c14a5c53d1736695a1210b6eea4d246e",
      "tree": "83e4c35e105d8fb0e5bf71ac8c93bbd3e7f964b4",
      "parents": [
        "4e090357c4f1f3bae53a5f2feaf20ea5e1bbbe61"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Tue Mar 16 13:38:29 2021 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Tue Mar 16 13:38:29 2021 +0100"
      },
      "message": "metropolis/node: use Event Value for network status\n\nThis moves over the GetIP API to use our fancy new event/value library.\nThe consumers of this data are currently the cluster manager and the\nkubernetes root service. Both are migrated over.\n\nTest Plan: Refactor, covered by E2E tests.\n\nX-Origin-Diff: phab/D711\nGitOrigin-RevId: 8a1e0dd35236d55492722f4439323cb2ee9574fc\n"
    },
    {
      "commit": "4e090357c4f1f3bae53a5f2feaf20ea5e1bbbe61",
      "tree": "335ec273335722befdeca623b8f3f787a2cd6571",
      "parents": [
        "0ed2f96a3a86aff2c9ce36289aa5d58a75f4d59b"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Wed Mar 17 17:44:41 2021 +0100"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Wed Mar 17 17:44:41 2021 +0100"
      },
      "message": "Add KVM device plugin\n\nThis adds a KVM device plugin for Kubernetes. This plugin allows for unprivileged access and granular\ncontrol of KVM access.\n\nTest Plan: Tested in subsequent revision\n\nX-Origin-Diff: phab/D739\nGitOrigin-RevId: 5cd738a47d24e7bfdc29bbd1a31537209e1ebf46\n"
    },
    {
      "commit": "056042962060369bd7607ecfea51c515fc3a8140",
      "tree": "86a6dbf7b1781ed2f5baf332938d4e8211353112",
      "parents": [
        "0ab4edafde3eb22e111e75d6aa5e29faa92c30ca"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Fri Mar 12 17:47:21 2021 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Fri Mar 12 17:47:21 2021 +0100"
      },
      "message": "m/node/kubernetes: parse klog output from services\n\nThis translates Kubernetes\u0027 logging ingo logging that we can\nquery/filter more easily.\n\nTest Plan: We don\u0027t test resulting logs from the system, and I\u0027m not sure we should?\n\nX-Origin-Diff: phab/D716\nGitOrigin-RevId: ba3f42b9a4e3172bf058bd7dce4283f50dc8e69d\n"
    },
    {
      "commit": "9411f7c2ed0afbbf617075ab37901addc76fadfb",
      "tree": "f1f62aa538ba3c2265815d2dbe942377264850a5",
      "parents": [
        "0de189355c6afad6f677029d90fa40dee824141b"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Wed Mar 10 13:12:53 2021 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Wed Mar 10 13:12:53 2021 +0100"
      },
      "message": "m/node/kubernetes/pki: refactor out CA functionality\n\nThis factors out all non-k8s-specific CA functionality from\nmetropolis/node/kubernetes/pki into metropolis/pkg/pki.\n\nThis will allow us to re-use the same PKI-in-CA system to issue\ncertificates for the Metropolis cluster and nodes.\n\nWe also drive-by change some Kubernetes/PKI interactions to make things\ncleaner. Notably, this implements Certificate.Mount to return a\nfileargs.FileArgs containing all the files neede to use this\nCertificate.\n\nTest Plan: covered by current e2e tests. An etcd harness to test this independently would be nice, though.\n\nX-Origin-Diff: phab/D709\nGitOrigin-RevId: bdc9ff215b94c9192f65c6da8935fe2818fd14ad\n"
    },
    {
      "commit": "74e8e5c35fea1ec9ce13c8a2d16100bab45d42d9",
      "tree": "3ec734c4b86fed54a5039623c789dd4b805b3b6e",
      "parents": [
        "19eb0006edc79edc53fb53ea0eed67e93f4c8eba"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Tue Jan 26 14:00:50 2021 +0100"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Tue Jan 26 14:00:50 2021 +0100"
      },
      "message": "Make containerd work with read-only root\n\nThis makes containerd work with a read-only root. There were a few config mistakes on our side which\ncaused it to write to the rootfs (mostly leftovers from the switch to /ephemeral) and a semi-hardcoded path\nin /var/lib/cni from containernetworking/cni. This is technically configurable, but it would require patching\nthree different repos (see diff message) and getting all of them to agree to take the change and wait for\nit to propagate to all repos (containerd is known to be slow to release stuff). So let\u0027s just hack in\nthis one-line diff for the time being.\n\nTest Plan: Should be covered by existing tests\n\nX-Origin-Diff: phab/D694\nGitOrigin-RevId: 0e8f5dbfb216539c16e64130af9fe1023722ae1b\n"
    },
    {
      "commit": "31370b07f0df2dc2765d812d4ce00a6b35185b16",
      "tree": "15563902eee9591083284441c8505b084b275d0a",
      "parents": [
        "313816f41244d7520eb2b6f8c231328ee5b7a4ef"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Thu Jan 07 16:31:14 2021 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Thu Jan 07 16:31:14 2021 +0100"
      },
      "message": "*: git.monogon.dev -\u003e source.monogon.dev\n\nThis implements T882, setting our (virtual) GOPATH to source.monogon.dev\nfor this repository.\n\nTest Plan: Refactor, CI only.\n\nX-Origin-Diff: phab/D686\nGitOrigin-RevId: c5e2309089948ffc3a98e68e2e0e1cbb157d3a36\n"
    },
    {
      "commit": "0be9be88224dd87eedb10436b11615fa59862271",
      "tree": "2cffcd0ca273ada48c0b42a36bd25bb1cc2da35c",
      "parents": [
        "549b72b2d65051403301f53111509f77e88b379b"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Thu Jan 07 15:23:44 2021 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Thu Jan 07 15:23:44 2021 +0100"
      },
      "message": "metropolis: Lock down visibility rules\n\nThis formalizes the package structure introduced by D683.\n\nTest Plan: Pure refactor, CI only.\n\nX-Origin-Diff: phab/D684\nGitOrigin-RevId: 574aa14c71faf94f4a5c02a2110e2e3fef7d36ac\n"
    },
    {
      "commit": "549b72b2d65051403301f53111509f77e88b379b",
      "tree": "b4e523d5d17e8130545e58b58870b4a18118a780",
      "parents": [
        "696f39abb19ffcca03e9fc5a98681338216b1e7f"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Thu Jan 07 14:54:19 2021 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Thu Jan 07 14:54:19 2021 +0100"
      },
      "message": "metropolis: unify utility packages\n\nOne last sweeping rename / reshuffle.\n\nWe get rid of //metropolis/node/common and //golibs, unifying them into\na single //metropolis/pkg meta-package.\n\nThis is to be documented somwhere properly, but here\u0027s the new logic\nbehind selecting where to place a new library package:\n\n - if it\u0027s specific to k8s-on-metropolis, put it in\n   //metropolis/node/kubernetes/*. This is a self-contained tree that\n   other paths cannot import from.\n - if it\u0027s a big new subsystem of the metropolis core, put it in\n   //metropolis/node/core. This can be imported by anything in\n   //m/n (eg the Kubernetes code at //m/n/kubernetes\n - otherwise, treat it as generic library that\u0027s part of the metropolis\n   project, and put it in //metropolis/pkg. This can be imported by\n   anything within //metropolis.\n\nThis will be followed up by a diff that updates visibility rules.\n\nTest Plan: Pure refactor, CI only.\n\nX-Origin-Diff: phab/D683\nGitOrigin-RevId: 883e7f09a7d22d64e966d07bbe839454ed081c79\n"
    },
    {
      "commit": "696f39abb19ffcca03e9fc5a98681338216b1e7f",
      "tree": "3eb962a59b2af0c3fb3cf40a05c405ae23b7f8a9",
      "parents": [
        "81de89b8675ee0ce677225ffef1cd3ee6ad9f56f"
      ],
      "author": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Tue Dec 22 16:54:01 2020 +0100"
      },
      "committer": {
        "name": "Lorenz Brun",
        "email": "lorenz@nexantic.com",
        "time": "Tue Dec 22 16:54:01 2020 +0100"
      },
      "message": "Make kube-apiserver use supervisor helper for commands\n\nAll other Kubernetes services already use this and it enables them to log\ninto logtree. Make kube-apiserver also do the same.\n\nTest Plan: Covered by existing tests\n\nX-Origin-Diff: phab/D680\nGitOrigin-RevId: 59df1342edc2cb27c22ffa9b4eb9101d7d1b400f\n"
    },
    {
      "commit": "662b5b3119b0798980b887d1ef9fa1b5632aa7fb",
      "tree": "3e1fc4ab033530e6d579112ba500d2c6edb43368",
      "parents": [
        "39f2f691726dc6e0a291aa8609085b835a313dad"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Mon Dec 21 13:49:00 2020 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Mon Dec 21 13:49:00 2020 +0100"
      },
      "message": "smalltown -\u003e metropolis\n\nThis pass removes all mentions of Smalltown, both from code and comments,\nand replaces them with appropriate new terminology.\n\nTest Plan: Refactor, covered by CI.\n\nX-Origin-Diff: phab/D674\nGitOrigin-RevId: 04a94d44ef07d46f7821530da5614daefe16d7ea\n"
    },
    {
      "commit": "77cb6c5ec3acadf02ad5005dd751cfbf0ec1602f",
      "tree": "7ddfcdf78c489a5d6fad7a20bd3580d803407450",
      "parents": [
        "26d41999e0c71813648c16ad84bba810c3b9d593"
      ],
      "author": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Sat Dec 19 00:09:22 2020 +0100"
      },
      "committer": {
        "name": "Serge Bazanski",
        "email": "serge@nexantic.com",
        "time": "Sat Dec 19 00:09:22 2020 +0100"
      },
      "message": "core -\u003e metropolis\n\nSmalltown is now called Metropolis!\n\nThis is the first commit in a series of cleanup commits that prepare us\nfor an open source release. This one just some Bazel packages around to\nfollow a stricter directory layout.\n\nAll of Metropolis now lives in `//metropolis`.\n\nAll of Metropolis Node code now lives in `//metropolis/node`.\n\nAll of the main /init now lives in `//m/n/core`.\n\nAll of the Kubernetes functionality/glue now lives in `//m/n/kubernetes`.\n\nNext steps:\n     - hunt down all references to Smalltown and replace them appropriately\n     - narrow down visibility rules\n     - document new code organization\n     - move `//build/toolchain` to `//monogon/build/toolchain`\n     - do another cleanup pass between `//golibs` and\n       `//monogon/node/{core,common}`.\n     - remove `//delta` and `//anubis`\n\nFixes T799.\n\nTest Plan: Just a very large refactor. CI should help us out here.\n\nBug: T799\n\nX-Origin-Diff: phab/D667\nGitOrigin-RevId: 6029b8d4edc42325d50042596b639e8b122d0ded\n"
    }
  ]
}