)]}' { "log": [ { "commit": "d4817496c23ab0b39b94ffc5a47ba63be0cf23ed", "tree": "b21338c9e3adbd055c72fd5000b7c9f1a9799d10", "parents": [ "2caadc7b37bca50bb50d74fd1f181c8e77915f38" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Mon Jun 16 15:03:12 2025 +0200" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Wed Jun 18 12:34:13 2025 +0000" }, "message": "treewide: bump dependencies\n\nChange-Id: Ibe397cb7eb2f2c591cb1affa5272616197a6c31c\nReviewed-on: https://review.monogon.dev/c/monogon/+/4281\nTested-by: Jenkins CI\nReviewed-by: Jan Schär \u003cjan@monogon.tech\u003e\n" }, { "commit": "62cecde6415032da48f05a178c8e9e9721dab9c2", "tree": "47617bd0bcaaf31a45eb085d946ad24db34b4f48", "parents": [ "82e8a57d0d715b9e0479000b18f50aafc63ac58a" ], "author": { "name": "Jan Schär", "email": "jan@monogon.tech", "time": "Wed Apr 16 15:24:04 2025 +0000" }, "committer": { "name": "Jan Schär", "email": "jan@monogon.tech", "time": "Tue Apr 29 06:55:58 2025 +0000" }, "message": "metropolis: use new OS image format for updates\n\nThis switches the node update implementation to the new OS image format\nbased on OCI artifacts. Updates are now fetched from an OCI registry.\n\nTo update existing clusters, build //metropolis/node:bundle in the new\nversion, then run the update command of the old version of metroctl with\nthis bundle. Once a node is updated, it only accepts updates in the\nnew format. It is possible to rollback if needed by building\n//metropolis/node:oci_image in the old version and using the new version\nof metroctl.\n\nThe node bundle target is no longer referenced anywhere, and will be\nremoved soon.\n\nChange-Id: I00ac6d0d88e379259cea52c8a106204c5eb73fe7\nReviewed-on: https://review.monogon.dev/c/monogon/+/4123\nTested-by: Jenkins CI\nReviewed-by: Tim Windelschmidt \u003ctim@monogon.tech\u003e\n" }, { "commit": "4cc3d4d23485f5144f1ee34877c5cc4ae693755f", "tree": "c7b8ae03805540f8c78ac99688ba59d2ce9aaa64", "parents": [ "5fdca5678df575870c5c2def673669e894b5158e" ], "author": { "name": "Jan Schär", "email": "jan@monogon.tech", "time": "Mon Apr 14 11:46:47 2025 +0000" }, "committer": { "name": "Jan Schär", "email": "jan@monogon.tech", "time": "Tue Apr 29 06:55:58 2025 +0000" }, "message": "cloud/agent: use new OS image format for install\n\nThis switches the Agent installation method to the new OS image format\nbased on OCI artifacts. OS images are now fetched from an OCI registry.\n\nChange-Id: Icd59a2c808fd607b95d8aaa8e60022a27fd2d091\nReviewed-on: https://review.monogon.dev/c/monogon/+/4091\nReviewed-by: Tim Windelschmidt \u003ctim@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "5ffa636e48f42aef08bd8d186db2213fc8d0d665", "tree": "6c40f21e3e1c52567734de5aa574b92c5ba10e20", "parents": [ "de57e6f273b05ebf9f58bf4a4ca9734038bcad9f" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue Jan 28 19:20:06 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Mon Feb 10 16:11:22 2025 +0000" }, "message": "treewide: Fix RPC_REQUEST_STANDARD_NAME and RPC_RESPONSE_STANDARD_NAME\n\nChange-Id: I190ade92c04313961edd4787196568216d028ba8\nReviewed-on: https://review.monogon.dev/c/monogon/+/3818\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "6d33a4342a16200d628f30ff91b169927fc2867a", "tree": "e65ad23cb6d0b795420b5ec625a757784d4c3e3b", "parents": [ "7887f758de8f9106a484ca59d9734304aa919e36" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue Feb 04 14:34:25 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Feb 06 17:03:43 2025 +0000" }, "message": "treewide: add license header and enable haslicense linter\n\nChange-Id: I873a8d4082d75e8f813d8a726a41187eea7a065e\nReviewed-on: https://review.monogon.dev/c/monogon/+/3825\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n" }, { "commit": "f525fa74802d2ea61577b188476bea2d54f816d7", "tree": "9603a1111df362b72286e12dc6a0f8f685a349bf", "parents": [ "b51ecdff88528652297cdaeefa9fd94e7d63f093" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue Jan 28 15:31:42 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Wed Feb 05 15:45:47 2025 +0000" }, "message": "treewide: Unmark SERVICE_SUFFIX rule exception as todo\n\nWe can\u0027t rename the services as it would be a breaking change.\n\nChange-Id: Ib6db1692e80ddff74819df62824b0d1311f11d7d\nReviewed-on: https://review.monogon.dev/c/monogon/+/3817\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "f4d38759600c2f308c4d4c79cfd9b4215d56b34a", "tree": "ea31800f2baa3bd6a6db28ca6d106abdf103058c", "parents": [ "3eb7d033642ebaaddccde287d5ad3c8c59f7a576" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Wed Jan 22 21:59:59 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue Jan 28 15:44:58 2025 +0000" }, "message": "treewide: Unmark ENUM_ZERO_VALUE_SUFFIX rule exception as todo\n\nWe don\u0027t really have a policy for these, they are chosen arbitrarily.\n\nChange-Id: I705ad309c2a36d794665de2482441858850a1893\nReviewed-on: https://review.monogon.dev/c/monogon/+/3805\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "a10d0cb2c85c0ede60be6cc6d2dc7a66750ddecb", "tree": "540bc92832ea12cc8427c0bcd785498dfcc30119", "parents": [ "f408e8123a3919a27d51983973a1bd41eaac1162" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Mon Jan 13 14:44:15 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Jan 23 20:14:58 2025 +0000" }, "message": "treewide: Fix ENUM_VALUE_PREFIX rule exception\n\nChange-Id: Ibc2fd66711f6aa347e88e2379c12db1898373700\nReviewed-on: https://review.monogon.dev/c/monogon/+/3804\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n" }, { "commit": "20c2ff08e3ec38d2388c80b580a129fc8a851add", "tree": "894b412c6ed8422b08401a17ab15050863734fdd", "parents": [ "2f9f624dee572823d0ead529c1507bb3605d9ae5" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Sat Jan 11 08:34:38 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Jan 23 19:05:38 2025 +0000" }, "message": "treewide: Fix FIELD_LOWER_SNAKE_CASE rule exception\n\nChange-Id: If59edf4c5483416c9779c382a5aafa58c7f73385\nReviewed-on: https://review.monogon.dev/c/monogon/+/3802\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "2f9f624dee572823d0ead529c1507bb3605d9ae5", "tree": "29977f8a39336929d45189a119bc7e4bf82c4bf5", "parents": [ "3b62407486d2c1fe7cd24a5f38e86fb19d1e2fa3" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Sat Jan 11 08:25:54 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Jan 23 19:05:38 2025 +0000" }, "message": "treewide: Fix PACKAGE_DIRECTORY_MATCH rule exception\n\nChange-Id: I8c4061f8d147a4708167b0674abfa23784a7f40d\nReviewed-on: https://review.monogon.dev/c/monogon/+/3801\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n" }, { "commit": "3b62407486d2c1fe7cd24a5f38e86fb19d1e2fa3", "tree": "bfe8bbebd74234a135aa48bb72d071097120c487", "parents": [ "15c46ccb52bc2544d35eee9a80b3c2fb5c0756e2" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Sat Jan 11 07:16:35 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Jan 23 19:05:38 2025 +0000" }, "message": "treewide: add buf_proto_lint_test to all proto_library targets\n\nChange-Id: Iaf6dc22fdbef6fcfd0bedff755bcdb06b56a6631\nReviewed-on: https://review.monogon.dev/c/monogon/+/3800\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n" }, { "commit": "156248b949f3da7c8d0f4f46cb97ac7606464952", "tree": "ff52faf242a29f1916edad64bca6282f8030ee66", "parents": [ "227c5cbbdd8f682b6e4d4cc661fa0d6e734206f2" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Fri Jan 10 00:27:45 2025 +0100" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Fri Jan 10 20:13:30 2025 +0000" }, "message": "treewide: format repo with buildifier\n\nChange-Id: Ia7aebeb7bba5b119c9157d1ad805cc477bcbb68a\nReviewed-on: https://review.monogon.dev/c/monogon/+/3774\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n" }, { "commit": "78567601398f4db5a8080fd30038ff7ac6affe0f", "tree": "757ee7c8d374317366a2535dbfb48ceaa66700f0", "parents": [ "beec27c6bdc2da730ffa2a2be6a68e1610148913" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Oct 31 13:42:04 2024 +0000" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Nov 05 13:11:03 2024 +0000" }, "message": "metropolis: remove stutter in ClusterConfiguration.KubernetesConfig\n\nWe already know this is a config (it lives in ClusterConfiguration), no\nneed to call that a config again.\n\nThis doesn\u0027t break any compatibility yet as field names are not (yet)\nunder a stability guarantee.\n\nChange-Id: Ib6492d1c8303cbd0620b979b8047ec9757e301c0\nReviewed-on: https://review.monogon.dev/c/monogon/+/3594\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "1e39914fbcecda7ec236e67f143bbefc31eee9da", "tree": "806a09d23eec324d7ff131f42ddfab13cc0f98e0", "parents": [ "20498ddc40079451c83ba3708afc57d820866cb3" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 22 10:58:15 2024 +0000" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 30 11:42:51 2024 +0000" }, "message": "metropolis: first pass API for reconfiguring cluster\n\nThis implements management.ConfigureCluster. This API is based around\nProtobuf FieldMasks, which is a new thing in the Metropolis codebase\n(node config mutation is performed via optional fields).\n\nWhether this is the right way to do this is to be discussed.\nAlternatives considered are:\n\n1. Always insert a full new config, providing the old one as a base. The\n downside of that is the potential conflicts that will spring up the\n moment we have systems regularly mutate independent parts of the\n config. Additionally, this might lead to some odd behaviour when\n dealing with clients that don\u0027t have support for newer versions of\n the config proto.\n2. Use optional fields, like in Node role code. However, this has the\n downside of duplicating protos (one for the config state, one for the\n mutation request). Plus, protobuf optionals are still somewhat\n unusual.\n3. Provide individual requests for mutating fields (like with Node\n labels). This also results in a lot of boilerplate code.\n4. Something akin to JSON Patch, but for protobufs, which doesn\u0027t seem\n to exist.\n\nChange-Id: I42e5eabd42076e947f4bc8399b843e0e1fd48548\nReviewed-on: https://review.monogon.dev/c/monogon/+/3591\nTested-by: Jenkins CI\nReviewed-by: Tim Windelschmidt \u003ctim@monogon.tech\u003e\n" }, { "commit": "5a5c66bf9f8b7429687705e30b35e5ef2249a068", "tree": "8f0bf5954e9f9083084b132414abdc52ec626df9", "parents": [ "32ccd10f990e435ddd830c86e1ca312b065da0da" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Aug 22 16:11:44 2024 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Sep 11 13:40:22 2024 +0000" }, "message": "metropolis: add Reboot RPC\n\nThis adds a new Reboot RPC to reboot a running node. It also supports\nrebooting into the passive slot and powering off the node.\n\nChange-Id: I329b22ea879adeb65a3e31103d39ad89813d61e8\nReviewed-on: https://review.monogon.dev/c/monogon/+/3354\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\n" }, { "commit": "10ef8f93d9c3acc3307819b679578f50c6798559", "tree": "aa957dd6625fac3c0afc62f17b9d8332fd3473d0", "parents": [ "1b1d95d14cb8727cd8c6a1b3efe88cef98b7bd0a" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue Aug 13 15:35:10 2024 +0200" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Aug 22 12:05:26 2024 +0000" }, "message": "treewide: move //net to //osbase/net\n\nThe net package contains the utility to dump a network configuration in\nproto format. It should be in osbase.\n\nChange-Id: I4d25d9c7d600f4a04b9b79bd1ba98286bf9daec3\nReviewed-on: https://review.monogon.dev/c/monogon/+/3313\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "e5e90a8911f93d2f7b6bdd7b57cd06d430b353a5", "tree": "04dc5ad0bf34805b8ad14af7f31d8510f4b47370", "parents": [ "d7f5993d91979bd5c68c6d46332ff781d014c21e" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Wed Jul 17 23:46:22 2024 +0200" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Jul 25 12:10:57 2024 +0000" }, "message": "treewide: migrate external rules to bzlmod\n\nThis is a huge one as it was very annoying to migrate them separately. This migrates rules_go, gazelle, rust_rust, protobuf to bzlmod\n\nChange-Id: If39591d43ed4c2afa2979ee5915e9d1cfa1574a9\nReviewed-on: https://review.monogon.dev/c/monogon/+/3234\nTested-by: Jenkins CI\nReviewed-by: Leopold Schabel \u003cleo@monogon.tech\u003e\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "9f21f5396aa18bc9f2f83c867ff883f49bbf02ae", "tree": "c232f42c84bd6b7ace576261a188134cb0c69771", "parents": [ "f430fbfe35b70283090b6174cf5a920163c0148c" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue May 07 15:14:20 2024 +0200" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Thu Jul 04 12:19:37 2024 +0000" }, "message": "treewide: introduce osbase package and move things around\n\nAll except localregistry moved from metropolis/pkg to osbase,\nlocalregistry moved to metropolis/test as its only used there anyway.