2 Commits

Author	SHA1	Message	Date
Josh Siviour	de64d6c63d	feat(ecs): agent control-plane over the AWS gateway (drop direct NATS) (#419) ... * feat(ecsgw): on-VM SigV4 client for the ECS agent→gateway channel Adds internal/ecsgw, the twin of internal/eksgw: a TLS + SigV4 (service "ecs") client the ecs-agent will use to reach the AWS gateway over HTTPS instead of connecting to host NATS directly. Calls are AWS JSON 1.1 with an X-Amz-Target action; the gateway relays onto ecs.* host-side, keeping NATS cluster-internal. * feat(ecs): SubmitTaskStateChange gateway action → recordTaskState Wires the AWS-API SubmitTaskStateChange action end to end (gateway action → ecs.SubmitTaskStateChange NATS → daemon → Service.SubmitTaskStateChange) so a gateway-routed agent reports task state without touching the NATS bus. The handler maps the SDK input onto the same bus.TaskState shape and converges on recordTaskState; the account is authoritative from the SigV4 caller, so an instance cannot report state for another account's task. * feat(ecs): durable assign KV inbox + PollAssignments gateway action Scheduler writes task assigns into a per-instance KV inbox (clusters/{cluster}/assignments/{instance}/{task}) instead of a fire-and-forget core-NATS publish, and a new PollAssignments gateway action lets a gateway-routed agent drain its inbox over TLS+SigV4. At-least-once: an unacked assign is re-delivered on the next poll; the agent acks accepted assigns (AckTaskIDs) and STOPPED transitions reclaim stale inbox entries. The Poll response carries bus.Assign with an RFC3339 time, so it is encoded with encoding/json (RawJSONActions) rather than the jsonutil epoch-second marshaler. * feat(ecs-agent): rewire control-plane off NATS onto the AWS gateway The agent no longer connects to NATS. It registers, heartbeats, reports task state, and receives assignments entirely through the AWS gateway over TLS+SigV4, using seeded IAM credentials — keeping the NATS bus host-internal and closing the trust-boundary gap (a tenant container instance must not hold a shared bus token). - controlPlane seam over ecsgw.Client replaces the NATS publisher: Register (RegisterContainerInstance), SubmitTaskState (SubmitTaskStateChange), PollAssignments. - Heartbeat folds into a periodic idempotent re-register (refreshes LastSeen); bus.Heartbeat is dropped from the agent. - subscribeAssign (NATS subscribe) becomes a poll loop: drain the inbox, dispatch each assign once, ack accepted taskIDs on the next poll (at-least-once). - config: ECS_ACCESS_KEY / ECS_SECRET_KEY / ECS_POLL_INTERVAL added, ECS_NATS_URL removed; cloud-init initd seeds the IAM creds. Tests move from the NATS publisher fake to a controlPlane fake. * feat(ecs): cloud-init cred-seed + ecs-node bring-up script ECS container instances are plain EC2 booted from the spinifex-ecs-node AMI (AWS-faithful: no ECS-specific launch API). This renders the cloud-init user-data that seeds /etc/spinifex-ecs/agent.env (gateway URL/CA/region/cluster + IAM creds) and the gateway CA, then runs the instance. The agent registers, heartbeats, polls assignments, and reports task state entirely through the AWS gateway over TLS+SigV4 — never NATS. The guest dials the customer-facing gateway address (network advertise IP), not the mgmt bridge, mirroring the EKS GatewayURL/AddonGatewayURL split. Seeds the system key for now; scoped per-instance creds are a follow-up (4g task-role endpoint). * fix(ecs): reconcile dev merge — restore #418 ENI release + netns wiring The 'Merge branch dev' resolution dropped code where Sprint 4d (#418, awsvpc ENI-per-task) and the gateway control-plane rewrite (#419) touch the same paths: - recordTaskState STOPPED branch: reclaimTaskENI was clobbered by reclaimAssignInbox; both are needed (release the task ENI AND drain the KV inbox). Restores TestRecordTaskState_Awsvpc_ReleasesENIOnStopOnce. - ecs-agent Agent: the netns field, its init, and the setupTaskNetns/ teardownTaskNetns wrappers were lost when the controlPlane Agent struct won the merge, leaving taskrun.go calling undefined methods. - eni_test assign assertion read the assign over NATS; #419 delivers it via the durable KV inbox, so it now polls via PollAssignments. - taskrun_test netns cases used the removed historyPub fake; switched to fakeCP to match the controlPlane seam.	2026-06-25 18:42:24 +10:00
Josh Siviour	93db7e4d1b	feat(ecs): ecs-agent skeleton + containerd image pull (Sprint 4c) (#414) ... * feat(ecs): ecs-agent skeleton + containerd image pull (Sprint 4c) Add the ecs-agent binary that runs inside an ECS container instance: it resolves host identity from IMDS, registers on the Layer-2 NATS bus, and heartbeats while alive. Image pulls go through a containerd-backed ImagePuller behind an interface, with an ECR resolver that mints GetAuthorizationToken creds from the instance role. Extract the IMDS-credential and ECR-auth flow out of ecr-credential-provider into internal/imdscreds and internal/ecrauth so the agent and the kubelet provider share one implementation. Add spinifex/handlers/ecs/bus as the single source of truth for Layer-2 subject builders and wire payloads, shared by the agent now and the scheduler in Sprint 4e. * build: pin genproto via replace to fix containerd/v2 ambiguous import go.opencensus.io -> grpc@v1.33.2 drags the pre-split monolithic genproto into the module graph; it still ships googleapis/rpc/status, which collides with the split genproto/googleapis/rpc module that containerd/ttrpc needs. The main module never imports the monolith, so a plain require bump is dropped by 'go mod tidy'. Pin it with a replace to a post-split version so the fix survives tidy and contributors can run 'go mod tidy' freely. * fix(ecs): agent boot failsafes from runtime verify - Build the ECR gateway HTTP client lazily on first image pull instead of at boot. A missing/malformed gateway CA no longer kills the agent before it can register + heartbeat, matching the best-effort containerd path. - Actively probe containerd with IsServing in runtime.New. The client dials lazily, so a dead socket previously slipped past the boot-time 'containerd unavailable' warn and only surfaced on the first pull. - Make the heartbeat interval configurable via ECS_HEARTBEAT_INTERVAL (default 30s) for test/verify and slow-link tuning.	2026-06-24 21:18:03 +10:00