chore: more cleanups

cmd/eks-token-webhook/main.go

@@ -125,7 +125,12 @@ func run(cfg config) error {
 	})
 	mux.HandleFunc("/authenticate", authr.handle)
 
-	server := newServer(cfg.addr, mux, tlsCert)
+	server := &http.Server{
+		Addr:              cfg.addr,
+		Handler:           mux,
+		ReadHeaderTimeout: 5 * time.Second,
+		TLSConfig:         tlsCert.serverTLSConfig(),
+	}
 	slog.Info("eks-token-webhook listening", "addr", cfg.addr, "cluster", cfg.clusterName)
 	if err := server.ListenAndServeTLS("", ""); err != nil && !errors.Is(err, http.ErrServerClosed) {
 		return fmt.Errorf("serve: %w", err)
@@ -214,14 +219,3 @@ func (a *authenticator) handle(w http.ResponseWriter, r *http.Request) {
 		slog.Error("encode TokenReview response", "err", err)
 	}
 }
-
-// newServer builds the loopback TLS server. Split out so tests can construct it
-// without binding a port.
-func newServer(addr string, handler http.Handler, cert tlsCertificate) *http.Server {
-	return &http.Server{
-		Addr:              addr,
-		Handler:           handler,
-		ReadHeaderTimeout: 5 * time.Second,
-		TLSConfig:         cert.serverTLSConfig(),
-	}
-}

spinifex/daemon/daemon.go

@@ -64,24 +64,6 @@ import (
 	"github.com/nats-io/nats.go"
 )
 
-type BlockDeviceMapping struct {
-	DeviceName string `json:"DeviceName"`
-	EBS        EBS    `json:"EBS"`
-}
-
-type EBS struct {
-	DeleteOnTermination      bool
-	Encrypted                bool
-	Iops                     int
-	KmsKeyId                 string
-	OutpostArn               string
-	SnapshotId               string
-	Throughput               int
-	VolumeInitializationRate int
-	VolumeSize               int
-	VolumeType               string
-}
-
 // ResourceManager handles the allocation and tracking of system resources.
 // It dynamically manages per-instance-type NATS subscriptions: when capacity
 // is available for a type, the node subscribes to ec2.RunInstances.{type};

spinifex/daemon/daemon_handlers_eks_test.go

@@ -20,7 +20,7 @@ import (
 func setupEKSDaemon(t *testing.T) (*Daemon, *nats.Conn) {
 	t.Helper()
 	_, nc, _ := testutil.StartTestJetStream(t)
-	svc, err := handlers_eks.NewEKSServiceImplWithNATS(nil, nc)
+	svc, err := handlers_eks.NewEKSServiceImpl(handlers_eks.EKSServiceDeps{NATSConn: nc})
 	require.NoError(t, err)
 	return &Daemon{eksService: svc}, nc
 }

spinifex/gateway/eks/handler.go

@@ -73,19 +73,3 @@ func WriteJSONError(w http.ResponseWriter, code, message string, httpStatus int)
 		slog.Error("Failed to write EKS error response", "err", err)
 	}
 }
-
-// WriteErrorFromCode looks up an awserrors code and writes the JSON error
-// envelope. Falls back to 500 InternalError for unknown codes.
-func WriteErrorFromCode(w http.ResponseWriter, code string) {
-	msg, ok := awserrors.ErrorLookup[code]
-	if !ok {
-		slog.Warn("Unknown EKS error code", "code", code)
-		WriteJSONError(w, awserrors.ErrorInternalError, "Internal error", http.StatusInternalServerError)
-		return
-	}
-	httpStatus := msg.HTTPCode
-	if httpStatus == 0 {
-		httpStatus = http.StatusInternalServerError
-	}
-	WriteJSONError(w, code, msg.Message, httpStatus)
-}

spinifex/gateway/gateway.go

@@ -17,7 +17,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/mulgadc/predastore/auth"
 	"github.com/mulgadc/predastore/ratelimit"
-	"github.com/mulgadc/spinifex/spinifex/awsec2query"
 	"github.com/mulgadc/spinifex/spinifex/awserrors"
 	gateway_ecr "github.com/mulgadc/spinifex/spinifex/gateway/ecr"
 	gateway_ecrauth "github.com/mulgadc/spinifex/spinifex/gateway/ecrauth"
@@ -624,17 +623,6 @@ func GenerateIAMErrorResponse(code, message, requestID string) (output []byte) {
 	return output
 }
 
-func ParseArgsToStruct(input *any, args map[string]string) (err error) {
-	// Generated from input shape: RunInstancesRequest
-	err = awsec2query.QueryParamsToStruct(args, input)
-
-	if err != nil {
-		return errors.New(awserrors.ErrorInvalidParameter)
-	}
-
-	return nil
-}
-
 // DiscoverActiveNodes discovers the number of active spinifex daemon nodes in the cluster
 // by publishing a discovery request and counting unique responses.
 // Returns the number of active nodes (minimum 1 if fallback is needed).

spinifex/gateway/gateway_test.go

@@ -988,38 +988,6 @@ func TestImportKeyPair_Base64PaddingWorkaround(t *testing.T) {
 		"Expected no URL-encoded padding remaining")
 }
 
-func TestParseArgsToStruct(t *testing.T) {
-	// ParseArgsToStruct wraps QueryParamsToStruct errors as ErrorInvalidParameter.
-	// The *any parameter causes a reflection kind mismatch, so this always errors.
-	type simpleInput struct {
-		Action string `locationName:"Action"`
-	}
-
-	t.Run("struct pointer wrapped in any returns InvalidParameter", func(t *testing.T) {
-		args := map[string]string{"Action": "RunInstances"}
-		var input any = &simpleInput{}
-		err := ParseArgsToStruct(&input, args)
-		assert.Error(t, err)
-		assert.Equal(t, "InvalidParameter", err.Error())
-	})
-
-	t.Run("non-pointer input returns InvalidParameter", func(t *testing.T) {
-		args := map[string]string{"Action": "Test"}
-		var input any = "not a struct"
-		err := ParseArgsToStruct(&input, args)
-		assert.Error(t, err)
-		assert.Equal(t, "InvalidParameter", err.Error())
-	})
-
-	t.Run("empty args still returns InvalidParameter", func(t *testing.T) {
-		args := map[string]string{}
-		var input any = &simpleInput{}
-		err := ParseArgsToStruct(&input, args)
-		assert.Error(t, err)
-		assert.Equal(t, "InvalidParameter", err.Error())
-	})
-}
-
 // --- Throttle middleware integration tests ---
 
 func TestThrottleKeyFuncs_ExtractsAccountAndAction(t *testing.T) {

spinifex/gpu/bind.go

@@ -14,12 +14,6 @@ func BindVFIO(addr string) (string, error) {
 	return bindVFIO("/sys", addr)
 }
 
-// UnbindVFIO unbinds addr from vfio-pci, clears driver_override, and rebinds
-// to originalDriver. If originalDriver is empty the device is left unbound.
-func UnbindVFIO(addr, originalDriver string) error {
-	return unbindVFIO("/sys", addr, originalDriver)
-}
-
 // CurrentDriver returns the name of the driver currently bound to addr,
 // or "" if the device is unbound.
 func CurrentDriver(addr string) (string, error) {

spinifex/gpu/iommu.go

@@ -7,12 +7,8 @@ import (
 	"strconv"
 )
 
-// GroupMembers returns all PCI devices in the given IOMMU group.
+// groupMembers returns all PCI devices in the given IOMMU group.
 // All members must be bound to vfio-pci together for passthrough.
-func GroupMembers(groupNum int) ([]IOMMUGroupMember, error) {
-	return groupMembers("/sys", groupNum)
-}
-
 func groupMembers(sysfsRoot string, groupNum int) ([]IOMMUGroupMember, error) {
 	devicesPath := filepath.Join(sysfsRoot, "kernel/iommu_groups", strconv.Itoa(groupNum), "devices")
 	entries, err := os.ReadDir(devicesPath)

spinifex/handlers/eks/service_impl.go

@@ -191,11 +191,6 @@ func NewEKSServiceImpl(deps EKSServiceDeps) (*EKSServiceImpl, error) {
 	}, nil
 }
 
-// NewEKSServiceImplWithNATS is a back-compat shim for tests that only need NATS wiring.
-func NewEKSServiceImplWithNATS(cfg *config.Config, nc *nats.Conn) (*EKSServiceImpl, error) {
-	return NewEKSServiceImpl(EKSServiceDeps{Config: cfg, NATSConn: nc})
-}
-
 // Shutdown stops the per-cluster reconciler goroutines and cancels every
 // background bootstrap goroutine. Safe to call multiple times.
 func (s *EKSServiceImpl) Shutdown() {

spinifex/handlers/eks/service_impl_test.go

@@ -16,14 +16,14 @@ import (
 func setupTestService(t *testing.T) *EKSServiceImpl {
 	t.Helper()
 	_, nc, _ := testutil.StartTestJetStream(t)
-	svc, err := NewEKSServiceImplWithNATS(nil, nc)
+	svc, err := NewEKSServiceImpl(EKSServiceDeps{NATSConn: nc})
 	require.NoError(t, err)
 	return svc
 }
 
 // TestEKSServiceImpl_ClusterLifecycleShimMode covers the four lifecycle
-// methods when the service is constructed via NewEKSServiceImplWithNATS
-// (the shim path the daemon-handler routing test uses): orchestration deps
+// methods when the service is constructed with only NATS wiring (the path the
+// daemon-handler routing test uses): orchestration deps
 // are absent so CreateCluster/DeleteCluster short-circuit to ServiceUnavailable
 // (the missing deps are logged at ERROR), DescribeCluster hits an empty
 // per-account bucket and surfaces ResourceNotFoundException, and ListClusters