\n\nChange-Id: If1a4bf377364bef0ac23169e1b90379c71b06d72\nReviewed-on: https://review.monogon.dev/c/monogon/+/3079\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "30e30b3323f05cb76a5168c24a487e4d8138b653", "tree": "f658e7c3537c1511dc84d6d2acad99a5c514269b", "parents": [ "11198c83ff733a10bfd731f20abadd286e753e28" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed May 22 14:11:56 2024 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Jun 12 10:00:40 2024 +0000" }, "message": "m/node: allow specifying node labels during node registration\n\nChange-Id: Ie7fc7387314cd2f59661c2d07530b712f8f29b48\nReviewed-on: https://review.monogon.dev/c/monogon/+/3104\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "11198c83ff733a10bfd731f20abadd286e753e28", "tree": "62d9f95bf1736fd9e3f77d6e21256223ff86a89d", "parents": [ "41113935d59f3c0210b04d6251b1559979c677fb" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed May 22 14:11:01 2024 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Jun 12 10:00:40 2024 +0000" }, "message": "m/node: allow specifying node labels during cluster bootstrap\n\nWe also drive-by refactor ProvideBootstrapData to take a structure\ninstead of a bunch of unnamed arguments.\n\nChange-Id: I8d876fd726fa87420789513540b20f523994d801\nReviewed-on: https://review.monogon.dev/c/monogon/+/3103\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "1f789540bbe4bf94c4ccae795272703577ca586e", "tree": "2ecd2308e42e5f25e898f6901cd7562c3adad18a", "parents": [ "2b6dc312656035aedade6f368af1994bdb8b6021" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed May 22 14:01:50 2024 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Jun 12 10:00:40 2024 +0000" }, "message": "m/{node,proto}: implement Node Labels\n\nNodes can now have Labels attached to them. These are string key/value\ndata designed after Kubernetes labels. They are meant to be used to\nattach metadata to nodes, for example external IDs, nicknames or\ngeographical information.\n\nThis change implements just the core functionality: storing them within\netcd, retrieving them via management and curator APIs, and mutating them\nvia a new management RPC.\n\nFollowup changes will impelement provisioning labels at\nbootstrap/registration time and accessing label data from metroctl.\n\nChange-Id: I556b452a65061294e7c51037723a6db31d587716\nReviewed-on: https://review.monogon.dev/c/monogon/+/3101\nReviewed-by: Jan Schär \u003cjan@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "8814f52a4b2baffd5bd1495483a806535e0eca02", "tree": "cc61e7260a52617b7ee62b4a44ada9ea4cfa26a0", "parents": [ "99b021469b209bf184cd8d18749a7c1e74852a50" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Wed May 08 00:41:13 2024 +0200" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue May 21 10:16:56 2024 +0000" }, "message": "metropolis/pkg/logtree: move logtree protobuf definition to logtree pkg\n\nBefore this change we had the LogEntry message inside the metropolis\ncommon proto file. This splits it out into the logtree package to make\nit standalone in a future change.\n\nChange-Id: Idb26a829d6174efa946a6c4ce0f1b984cb2f18a2\nReviewed-on: https://review.monogon.dev/c/monogon/+/3080\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "146346870881d7043bf591ea1e7ca6cdde8e11d6", "tree": "3160d2f6f0baf7a50887db6b144a6fcb645f91e3", "parents": [ "de12c7ef5833ae349d8f39c8116431a286838fd7" ], "author": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Wed May 08 02:53:55 2024 +0200" }, "committer": { "name": "Tim Windelschmidt", "email": "tim@monogon.tech", "time": "Tue May 14 21:12:26 2024 +0000" }, "message": "metropolis/proto/api: remove unused import\n\nChange-Id: I45418860e5c0059b2853dbb0ba0dfc8c442aabfa\nReviewed-on: https://review.monogon.dev/c/monogon/+/3085\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "8456ddf02aea2e1015805f18ef1871812c5cb7f6", "tree": "7ea30de34d2ed42e2da1c044fb62576464b4e2cc", "parents": [ "7acd92dae19109fff8e6036d0a7fcd64aa1851c1" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Oct 30 18:56:59 2023 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Oct 30 22:12:01 2023 +0000" }, "message": "metropolis: implement node Deletion and framework for Decommissioning\n\nThis implements the basic ability to remove nodes from a cluster.\n\nWe prepare for a more complex workflow involving multi-sage\ndecommissioning, but first implement the \u0027worst case\u0027 workflow, in which\na node needs to be deleted if it hasn\u0027t been gracefully decommissioned.\nThis is what we currently need most in practice, as we have node\nfailures we\u0027d like to deal with.\n\nThe Delete functionality is still not fully complete though, as we\u0027re\nstill accepting client certificates from decommissioned nodes. But we\u0027ll\nfix that in an upcoming CR.\n\nChange-Id: I7322cb1464a9e5bc924363321534033dcc8a6246\nReviewed-on: https://review.monogon.dev/c/monogon/+/2270\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "d14be0eb8bcffb6ba597f26e3ad57b311ca376fc", "tree": "3a1286f0eb3623db53c4cb2c880eb5a1059ae1f0", "parents": [ "c07d74efd282261c68d33d745d52a6703448c8fd" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Jul 31 16:46:14 2023 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Aug 07 11:37:10 2023 +0000" }, "message": "m/n/c/update: implement kexec-based activation\n\nAs we\u0027ve had some issues with EFI-based slot activation and enterprise\nserver firmware is extremely slow, this implements kexec-based\nactivation. This just kexecs into the freshly-installed slot instead of\nrebooting. It still updates the BootOrder on successful boot to allow\ncold-boots if the server crashes or loses power, but no longer uses the\nNextBoot mechanism to boot into the new slot once (this is taken care of\nby kexec).\n\nChange-Id: I6092c47d988634ba39fb6bdd7fd7ccd41ceb02ef\nReviewed-on: https://review.monogon.dev/c/monogon/+/2021\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "35fcf0397be02883ace364e650b3e8d9a2281e24", "tree": "cb1297a2e4a34eeebb9faf09b44c3b95cf603f7f", "parents": [ "ad131883747f73e51526dd6f163df23b913f69ed" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jun 29 04:15:58 2023 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Jul 27 13:58:35 2023 +0000" }, "message": "metropolis: implement A/B updates\n\nThis implements an A/B update mechanism using two slots, A and B.\nThis is realized with two system partitions as well as two EFI\nloaders/kernels.\n\nThe A/B system relies on two EFI loader entries. This has the advantage\nthat there is no preloader required, which makes the system more\nreliable as well as avoiding the complexity of having an un-updatable\npreloader (CoreOS has this issue where their GRUB2 crashed booting newer\nkernels, sadly the issue seems lost with the migration to Fedora\nCoreOS). It also means that the operator can easily override the slot\nbeing booted via the boot loader entries. Primary disadvantage is that\nit relies on EFI working somewhat to spec.\n\nNew versions are booted into only once by setting NextBoot, if the\nbootup doesn\u0027t succeed, i.e. if the boot doesn\u0027t get to a cluster rejoin\nthe next boot will be the old slot. Once it gets to this stage the\npermanent BootOrder is changed.\n\nThe EFI loaders don\u0027t know if they are slot A or B because they are\nidentical and relying on OptionalData in the boot entry to indicate the\nslot means that if the EFI boot entries go away, recovering is very hard.\nThus the loaders look at their own file name to determine what slot they\nare in. If no slot could be determined, they default to booting slot A.\nIt is planned to eventually use Authenticode Stamping (passing data in\nfake certificates) to stamp the slot into the loader without affecting\nthe TPM hash logged.\n\nChange-Id: I40de2df8ff7ff660c17d2c97f3d9eb1bd4ddf5bc\nReviewed-on: https://review.monogon.dev/c/monogon/+/1874\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "e4a4ce1dbbc8abc8a0817f80fcb27437a9e6ca63", "tree": "1d2fc878f2e74e1e077dd8848c983c00e6ffcb6d", "parents": [ "5df62bae21bd89f15321a54a33a2ff59f5cbdce8" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 22 18:29:54 2023 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Apr 17 09:14:54 2023 +0000" }, "message": "metropolis: finish implementing TPMMode\n\nThis wraps up the implementation of TPMMode in ClusterConfiguration,\nallowing operators to select whether nodes should or should not use\ntheir TPM, based on local availability.\n\nWe keep the default behaviour to require a TPM, as we\u0027d like to be\nsecure by default.\n\nChange-Id: Ic8ac76d88ecc9de51f58ca99c92daede79d78ad7\nReviewed-on: https://review.monogon.dev/c/monogon/+/1495\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "5df62bae21bd89f15321a54a33a2ff59f5cbdce8", "tree": "45e397cafdbff558801e94c4c124bbb8e4d8a55b", "parents": [ "10b2154450b4e43d2b959137f47bceeaf9c9f1f3" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 22 17:56:46 2023 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Apr 17 09:14:54 2023 +0000" }, "message": "metropolis: implement cluster configuration\n\nThis adds a cluster configuration to Metropolis. We\u0027ll be keeping any\nnon-node-specific options there. The config is stored in etcd by the\ncurator.\n\nAn initial cluster configuration can be specified when bootstrapping a\ncluster. By design the configuration is then immutable by default, but\nwe might add some purpose-specific management API calls to change some\nvalues if needed.\n\nWe initialize the cluster configuration with a setting for node TPM\npolicy, \u0027TPMMode\u0027. It\u0027s currently populated on cluster bootstrap, but\nnot used otherwise. That will come in a follow-up CR.\n\nChange-Id: I44ddcd099c9ae68c20519c77e3fa77c894cf5a20\nReviewed-on: https://review.monogon.dev/c/monogon/+/1494\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "85ad26a4389b926e2d4656f540257169eacdc4aa", "tree": "ed69090952b8734c0d2dc2a52019921d34a9d75a", "parents": [ "3ecb04a95b2d877ea4ef6adad0059183858af5a9" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Mon Mar 27 17:00:00 2023 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Thu Apr 06 14:26:33 2023 +0000" }, "message": "m/node: implement static network config\n\nAllows using a static network configuration in Monogon OS.\n\nThis plumbs in support for the new static network configuration mode of\nthe network service into Monogon OS. It introduces a new NodeParameter\nfield as well as an ESP file to persistently hold this configuration.\nThe file is not sealed or encrypted to allow recovery of nodes with\nbroken network configuration.\n\nChange-Id: Ia398368a8d1c0eef4bca53bb279a97a144bdbd20\nReviewed-on: https://review.monogon.dev/c/monogon/+/1403\nTested-by: Jenkins CI\nReviewed-by: Serge Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "da11486352f2aaccfa271a8aaf06a3bef09b0a3a", "tree": "c5a4f5488061d4c0a8660014bc4f4838361ee4aa", "parents": [ "bc7397214147701d6e70141ff70bf6e84f9aab62" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 29 17:46:42 2023 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Mar 30 14:19:03 2023 +0000" }, "message": "metropolis/proto: move log-related types to common\n\nHaving them in API is kinda weird, especially as we\u0027re\ngenerating/parsing them from a few libraries already.\n\nChange-Id: I87b4b51f151443c60b87e3e50753c395fcf6e845\nReviewed-on: https://review.monogon.dev/c/monogon/+/1437\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "b91938fe16d74272c14e13cad5c6bd8f82391bc4", "tree": "c70a0acf239851748611957bee9d0275740b56ed", "parents": [ "b40c008a6842a232c18b955375d4f1432b32cd53" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 29 14:31:22 2023 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 29 17:18:22 2023 +0000" }, "message": "metropolis: stub out log service\n\nThe server side and client-side implementations are not quite ready yet,\nbut we\u0027re commiting this early so that we can start implementing more\nnode-local management RPCs.\n\nChange-Id: I81b615b0f77dc7750cc738d60ee4923c3182721b\nReviewed-on: https://review.monogon.dev/c/monogon/+/1429\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "b40c008a6842a232c18b955375d4f1432b32cd53", "tree": "3fd188eb8b831102c9ab8997579554d200057ed3", "parents": [ "8535cb5bc5437960430ff94d3ea7280ccf931340" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 29 14:28:04 2023 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 29 17:18:22 2023 +0000" }, "message": "m/n/core/mgmt: implement node-local management service\n\nChange-Id: I1e8a8ff46d1172e00f2d991ae3cc3af1929b6e4e\nReviewed-on: https://review.monogon.dev/c/monogon/+/1428\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "30fd15406e2c9cba7391f6af96c775b313a115fa", "tree": "cd19f1366d884c5b3110a7396b9cc5514dedecc2", "parents": [ "8fab014d343633828dc4df3c670def9c75fa4485" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 29 14:19:02 2023 +0200" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Mar 29 17:18:22 2023 +0000" }, "message": "m/n/core/curator: return denormalized node id in GetNodes\n\nThis is mostly useful when using filters to get just one node, eg.\n`node.id \u003d \"metropolis-1234567890\"`.\n\nChange-Id: I154508751b0e610742374b65915c07b64a7f7b71\nReviewed-on: https://review.monogon.dev/c/monogon/+/1426\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "15f7f637d6885b471f52fd0aa04d04998366a7f9", "tree": "b1884808d565ce0736993939f4f6b482aab0874d", "parents": [ "e00a89da1c62e20c2528dadb0543a4578680b073" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Mar 14 17:17:20 2023 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Mar 14 20:07:36 2023 +0000" }, "message": "metropolis: rename KubernetesWorker to KubernetesController, add no-op KubernetesWorker\n\nThis is in preparation for actually splitting the Kubernetes service\ninto a control plane and data plane / worker. The new Worker service is\na no-op: it can be enabled/disabled, but has no practical effect.\n\nSince we plan on keeping the control plane stuff mostly as is, and add\nsplit worker functionality as a new codebase, it makes sense to rename\nthe existing role to Controller, and createa brand new Worker one (to\nmake future diffs smaller).\n\nChange-Id: I79de3219f3c190d38469a0a8d7371820471c100d\nReviewed-on: https://review.monogon.dev/c/monogon/+/1325\nTested-by: Jenkins CI\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "9c315f1116567df934cf7fce5f3f341c70cb9b66", "tree": "d02e8e879f226dffc657e7483795ba58cc2236ee", "parents": [ "db75e21d4826eac4e0177995dff64c9ff6a64064" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Thu Aug 11 16:31:22 2022 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Thu Aug 25 11:26:58 2022 +0000" }, "message": "m/p/api: UpdateNodeRoles: identify by node IDs\n\nThis adds the possibility of identifying nodes through their node IDs\non top of their public keys.\n\nChange-Id: I4028832773acb11faf306144fece923e6c51d20d\nReviewed-on: https://review.monogon.dev/c/monogon/+/849\nTested-by: Jenkins CI\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "cf92f409655c4f4bc22eaa5d17f543d69e8c411b", "tree": "f0db9b6b5d73e168954544af951754a082b34493", "parents": [ "28800ad9a591c8a9dbbba4f21de51d8e07443b1e" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Fri Jul 08 15:08:48 2022 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Jul 11 12:09:15 2022 +0000" }, "message": "m/p/api: use protobuf.Timestamp in LogEntry\n\nThis updates LogEntry to use google.protobuf.Timestamp.\nSee: issue #129.\n\nChange-Id: I937800aa91e86690da0d06f743e720c2d474ad0a\nReviewed-on: https://review.monogon.dev/c/monogon/+/832\nTested-by: Jenkins CI\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "944cb53d38e1b506eb5dcb0ca17fa0811195b09f", "tree": "adb106cb1a620fb7d804c6f3cee1d665a872fb5c", "parents": [ "ddf19b4b194936cc310eae9fc5c01bedcedbb900" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Jun 20 16:54:17 2022 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Thu Jun 23 16:27:33 2022 +0000" }, "message": "m/p/api: use protobuf.Duration in Management.Node\n\nThis switches Management.Node message\u0027s time_since_heartbeat backing\ntype from int64 to google.protobuf.Duration in order to enable duration\nbased predicates in Management.GetNodes filter expressions.\n\nChange-Id: Ia2663475d1b9ee535dc5578f16d53b70c6686b7c\nReviewed-on: https://review.monogon.dev/c/monogon/+/776\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "2175ec96b7cb0c70820ea99f304d4f437aeb620c", "tree": "0999642c67de8cde0cb1ab7e528f224cc9371581", "parents": [ "bb2edbe8a69a04b0d72c5a565bdead5040959125" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Mon Jun 13 09:29:09 2022 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Jun 21 11:19:47 2022 +0000" }, "message": "m/p/api: rename Node.HeartbeatTimestamp\n\nNode.HeartbeatTimestamp was renamed to Node.TimeSinceHeartbeat to\nbetter reflect the nature of its contents.\n\nChange-Id: Icef000cf7493a06f7b3aabfc2aba57b380433887\nReviewed-on: https://review.monogon.dev/c/monogon/+/765\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "bb2edbe8a69a04b0d72c5a565bdead5040959125", "tree": "3d9286bd95757222431a279db7e9fcb1b6238dfb", "parents": [ "83e8b6c897aaabb4230ae73a28bba0ed0aca039c" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Wed Jun 08 11:57:09 2022 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue Jun 21 11:19:32 2022 +0000" }, "message": "m/n/c/curator: add Management.UpdateNodeRoles\n\nThis provides an API for node role adjustments.\n\nWhile changes to KubernetesWorker role are registered, not all side\neffects are accounted for as of now. Specifically, disabling this role\nwithin a node won\u0027t lead to its removal from the Kubernetes cluster.\n\nChange-Id: Ie8e65990108b8cf82afecf3374f40f2e857fa776\nReviewed-on: https://review.monogon.dev/c/monogon/+/767\nTested-by: Jenkins CI\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "955e46e2e6cca29481b61c7303b1dd9746309bf7", "tree": "7cea2df4b72c9b04eaeffd6d9e10570be096027a", "parents": [ "1b2df233817ae3dd09ff33ad18d319a50be10584" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Fri May 27 18:00:50 2022 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Thu Jun 16 11:41:27 2022 +0000" }, "message": "m/n/c/curator: add result filtering to GetNodes\n\nThis introduces result filtering to management.GetNodes Curator API\ncall. GetNodesRequest payload was modified to contain an optional CEL\nexpression. GetNodes will return only node protobuf messages for which\nthe expression evaluates to boolean truth. GetNodes behavior remains\nunchanged for empty expression strings, returning all nodes.\n\nSee: https://github.com/google/cel-go\nhttps: //github.com/google/cel-spec\nChange-Id: Ibdd847c73d305de22b7df496c401e9bc37f9f0bc\nReviewed-on: https://review.monogon.dev/c/monogon/+/768\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\nVouch-Run-CI: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "32b192929c34e408bec6286de471313a4cfce5e2", "tree": "5a05f888581a3749ede7f09340119171422150e2", "parents": [ "08cb464d60f859ad029a52abe161cae02a0bf405" ], "author": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Tue May 17 13:26:55 2022 +0200" }, "committer": { "name": "Mateusz Zalega", "email": "mateusz@monogon.tech", "time": "Fri May 27 10:24:27 2022 +0000" }, "message": "m/n/core: implement node heartbeats\n\nThis change introduces cluster member node health monitoring by\nimplementing a bidirectional RPC stream the nodes will periodically\nsend their heartbeat updates through. Management.GetNodes call was\nmodified to include the new node health information.\n\nRelevant data available through the management API is non-persistent,\nand stored within current Curator leader\u0027s local state. As such, it\nwill become briefly unavailable in an event of leader re-election. The\ninformation returned, however, is guaranteed to be correct.\n\nChange-Id: I916ac48f496941a7decc09d672ecf72a914b0d88\nReviewed-on: https://review.monogon.dev/c/monogon/+/694\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\nTested-by: Jenkins CI\n" }, { "commit": "fdc3a2473e4ebfd77db342252e1088882e01b2d6", "tree": "addfe894acce55d3088764cc49a6c1c3cee55573", "parents": [ "33ce3bcd5c4791cb66a3020b7792829c534c97c6" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Apr 06 15:56:38 2022 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Apr 19 08:01:17 2022 +0000" }, "message": "third_party/go: fix `go mod tidy`\n\nThis makes our root repository somewhat more gomod-compliant, to the\npoint where we can run `go mod tidy` to manage dependencies.\n\nThe generated placeholder files turn their parent paths into enough of a\nGo package that the go tooling is appeased, but they are ignored by\nGazelle.\n\nIdeally, we will generate these placeholders automatically before\nrunning `go mod tidy` and gitignore them, but this will do as a first\npass.\n\nWe also remove some unused dependencies which got caught by `go mod\ntidy`.\n\nChange-Id: I81e7e92a45f22c8ef9c92207f67a5bd6cc773da5\nReviewed-on: https://review.monogon.dev/c/monogon/+/652\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\n" }, { "commit": "d13c1c64387ca9a83bb832a3faa5c4b07268d265", "tree": "0c0f534db4726e4400486aad25235e8c573d455e", "parents": [ "79a1a8f9dd49afe8e0a2364c4586b8f39525b204" ], "author": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Mar 30 19:58:58 2022 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Tue Apr 05 10:35:29 2022 +0000" }, "message": "treewide: switch to gomod and bump everything\n\nThis switches version resolution from fietsje to gomod and updates\nall Go dependencies. It also bumps rules_go (required by gVisor) and\nswitches the Gazelle naming convention from go_default_xxx to the\nstandard Bazel convention of the default target having the package\nname.\n\nSince Kubernetes dropped upstream Bazel support and doesn\u0027t check in\nall generated files I manually pregenerated the OpenAPI spec. This\nshould be fixed, but because of the already-huge scope of this CL\nand the rebase complexity this is not in here.\n\nChange-Id: Iec8ea613d06946882426c2f9fad5bda7e8aaf833\nReviewed-on: https://review.monogon.dev/c/monogon/+/639\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\nReviewed-by: Leopold Schabel \u003cleo@nexantic.com\u003e\n" }, { "commit": "1612d4b51f74e439d1efb4b8957d440d148035b7", "tree": "c69d3d08b638ed54ef938a97166893e7b9779cf5", "parents": [ "5b60e581bdc1cd420a281e3a110367e310337850" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Nov 12 13:54:15 2021 +0100" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Mon Nov 22 11:18:43 2021 +0000" }, "message": "m/n/c/curator: implement Management.ApproveNode\n\nThis takes a node from NEW to STANDBY. This is the second-to-last\nstep requires in a node\u0027s regsitration flow.\n\nChange-Id: I88f9c7d2cd824c7d3182195b784a725ec9528d28\nReviewed-on: https://review.monogon.dev/c/monogon/+/442\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "5611447f05c85eb5d0b7f7c5865911b1d560ef66", "tree": "19274d1fae7747027ad2758d3027f0e09b9c599e", "parents": [ "6cefe518de0b964db90c1b10d57b8be47aa4448e" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Oct 11 14:47:54 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Nov 18 15:40:45 2021 +0000" }, "message": "m/n/c/curator: implement Management.GetNodes\n\nThis is a management call that provides detailed per-node details.\nCurrently it returns all information about all nodes, but can be then\nextended to allow filtering and selective/masked field retrieval.\n\nThis call is then used to implement a test which exercises\nCurator.NodeRegister and GetNodes.\n\nChange-Id: Ia093d9f03a4213b01acbb0fdac9714d8e7b02dd3\nReviewed-on: https://review.monogon.dev/c/monogon/+/434\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "fbd38e280916f0883263cf0b566984d3fea4ff39", "tree": "44abb583a39606b61940523e873af4d92a787be4", "parents": [ "579015afff6be9d6c87c867b0645f254b9aeb2d8" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Oct 08 14:41:16 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Nov 18 13:01:16 2021 +0000" }, "message": "m/proto: switch from CA pubkey to CA certificate in ClusterDirectory/Register\n\nA CA certificate is a strict superset of the public key, and using it\ninstead of a public key allows us to connect to the cluster securely by\nreusing standard/existing x509 CA auth, instead of having to implement a\ncheck based on just a public key.\n\nBackwards-incompatible proto change, but we\u0027re pre-MVP, and this flow is\njust being implemented.\n\nChange-Id: I014780a6ec3e5e8c6e81532531b18ad1438c8258\nReviewed-on: https://review.monogon.dev/c/monogon/+/424\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "516d300df9a34da5b39944017cebf1b11897e7a0", "tree": "b045662801001e5c53412baa6d744346892830f0", "parents": [ "c6c092be9c8774192867620d1df41c6014e20de1" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Oct 01 00:05:41 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Nov 16 14:39:15 2021 +0000" }, "message": "m/n/c/curator: implement Curator.RegisterNode\n\nThis is the \u0027Register\u0027 call from the cluster lifecycle design document.\nWe don\u0027t yet call it from node startup code, but we do exercise it in a\nCurator test.\n\nChange-Id: Ife617b148a25fc8aecb0ed15f78a758ca4538016\nReviewed-on: https://review.monogon.dev/c/monogon/+/423\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "2f58ac0ba336ad64e5708a4bb72163e368410959", "tree": "f0047b265e47d3e934220f93147bbe663d7ac097", "parents": [ "eac8f7312382f20c17082f2871b50aea92e0a45e" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 11:47:20 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 16:07:56 2021 +0000" }, "message": "m/n/c/curator: return CA public key in GetClusterInfo\n\nThis is needed for node registration (and is generally useful data\nwhenever a caller might not be aware of the CA\u0027s public key but already\nhas access to a Management client). In theory, all callers should be\naware of the public key, but in the future some other cluster\nverification might be performed with the CA public key ignored on\nconnectivity, but used by some other logic.\n\nChange-Id: If1928435bd5606c733460eb1a4a29a6578c8c723\nReviewed-on: https://review.monogon.dev/c/monogon/+/342\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "bc671d09b9cdeb420260797c22020aa12059eb36", "tree": "868fe4b9601c2c5c1f63106f3f0160037cb76462", "parents": [ "3be483247a07a6ebe73dd044f6ad299e19a04c7b" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:53:32 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 14:49:55 2021 +0000" }, "message": "m/n/core: implement GetClusterInfo\n\nThis implements Management.GetClusterInfo which is used to retrieve a\nClusterDirectory. This in turn will be used by nodes that wish to\nregister into a cluster.\n\nThis could\u0027ve been skipped and instead Curator.Watch could\u0027ve been used.\nHowever, the Curator service is only really (currently) intended to be\nused by node-to-node communications. To keep with the current design, we\nimplement a separate RPC, but we should maybe reconsider if this\nseparation makes sense.\n\nChange-Id: Ie9d475731f4faafdc51a2aa51a1582ee1a259fd2\nReviewed-on: https://review.monogon.dev/c/monogon/+/340\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "2893e980368c0bbb843aa422386462a964623b40", "tree": "0e95252b16a85991de6f0901bc7dcaf2ac566145", "parents": [ "96043bc1cb55b1271b21309b2011d64d2361a0fd" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 09 13:06:16 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:29:42 2021 +0000" }, "message": "m/n/c/curator: add UpdateStatus\n\nThis implements Curator.UpdateStatus, which lets nodes self-report some\nstatus items. Currently this is their external IP address, which is\nneeded to generate a Cluster Directory which is in turn needed to\nregister into a cluster.\n\nChange-Id: Ib5464ca78ee3466d9b9f89b7af8b40f613ae8dcc\nReviewed-on: https://review.monogon.dev/c/monogon/+/332\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "9ffa1f9577003ab70a6b483475874f3552d1ccc3", "tree": "a688d02424e8601ed830d12021b5867688d31438", "parents": [ "6bd415920b84bd695038caeb386f1e97184f0c51" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 15:42:23 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 02 10:38:15 2021 +0000" }, "message": "m/n/core/curator: authenticated RPC\n\nThis adds authentication middleware (server interceptors) for gRPC\nservices running on the public curator listener.\n\nMost of this code is testing harnesses to start up just the curator\nlistener with enough of a PKI infrastructure copy from a real Metropolis\ncluster to be able to start running tests against GetRegisterTicket.\n\nChange-Id: I429ff29e3c1233d74e8da619ddb543d56bc051b9\nReviewed-on: https://review.monogon.dev/c/monogon/+/311\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "6bd415920b84bd695038caeb386f1e97184f0c51", "tree": "60a125e0a299663c392218ed8b80cf33ea31aabd", "parents": [ "68dcee136984e2e16b7682e0c0758c1df831a84c" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Aug 23 13:18:37 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 12:56:15 2021 +0000" }, "message": "m/node: add Management service, implement GetRegisterTicket RPC\n\nThis follows the Cluster Lifecycle design document.\n\nDO NOT MERGE: this needs a stacked CL on top which implements\nauthentication for the Management service.\n\nChange-Id: I19422a63b9dbf2fc0c7f4cbe204851af35b4dbdf\nReviewed-on: https://review.monogon.dev/c/monogon/+/307\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "9d6c4c78bca9da0db7e40e5de776528f3d83a7dd", "tree": "71cba058637a866b7c87e3f296dd4995d0171cfe", "parents": [ "257acab41f5a35575ca0f2dbc9568b1bd75d2570" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Jul 20 21:16:27 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Aug 11 15:38:58 2021 +0000" }, "message": "Support injecting container images for development\n\nThis adds the LoadImage RPC and an accompanying subcommand\nto the debug API which allows loading images into\nan existing Metropolis node for\ndevelopment or testing.\n\nChange-Id: I51d802630ae4c95fb874e01bfb6510ab69c322e1\nReviewed-on: https://review.monogon.dev/c/monogon/+/219\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "09c275bc489bc1de406be9a2e8f158eaa87b7c61", "tree": "31c62a93e37f6052aa99e2addacef6c060d75e85", "parents": [ "37050126ef89ec30cc677c272471debe55ec0d69" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Mar 30 12:47:09 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 11:04:05 2021 +0200" }, "message": "Add ftrace support to DebugService\n\nThis allows us to do ad-hoc kernel-level tracing on a running Metropolis node.\nUseful for tracking down complex bugs.\n\nExample: `bazel run //metropolis/cli/dbg -- trace -function_graph_filter blkdev_* function_graph`\n\nTest Plan: Debug utility, manually tested\n\nX-Origin-Diff: phab/D748\nGitOrigin-RevId: 924eb795250412a73eb30c0eef4a8c1cc726e5fd\n" }, { "commit": "72068da814af80568cb106b877ef8f5e526e684c", "tree": "31831657903e62d4a813c9d18d47413154f13560", "parents": [ "d8af5bf4c14a5c53d1736695a1210b6eea4d246e" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:15:45 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:15:45 2021 +0100" }, "message": "metropolis/proto: add private\n\nWe add a new proto package, \u0027private\u0027. This will hold all non-public\nproto messages for the implementation of the cluster lifecyclce design\ndocument.\n\nWe duplicate \u0027internal\u0027 for two reasons:\n\n - make it easier to port code accross to use the new protos/cluster\n code, while slowly phasing out protos/internal.\n - \u0027internal\u0027 was a poor name choice, as it\u0027s significant in Go path\n naming, and might cause some problems in the future. We have Bazel\u0027s\n visiblility mechanism to protect accidental use.\n\nTest Plan: New proto, not yet used - see rest of stack.\n\nX-Origin-Diff: phab/D732\nGitOrigin-RevId: 15632353c46068b4f4c5025828c9c8459feaa335\n" }, { "commit": "0ed2f96a3a86aff2c9ce36289aa5d58a75f4d59b", "tree": "afbe1fb6cd0a1667e981edfe97969338437bdaca", "parents": [ "056042962060369bd7607ecfea51c515fc3a8140" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Mar 15 16:39:30 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Mar 15 16:39:30 2021 +0100" }, "message": "metropolis/proto: EnrolmentConfig -\u003e NodeParameters\n\nThis starts off the move to a node configuration API conforming to\nthe lifecycle management design document.\n\nInstead of an Enrolment Config used only to join an existing cluster, we\nmove to a NodeParameters proto that must always be given to a node if\nit\u0027s supposed to either bootstrap a new cluster or join an existing one.\n\nThis links the existing cluster management code (and its state machine)\nto work with this file. However, that state machine will be removed very\nsoon, anyway.\n\nWe also remove everything related to golden tickets.\n\nThis breaks multi-node tests.\n\nX-Origin-Diff: phab/D710\nGitOrigin-RevId: f22615fbccab975f2d5e6928bdc7387ab3aa5714\n" }, { "commit": "32d73486f4ea778cd3ea58e2d579e862cf67fb9c", "tree": "78e3444e0b55df55f512415dbfd34977cdca2350", "parents": [ "6c4199afe4dc4d446679b862f528e840e60925df" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Feb 01 23:49:17 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Feb 01 23:49:17 2021 +0100" }, "message": "metropolis: introduce AAA.Escrow RPC\n\nThis is a combined proto change and design document RFC.\n\nThis implements a generic \u0027Escrow\u0027 methid, used to allow external\nentities to log into a Metropolis cluster. This flow\u0027s subject vaguely\ncorresponds to \u0027Entity\u0027 objects from the Lifecycle DD, but this will be\nmore precisely defined in a subsequent change which introduces the\nactual entities objects, the way they\u0027re identified, and the way they\u0027re\nstored in the cluster.\n\nIn addition, this formalizes the part of the LDD in which entities are\nable to perform hardware attestation on nodes. The hardware attestation\npart is not fully implemented, but is placed within the bounds of the\nEscrow streaming RPC. Entities might also be able to performs this\nhardware attestation in a separate RPC call (having already requested a\nshort-lived certificate permitting access to RPC), but this is not yet\nsure.\n\nThis design, is in a way, a modernized version of GSSAPI. It assumes it\nruns over a confidential channel (TLS), and that it only ever returns\nx509 certificates emitted for the requesting client. It is also designed\nto handle flows that we expect to use within Metropolis.\n\nThis design has some known limitations:\n\n1) Limited decisionmaking abitility by the server to decide which proofs\n are needed - ie., the server cannot change its mind what other proofs\n are needed as the client presents some. Currently the server can\n decide the proofs only based on the parameters given by the client,\n and the initial context of the connection, ie. its originating\n address and the presented TLS certificate.\n2) Limited expressibility of required proofs to the client, currently\n all listed must be fulfilled.\n\nThis, however, can be extended as the protocol evolves, and can continue\nto support simple clients that handle only this protocol. Especially 2)\nmight be limiting us from preventing things like accepting emergency\ncertificates without necessarily needing an OIDC login, even though OIDC\nlogins are required for other kinds of certificates. We are explicitly\ntrying to keep things simple for now, and just not write ourselves into\na corner here.\n\nFinally, this API should cover all scenarios expressed within T865 -\nminus the entity storage part within the cluster.\n\nTest Plan: Proto change and review process.\n\nX-Origin-Diff: phab/D698\nGitOrigin-RevId: 92892b5522a4d41d572fd4c10f24d26f72919aeb\n" }, { "commit": "31370b07f0df2dc2765d812d4ce00a6b35185b16", "tree": "15563902eee9591083284441c8505b084b275d0a", "parents": [ "313816f41244d7520eb2b6f8c231328ee5b7a4ef" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 16:31:14 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 16:31:14 2021 +0100" }, "message": "*: git.monogon.dev -\u003e source.monogon.dev\n\nThis implements T882, setting our (virtual) GOPATH to source.monogon.dev\nfor this repository.\n\nTest Plan: Refactor, CI only.\n\nX-Origin-Diff: phab/D686\nGitOrigin-RevId: c5e2309089948ffc3a98e68e2e0e1cbb157d3a36\n" }, { "commit": "549b72b2d65051403301f53111509f77e88b379b", "tree": "b4e523d5d17e8130545e58b58870b4a18118a780", "parents": [ "696f39abb19ffcca03e9fc5a98681338216b1e7f" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 14:54:19 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 14:54:19 2021 +0100" }, "message": "metropolis: unify utility packages\n\nOne last sweeping rename / reshuffle.\n\nWe get rid of //metropolis/node/common and //golibs, unifying them into\na single //metropolis/pkg meta-package.\n\nThis is to be documented somwhere properly, but here\u0027s the new logic\nbehind selecting where to place a new library package:\n\n - if it\u0027s specific to k8s-on-metropolis, put it in\n //metropolis/node/kubernetes/*. This is a self-contained tree that\n other paths cannot import from.\n - if it\u0027s a big new subsystem of the metropolis core, put it in\n //metropolis/node/core. This can be imported by anything in\n //m/n (eg the Kubernetes code at //m/n/kubernetes\n - otherwise, treat it as generic library that\u0027s part of the metropolis\n project, and put it in //metropolis/pkg. This can be imported by\n anything within //metropolis.\n\nThis will be followed up by a diff that updates visibility rules.\n\nTest Plan: Pure refactor, CI only.\n\nX-Origin-Diff: phab/D683\nGitOrigin-RevId: 883e7f09a7d22d64e966d07bbe839454ed081c79\n" }, { "commit": "662b5b3119b0798980b887d1ef9fa1b5632aa7fb", "tree": "3e1fc4ab033530e6d579112ba500d2c6edb43368", "parents": [ "39f2f691726dc6e0a291aa8609085b835a313dad" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Dec 21 13:49:00 2020 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Dec 21 13:49:00 2020 +0100" }, "message": "smalltown -\u003e metropolis\n\nThis pass removes all mentions of Smalltown, both from code and comments,\nand replaces them with appropriate new terminology.\n\nTest Plan: Refactor, covered by CI.\n\nX-Origin-Diff: phab/D674\nGitOrigin-RevId: 04a94d44ef07d46f7821530da5614daefe16d7ea\n" }, { "commit": "77cb6c5ec3acadf02ad5005dd751cfbf0ec1602f", "tree": "7ddfcdf78c489a5d6fad7a20bd3580d803407450", "parents": [ "26d41999e0c71813648c16ad84bba810c3b9d593" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Sat Dec 19 00:09:22 2020 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Sat Dec 19 00:09:22 2020 +0100" }, "message": "core -\u003e metropolis\n\nSmalltown is now called Metropolis!\n\nThis is the first commit in a series of cleanup commits that prepare us\nfor an open source release. This one just some Bazel packages around to\nfollow a stricter directory layout.\n\nAll of Metropolis now lives in `//metropolis`.\n\nAll of Metropolis Node code now lives in `//metropolis/node`.\n\nAll of the main /init now lives in `//m/n/core`.\n\nAll of the Kubernetes functionality/glue now lives in `//m/n/kubernetes`.\n\nNext steps:\n - hunt down all references to Smalltown and replace them appropriately\n - narrow down visibility rules\n - document new code organization\n - move `//build/toolchain` to `//monogon/build/toolchain`\n - do another cleanup pass between `//golibs` and\n `//monogon/node/{core,common}`.\n - remove `//delta` and `//anubis`\n\nFixes T799.\n\nTest Plan: Just a very large refactor. CI should help us out here.\n\nBug: T799\n\nX-Origin-Diff: phab/D667\nGitOrigin-RevId: 6029b8d4edc42325d50042596b639e8b122d0ded\n" } ] }