From 7ca1cc91ea53f714c9178b2228653bedc4541a2b Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Wed, 7 Oct 2026 10:15:55 +1000 Subject: [PATCH] docs: record ECR credential provider move --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index 633bdfa7e..46df68a37 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -262,6 +262,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `d8ab4017a` | `spinifex/handlers/ec2/{account,key,launchtemplate,placementgroup,spotinstance,volumestate}` | `spinifex/domains/ec2/` | These EC2 resources import no other EC2 handler package, so they move first as EC2 domain resources with their responsibilities unchanged. Each package is named after its directory and callers import it as `ec2`, because the bare names collide with common local identifiers; `volumestate` already carried its directory name. No package name appears in error text, KV keys or metrics. Path comments were updated. Full preflight apart from the known vulnerability-scan finding, focused EC2 domain, EC2 gateway, account-teardown and remaining EC2 handler suites, and tagged integration/E2E compilation passed. | | `20b5deb5c` | `spinifex/handlers/ec2/{vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/` | VPC, egress-only and internet gateways, Elastic IPs, NAT gateways and route tables are EC2 API resources and keep their responsibilities. `vpc` moves whole; splitting it along VPC, subnet, ENI and security-group boundaries remains EC2 decomposition work. Packages are named after their directories and imported as `ec2`; one test's local `vpc` alias was kept. The reconcile drift-watch test located bucket constants by matching the `handlers_ec2_` qualifier text, so its pattern now matches `ec2`; removing `ec2eip.KVBucketEIPs` from the watched list made it fail as intended. `domains/network`'s imports of these packages are now visible domain-to-domain edges, already listed in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused EC2 and network domain, EC2 gateway, handler, daemon and CLI suites, and tagged integration/E2E compilation passed. | | `5d60184e8` | `spinifex/handlers/ec2/{instance,volume,snapshot,image,tags}` | `spinifex/domains/ec2/` | Instances, volumes, snapshots, images and tags are EC2 API resources and keep their responsibilities; `handlers/ec2` is now empty. Packages are named after their directories and imported as `ec2`; one test's local `instance` alias was kept. `docs/service-interfaces.yaml` mapped `spinifex/handlers/ec2` to the daemon for e2e suite selection, so since the first EC2 slice an EC2-only change fell back to the default suites; a throwaway commit changing only a `domains/ec2/key` file selected `e2e-cert e2e-lb` with the old manifest and the daemon suites with the new one, which lists the 17 moved resource paths rather than all of `domains/ec2` so selection is unchanged. The move exposes `domains/ec2/instance`'s runtime and DNS imports, recorded in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused domain, EC2 gateway, handler, daemon, account-teardown, CLI and selector suites, `manifest-check` and tagged integration/E2E compilation passed. | +| `4501dbf69` | `cmd/ecr-credential-provider` (implementation) | `spinifex/agents/eks/credentialprovider` | The kubelet exec credential provider is EKS-node integration and moves under the agent tree as ADR-0001 maps it; it depends only on `internal/{ecrauth,guestenv,imdscreds}`, so no ECR domain code gains a guest-environment dependency. `main()` became `Main(in, out) int` with the same body writing to `out` and returning the exit code; the thin `cmd/ecr-credential-provider` main keeps the binary name and the `fipsboot` import. `.golangci.yml` excludes gosec for `cmd/`, so the move brings this code under gosec for the first time; its one G101 false positive is annotated. The moved test, full preflight apart from the known vulnerability-scan finding, a bad-CA smoke run (empty-auth response, exit 1) and a dependency check that `fipsboot` still links into the binary passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS