From 6e46f2e078a825f27f7a50b431fdb7c8010f8127 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Wed, 7 Oct 2026 11:06:43 +1000 Subject: [PATCH] docs: record EKS gateway publish move --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index 46df68a37..262d9ac13 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -263,6 +263,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `20b5deb5c` | `spinifex/handlers/ec2/{vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/` | VPC, egress-only and internet gateways, Elastic IPs, NAT gateways and route tables are EC2 API resources and keep their responsibilities. `vpc` moves whole; splitting it along VPC, subnet, ENI and security-group boundaries remains EC2 decomposition work. Packages are named after their directories and imported as `ec2`; one test's local `vpc` alias was kept. The reconcile drift-watch test located bucket constants by matching the `handlers_ec2_` qualifier text, so its pattern now matches `ec2`; removing `ec2eip.KVBucketEIPs` from the watched list made it fail as intended. `domains/network`'s imports of these packages are now visible domain-to-domain edges, already listed in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused EC2 and network domain, EC2 gateway, handler, daemon and CLI suites, and tagged integration/E2E compilation passed. | | `5d60184e8` | `spinifex/handlers/ec2/{instance,volume,snapshot,image,tags}` | `spinifex/domains/ec2/` | Instances, volumes, snapshots, images and tags are EC2 API resources and keep their responsibilities; `handlers/ec2` is now empty. Packages are named after their directories and imported as `ec2`; one test's local `instance` alias was kept. `docs/service-interfaces.yaml` mapped `spinifex/handlers/ec2` to the daemon for e2e suite selection, so since the first EC2 slice an EC2-only change fell back to the default suites; a throwaway commit changing only a `domains/ec2/key` file selected `e2e-cert e2e-lb` with the old manifest and the daemon suites with the new one, which lists the 17 moved resource paths rather than all of `domains/ec2` so selection is unchanged. The move exposes `domains/ec2/instance`'s runtime and DNS imports, recorded in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused domain, EC2 gateway, handler, daemon, account-teardown, CLI and selector suites, `manifest-check` and tagged integration/E2E compilation passed. | | `4501dbf69` | `cmd/ecr-credential-provider` (implementation) | `spinifex/agents/eks/credentialprovider` | The kubelet exec credential provider is EKS-node integration and moves under the agent tree as ADR-0001 maps it; it depends only on `internal/{ecrauth,guestenv,imdscreds}`, so no ECR domain code gains a guest-environment dependency. `main()` became `Main(in, out) int` with the same body writing to `out` and returning the exit code; the thin `cmd/ecr-credential-provider` main keeps the binary name and the `fipsboot` import. `.golangci.yml` excludes gosec for `cmd/`, so the move brings this code under gosec for the first time; its one G101 false positive is annotated. The moved test, full preflight apart from the known vulnerability-scan finding, a bad-CA smoke run (empty-auth response, exit 1) and a dependency check that `fipsboot` still links into the binary passed. | +| `fecf0b28a` | `cmd/eks-gateway-publish` (implementation) | `spinifex/agents/eks/gatewaypublish` | The control-plane VM's gateway publication relay is EKS in-guest behaviour. `cmd/eks-gateway-publish` keeps flag definitions, `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-publish:` log prefix and exit code 1; the agent exposes only `Config` and `Run(ctx, Config) error` and imports no `flag`, `os.Args`, `os.Stdin` or `os.Exit`. The 11 former `fatal` sites had no defers or cleanup and return errors with identical text. `retryDelay` became a variable for tests and the retry wait honours context cancellation, which the binary's background context never triggers. New focused `Run` tests cover every validation and payload error, a wrapped publish, the 30-attempt budget and cancellation. Old and new binaries gave identical stderr and exit codes for nine command-path cases apart from the binary path in flag usage output. Full preflight apart from the known vulnerability-scan finding passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS