)]}' { "log": [ { "commit": "516d300df9a34da5b39944017cebf1b11897e7a0", "tree": "b045662801001e5c53412baa6d744346892830f0", "parents": [ "c6c092be9c8774192867620d1df41c6014e20de1" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Fri Oct 01 00:05:41 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Nov 16 14:39:15 2021 +0000" }, "message": "m/n/c/curator: implement Curator.RegisterNode\n\nThis is the \u0027Register\u0027 call from the cluster lifecycle design document.\nWe don\u0027t yet call it from node startup code, but we do exercise it in a\nCurator test.\n\nChange-Id: Ife617b148a25fc8aecb0ed15f78a758ca4538016\nReviewed-on: https://review.monogon.dev/c/monogon/+/423\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "2f58ac0ba336ad64e5708a4bb72163e368410959", "tree": "f0047b265e47d3e934220f93147bbe663d7ac097", "parents": [ "eac8f7312382f20c17082f2871b50aea92e0a45e" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 11:47:20 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 16:07:56 2021 +0000" }, "message": "m/n/c/curator: return CA public key in GetClusterInfo\n\nThis is needed for node registration (and is generally useful data\nwhenever a caller might not be aware of the CA\u0027s public key but already\nhas access to a Management client). In theory, all callers should be\naware of the public key, but in the future some other cluster\nverification might be performed with the CA public key ignored on\nconnectivity, but used by some other logic.\n\nChange-Id: If1928435bd5606c733460eb1a4a29a6578c8c723\nReviewed-on: https://review.monogon.dev/c/monogon/+/342\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "bc671d09b9cdeb420260797c22020aa12059eb36", "tree": "868fe4b9601c2c5c1f63106f3f0160037cb76462", "parents": [ "3be483247a07a6ebe73dd044f6ad299e19a04c7b" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:53:32 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Oct 06 14:49:55 2021 +0000" }, "message": "m/n/core: implement GetClusterInfo\n\nThis implements Management.GetClusterInfo which is used to retrieve a\nClusterDirectory. This in turn will be used by nodes that wish to\nregister into a cluster.\n\nThis could\u0027ve been skipped and instead Curator.Watch could\u0027ve been used.\nHowever, the Curator service is only really (currently) intended to be\nused by node-to-node communications. To keep with the current design, we\nimplement a separate RPC, but we should maybe reconsider if this\nseparation makes sense.\n\nChange-Id: Ie9d475731f4faafdc51a2aa51a1582ee1a259fd2\nReviewed-on: https://review.monogon.dev/c/monogon/+/340\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "2893e980368c0bbb843aa422386462a964623b40", "tree": "0e95252b16a85991de6f0901bc7dcaf2ac566145", "parents": [ "96043bc1cb55b1271b21309b2011d64d2361a0fd" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 09 13:06:16 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Tue Oct 05 17:29:42 2021 +0000" }, "message": "m/n/c/curator: add UpdateStatus\n\nThis implements Curator.UpdateStatus, which lets nodes self-report some\nstatus items. Currently this is their external IP address, which is\nneeded to generate a Cluster Directory which is in turn needed to\nregister into a cluster.\n\nChange-Id: Ib5464ca78ee3466d9b9f89b7af8b40f613ae8dcc\nReviewed-on: https://review.monogon.dev/c/monogon/+/332\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "d7d6e0284de38cbeeb185ca17c0853b4b2c10ee9", "tree": "37e0b443caf904f0b78d423ba6580c1416f5bc11", "parents": [ "9ffa1f9577003ab70a6b483475874f3552d1ccc3" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 15:03:06 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Fri Sep 03 11:15:40 2021 +0000" }, "message": "m/n/core/rpc: create library for common gRPC functions\n\nThis is the beginning of consolidating all gRPC-related code into a\nsingle package.\n\nWe also run the Curator service publicly and place it behind a new\nauthorization permission bit. This is in preparation for Curator\nfollowers needing access to this Service.\n\nSome of the service split and authorization options are likely to be\nchanged in the future (I\u0027m considering renaming Curator to something\nelse, or at least clearly stating that it\u0027s a node-to-node service).\n\nChange-Id: I0a4a57da15b35688aefe7bf669ba6342d46aa3f5\nReviewed-on: https://review.monogon.dev/c/monogon/+/316\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "9ffa1f9577003ab70a6b483475874f3552d1ccc3", "tree": "a688d02424e8601ed830d12021b5867688d31438", "parents": [ "6bd415920b84bd695038caeb386f1e97184f0c51" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 15:42:23 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Thu Sep 02 10:38:15 2021 +0000" }, "message": "m/n/core/curator: authenticated RPC\n\nThis adds authentication middleware (server interceptors) for gRPC\nservices running on the public curator listener.\n\nMost of this code is testing harnesses to start up just the curator\nlistener with enough of a PKI infrastructure copy from a real Metropolis\ncluster to be able to start running tests against GetRegisterTicket.\n\nChange-Id: I429ff29e3c1233d74e8da619ddb543d56bc051b9\nReviewed-on: https://review.monogon.dev/c/monogon/+/311\nReviewed-by: Lorenz Brun \u003clorenz@monogon.tech\u003e\n" }, { "commit": "6bd415920b84bd695038caeb386f1e97184f0c51", "tree": "60a125e0a299663c392218ed8b80cf33ea31aabd", "parents": [ "68dcee136984e2e16b7682e0c0758c1df831a84c" ], "author": { "name": "Serge Bazanski", "email": "serge@monogon.tech", "time": "Mon Aug 23 13:18:37 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@monogon.tech", "time": "Wed Sep 01 12:56:15 2021 +0000" }, "message": "m/node: add Management service, implement GetRegisterTicket RPC\n\nThis follows the Cluster Lifecycle design document.\n\nDO NOT MERGE: this needs a stacked CL on top which implements\nauthentication for the Management service.\n\nChange-Id: I19422a63b9dbf2fc0c7f4cbe204851af35b4dbdf\nReviewed-on: https://review.monogon.dev/c/monogon/+/307\nReviewed-by: Mateusz Zalega \u003cmateusz@monogon.tech\u003e\n" }, { "commit": "9d6c4c78bca9da0db7e40e5de776528f3d83a7dd", "tree": "71cba058637a866b7c87e3f296dd4995d0171cfe", "parents": [ "257acab41f5a35575ca0f2dbc9568b1bd75d2570" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Jul 20 21:16:27 2021 +0200" }, "committer": { "name": "Lorenz Brun", "email": "lorenz@monogon.tech", "time": "Wed Aug 11 15:38:58 2021 +0000" }, "message": "Support injecting container images for development\n\nThis adds the LoadImage RPC and an accompanying subcommand\nto the debug API which allows loading images into\nan existing Metropolis node for\ndevelopment or testing.\n\nChange-Id: I51d802630ae4c95fb874e01bfb6510ab69c322e1\nReviewed-on: https://review.monogon.dev/c/monogon/+/219\nReviewed-by: Sergiusz Bazanski \u003cserge@monogon.tech\u003e\n" }, { "commit": "30653eeb3adcbebfecb4216569dc247b51cfb464", "tree": "32171ac29f074a717c6e8ddb621a130f68428069", "parents": [ "fac8b2e265836dea105e8463a3a22b189764fd3f" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jun 17 15:44:29 2021 +0200" }, "committer": { "name": "Sergiusz Bazanski", "email": "serge@nexantic.com", "time": "Mon Jun 21 09:12:58 2021 +0000" }, "message": "metropolis/proto/common: factor out common messages\n\nIn preparation for moving some proto structures from this proto package\n(eg. Node etcd serialization) into //metropolis/node/core/curator, we\nfully specify and document all elements of the Node/Cluster FSM states\nand a shared NodeRoles structure.\n\nThese will be shared by both serialized etcd state in the curator, the\ncurator API and possibly other APIs in the future. They are critical to\nthe Metropolis concept, so we aim to have them deduplicated across all\nuses, and that\u0027s why they\u0027re supposed to end up in\n//metropolis/proto/common.\n\nThese effectively temporarily duplicate definitions from\n//metropolis/proto/private, but these will be removed in an upcoming CL.\n\nTesting plan: no-op, in preparation for use in a further CL.\n\nChange-Id: I97087c7348a90e2dbe4cef03f7f55c7b58823ff1\nReviewed-on: https://review.monogon.dev/c/monogon/+/161\nReviewed-by: Lorenz Brun \u003clorenz@nexantic.com\u003e\n" }, { "commit": "09c275bc489bc1de406be9a2e8f158eaa87b7c61", "tree": "31c62a93e37f6052aa99e2addacef6c060d75e85", "parents": [ "37050126ef89ec30cc677c272471debe55ec0d69" ], "author": { "name": "Lorenz Brun", "email": "lorenz@nexantic.com", "time": "Tue Mar 30 12:47:09 2021 +0200" }, "committer": { "name": "Leopold Schabel", "email": "leo@nexantic.com", "time": "Tue Apr 13 11:04:05 2021 +0200" }, "message": "Add ftrace support to DebugService\n\nThis allows us to do ad-hoc kernel-level tracing on a running Metropolis node.\nUseful for tracking down complex bugs.\n\nExample: `bazel run //metropolis/cli/dbg -- trace -function_graph_filter blkdev_* function_graph`\n\nTest Plan: Debug utility, manually tested\n\nX-Origin-Diff: phab/D748\nGitOrigin-RevId: 924eb795250412a73eb30c0eef4a8c1cc726e5fd\n" }, { "commit": "c4a3aab4c8d14d05b7e2448ab11897b6f9093046", "tree": "61585da074852ab286fab9fefa671e35fc1e4658", "parents": [ "42e61c6a3601d7f63176af3f53a3ac9c53120099" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:31:19 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:31:19 2021 +0100" }, "message": "metropolis/proto: remove internal\n\nThis is now unused (as it has been replaced by proto/private) and can be\nremoved.\n\nTest Plan: Refactor.\n\nX-Origin-Diff: phab/D736\nGitOrigin-RevId: e71dfd70d36d0ae9b29e2b287fcc337cf2520a51\n" }, { "commit": "72068da814af80568cb106b877ef8f5e526e684c", "tree": "31831657903e62d4a813c9d18d47413154f13560", "parents": [ "d8af5bf4c14a5c53d1736695a1210b6eea4d246e" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:15:45 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Tue Mar 16 13:15:45 2021 +0100" }, "message": "metropolis/proto: add private\n\nWe add a new proto package, \u0027private\u0027. This will hold all non-public\nproto messages for the implementation of the cluster lifecyclce design\ndocument.\n\nWe duplicate \u0027internal\u0027 for two reasons:\n\n - make it easier to port code accross to use the new protos/cluster\n code, while slowly phasing out protos/internal.\n - \u0027internal\u0027 was a poor name choice, as it\u0027s significant in Go path\n naming, and might cause some problems in the future. We have Bazel\u0027s\n visiblility mechanism to protect accidental use.\n\nTest Plan: New proto, not yet used - see rest of stack.\n\nX-Origin-Diff: phab/D732\nGitOrigin-RevId: 15632353c46068b4f4c5025828c9c8459feaa335\n" }, { "commit": "0ed2f96a3a86aff2c9ce36289aa5d58a75f4d59b", "tree": "afbe1fb6cd0a1667e981edfe97969338437bdaca", "parents": [ "056042962060369bd7607ecfea51c515fc3a8140" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Mar 15 16:39:30 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Mar 15 16:39:30 2021 +0100" }, "message": "metropolis/proto: EnrolmentConfig -\u003e NodeParameters\n\nThis starts off the move to a node configuration API conforming to\nthe lifecycle management design document.\n\nInstead of an Enrolment Config used only to join an existing cluster, we\nmove to a NodeParameters proto that must always be given to a node if\nit\u0027s supposed to either bootstrap a new cluster or join an existing one.\n\nThis links the existing cluster management code (and its state machine)\nto work with this file. However, that state machine will be removed very\nsoon, anyway.\n\nWe also remove everything related to golden tickets.\n\nThis breaks multi-node tests.\n\nX-Origin-Diff: phab/D710\nGitOrigin-RevId: f22615fbccab975f2d5e6928bdc7387ab3aa5714\n" }, { "commit": "32d73486f4ea778cd3ea58e2d579e862cf67fb9c", "tree": "78e3444e0b55df55f512415dbfd34977cdca2350", "parents": [ "6c4199afe4dc4d446679b862f528e840e60925df" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Feb 01 23:49:17 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Feb 01 23:49:17 2021 +0100" }, "message": "metropolis: introduce AAA.Escrow RPC\n\nThis is a combined proto change and design document RFC.\n\nThis implements a generic \u0027Escrow\u0027 methid, used to allow external\nentities to log into a Metropolis cluster. This flow\u0027s subject vaguely\ncorresponds to \u0027Entity\u0027 objects from the Lifecycle DD, but this will be\nmore precisely defined in a subsequent change which introduces the\nactual entities objects, the way they\u0027re identified, and the way they\u0027re\nstored in the cluster.\n\nIn addition, this formalizes the part of the LDD in which entities are\nable to perform hardware attestation on nodes. The hardware attestation\npart is not fully implemented, but is placed within the bounds of the\nEscrow streaming RPC. Entities might also be able to performs this\nhardware attestation in a separate RPC call (having already requested a\nshort-lived certificate permitting access to RPC), but this is not yet\nsure.\n\nThis design, is in a way, a modernized version of GSSAPI. It assumes it\nruns over a confidential channel (TLS), and that it only ever returns\nx509 certificates emitted for the requesting client. It is also designed\nto handle flows that we expect to use within Metropolis.\n\nThis design has some known limitations:\n\n1) Limited decisionmaking abitility by the server to decide which proofs\n are needed - ie., the server cannot change its mind what other proofs\n are needed as the client presents some. Currently the server can\n decide the proofs only based on the parameters given by the client,\n and the initial context of the connection, ie. its originating\n address and the presented TLS certificate.\n2) Limited expressibility of required proofs to the client, currently\n all listed must be fulfilled.\n\nThis, however, can be extended as the protocol evolves, and can continue\nto support simple clients that handle only this protocol. Especially 2)\nmight be limiting us from preventing things like accepting emergency\ncertificates without necessarily needing an OIDC login, even though OIDC\nlogins are required for other kinds of certificates. We are explicitly\ntrying to keep things simple for now, and just not write ourselves into\na corner here.\n\nFinally, this API should cover all scenarios expressed within T865 -\nminus the entity storage part within the cluster.\n\nTest Plan: Proto change and review process.\n\nX-Origin-Diff: phab/D698\nGitOrigin-RevId: 92892b5522a4d41d572fd4c10f24d26f72919aeb\n" }, { "commit": "31370b07f0df2dc2765d812d4ce00a6b35185b16", "tree": "15563902eee9591083284441c8505b084b275d0a", "parents": [ "313816f41244d7520eb2b6f8c231328ee5b7a4ef" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 16:31:14 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 16:31:14 2021 +0100" }, "message": "*: git.monogon.dev -\u003e source.monogon.dev\n\nThis implements T882, setting our (virtual) GOPATH to source.monogon.dev\nfor this repository.\n\nTest Plan: Refactor, CI only.\n\nX-Origin-Diff: phab/D686\nGitOrigin-RevId: c5e2309089948ffc3a98e68e2e0e1cbb157d3a36\n" }, { "commit": "0be9be88224dd87eedb10436b11615fa59862271", "tree": "2cffcd0ca273ada48c0b42a36bd25bb1cc2da35c", "parents": [ "549b72b2d65051403301f53111509f77e88b379b" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 15:23:44 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 15:23:44 2021 +0100" }, "message": "metropolis: Lock down visibility rules\n\nThis formalizes the package structure introduced by D683.\n\nTest Plan: Pure refactor, CI only.\n\nX-Origin-Diff: phab/D684\nGitOrigin-RevId: 574aa14c71faf94f4a5c02a2110e2e3fef7d36ac\n" }, { "commit": "549b72b2d65051403301f53111509f77e88b379b", "tree": "b4e523d5d17e8130545e58b58870b4a18118a780", "parents": [ "696f39abb19ffcca03e9fc5a98681338216b1e7f" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 14:54:19 2021 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Thu Jan 07 14:54:19 2021 +0100" }, "message": "metropolis: unify utility packages\n\nOne last sweeping rename / reshuffle.\n\nWe get rid of //metropolis/node/common and //golibs, unifying them into\na single //metropolis/pkg meta-package.\n\nThis is to be documented somwhere properly, but here\u0027s the new logic\nbehind selecting where to place a new library package:\n\n - if it\u0027s specific to k8s-on-metropolis, put it in\n //metropolis/node/kubernetes/*. This is a self-contained tree that\n other paths cannot import from.\n - if it\u0027s a big new subsystem of the metropolis core, put it in\n //metropolis/node/core. This can be imported by anything in\n //m/n (eg the Kubernetes code at //m/n/kubernetes\n - otherwise, treat it as generic library that\u0027s part of the metropolis\n project, and put it in //metropolis/pkg. This can be imported by\n anything within //metropolis.\n\nThis will be followed up by a diff that updates visibility rules.\n\nTest Plan: Pure refactor, CI only.\n\nX-Origin-Diff: phab/D683\nGitOrigin-RevId: 883e7f09a7d22d64e966d07bbe839454ed081c79\n" }, { "commit": "662b5b3119b0798980b887d1ef9fa1b5632aa7fb", "tree": "3e1fc4ab033530e6d579112ba500d2c6edb43368", "parents": [ "39f2f691726dc6e0a291aa8609085b835a313dad" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Dec 21 13:49:00 2020 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Mon Dec 21 13:49:00 2020 +0100" }, "message": "smalltown -\u003e metropolis\n\nThis pass removes all mentions of Smalltown, both from code and comments,\nand replaces them with appropriate new terminology.\n\nTest Plan: Refactor, covered by CI.\n\nX-Origin-Diff: phab/D674\nGitOrigin-RevId: 04a94d44ef07d46f7821530da5614daefe16d7ea\n" }, { "commit": "77cb6c5ec3acadf02ad5005dd751cfbf0ec1602f", "tree": "7ddfcdf78c489a5d6fad7a20bd3580d803407450", "parents": [ "26d41999e0c71813648c16ad84bba810c3b9d593" ], "author": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Sat Dec 19 00:09:22 2020 +0100" }, "committer": { "name": "Serge Bazanski", "email": "serge@nexantic.com", "time": "Sat Dec 19 00:09:22 2020 +0100" }, "message": "core -\u003e metropolis\n\nSmalltown is now called Metropolis!\n\nThis is the first commit in a series of cleanup commits that prepare us\nfor an open source release. This one just some Bazel packages around to\nfollow a stricter directory layout.\n\nAll of Metropolis now lives in `//metropolis`.\n\nAll of Metropolis Node code now lives in `//metropolis/node`.\n\nAll of the main /init now lives in `//m/n/core`.\n\nAll of the Kubernetes functionality/glue now lives in `//m/n/kubernetes`.\n\nNext steps:\n - hunt down all references to Smalltown and replace them appropriately\n - narrow down visibility rules\n - document new code organization\n - move `//build/toolchain` to `//monogon/build/toolchain`\n - do another cleanup pass between `//golibs` and\n `//monogon/node/{core,common}`.\n - remove `//delta` and `//anubis`\n\nFixes T799.\n\nTest Plan: Just a very large refactor. CI should help us out here.\n\nBug: T799\n\nX-Origin-Diff: phab/D667\nGitOrigin-RevId: 6029b8d4edc42325d50042596b639e8b122d0ded\n" } ] }