From c42160d8982bac237cf04cfdb4acd295e5a0e815 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Wed, 7 Oct 2026 11:25:07 +1000 Subject: [PATCH] docs: record EKS webhook cert move --- docs/PACKAGE_BOUNDARY_MIGRATION.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md index fa74c7734..684daedae 100644 --- a/docs/PACKAGE_BOUNDARY_MIGRATION.md +++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md @@ -265,6 +265,7 @@ while the branch is in flight; they do not describe the umbrella repository's | `4501dbf69` | `cmd/ecr-credential-provider` (implementation) | `spinifex/agents/eks/credentialprovider` | The kubelet exec credential provider is EKS-node integration and moves under the agent tree as ADR-0001 maps it; it depends only on `internal/{ecrauth,guestenv,imdscreds}`, so no ECR domain code gains a guest-environment dependency. `main()` became `Main(in, out) int` with the same body writing to `out` and returning the exit code; the thin `cmd/ecr-credential-provider` main keeps the binary name and the `fipsboot` import. `.golangci.yml` excludes gosec for `cmd/`, so the move brings this code under gosec for the first time; its one G101 false positive is annotated. The moved test, full preflight apart from the known vulnerability-scan finding, a bad-CA smoke run (empty-auth response, exit 1) and a dependency check that `fipsboot` still links into the binary passed. | | `fecf0b28a` | `cmd/eks-gateway-publish` (implementation) | `spinifex/agents/eks/gatewaypublish` | The control-plane VM's gateway publication relay is EKS in-guest behaviour. `cmd/eks-gateway-publish` keeps flag definitions, `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-publish:` log prefix and exit code 1; the agent exposes only `Config` and `Run(ctx, Config) error` and imports no `flag`, `os.Args`, `os.Stdin` or `os.Exit`. The 11 former `fatal` sites had no defers or cleanup and return errors with identical text. `retryDelay` became a variable for tests and the retry wait honours context cancellation, which the binary's background context never triggers. New focused `Run` tests cover every validation and payload error, a wrapped publish, the 30-attempt budget and cancellation. Old and new binaries gave identical stderr and exit codes for nine command-path cases apart from the binary path in flag usage output. Full preflight apart from the known vulnerability-scan finding passed. | | `8929ee47b` | `cmd/eks-gateway-fetch` (implementation) | `spinifex/agents/eks/gatewayfetch` | The control-plane VM's add-on and recovery fetch is EKS in-guest behaviour. `cmd/eks-gateway-fetch` keeps its nine flags in their original order with `EKS_*` environment defaults, parsing, the `fipsboot` import, the `eks-gateway-fetch:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error`. The 8 former `fatal` sites had no defers or cleanup and return errors with identical text; a render failure is still not retried. As with publish, `retryDelay` is a test variable and the retry wait honours a cancellation the binary never triggers. The TSV emitters and their tests moved unchanged; new `Run` tests cover the five startup errors, addons and recovery rendering at their gateway paths, an unretried render failure, the attempt budget and cancellation. Old and new binaries gave byte-identical stdout, stderr and exit codes for 11 cases against a local TLS gateway, including both TSV outputs and flags overriding environment. Full preflight apart from the known vulnerability-scan finding passed. | +| `d064924e6` | `cmd/eks-webhook-cert` (implementation) | `spinifex/agents/eks/webhookcert` | Minting and caching the in-cluster admission webhook's self-signed serving certificate is EKS in-guest behaviour. `cmd/eks-webhook-cert` keeps the `-dir`, `-cn` and `-dns` flags, parsing, the usage text, the `fipsboot` import, the `eks-webhook-cert:` log prefix and exit code 1; the agent exposes only `Config` (with `Out` supplied by the binary) and `Run(ctx, Config) error` and depends only on the standard library. The 3 former `fatal` sites had no defers or cleanup; a key-write failure still leaves `tls.crt` on disk, and a stdout write error is still ignored. Moving out of `cmd/` brought the file under gosec, whose G306 finding on the public certificate's 0644 mode is annotated with its reason. Existing tests moved unchanged; new `Run` tests cover the required-flag and blank-SAN errors, the cache-directory failure and the one-line CA/leaf/key output. Old and new binaries gave identical stdout, stderr, exit codes, file modes and output shape for 7 cases, and a second run reused the cached pair. Full preflight apart from the known vulnerability-scan finding passed. | The EC2 contract row is intentionally different from the directory moves: it creates a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS