5ff0fa452c
refactor: localize ecr repository projection
2026-10-01 14:55:41 +10:00
452005583c
docs: record ecr domain migration sequence
2026-10-01 14:50:00 +10:00
474c073167
refactor: move ecr auth bridge to domain
2026-10-01 14:48:07 +10:00
5e7311eb25
refactor: move ecr registry adapter to domain
2026-10-01 14:45:31 +10:00
51b5c55b95
refactor: move ecr aws actions to domain
2026-10-01 14:42:37 +10:00
93084043a9
refactor: move ecr resource owner to domain
2026-10-01 14:35:36 +10:00
a010f731e0
docs: record bootstrap configuration relocation
2026-10-01 14:28:38 +10:00
f119229861
refactor: move root configuration to bootstrap
2026-10-01 14:23:56 +10:00
6057d2f880
docs: record provider adapter relocations
2026-10-01 14:17:33 +10:00
dbc62562c8
refactor: move object storage adapter to providers
2026-10-01 14:16:25 +10:00
61cf833aa4
refactor: move exoscale client to cloud providers
2026-10-01 14:09:08 +10:00
08d9507701
refactor: localize qmp collector metrics
2026-10-01 14:06:10 +10:00
b975f1ba9d
refactor: make legacy EBS messaging explicit
2026-10-01 14:02:02 +10:00
3f91a3dbcd
Merge remote-tracking branch 'origin/dev' into refactor/spinifex-package-boundaries
...
# Conflicts:
# spinifex/daemon/daemon.go
# spinifex/foundation/aws/arn/arn.go
# spinifex/foundation/aws/arn/arn_test.go
# spinifex/foundation/state/kvlease/bucket.go
# spinifex/foundation/state/kvlease/bucket_test.go
# spinifex/foundation/state/kvstore/wait.go
# spinifex/foundation/state/kvstore/wait_test.go
# spinifex/foundation/state/kvutil/bucket_creation_invariants_test.go
# spinifex/foundation/state/kvutil/export_test.go
# spinifex/foundation/state/kvutil/kvutil.go
# spinifex/foundation/state/kvutil/kvutil_test.go
# spinifex/foundation/state/kvutil/replicas.go
# spinifex/foundation/state/kvutil/replicas_health_test.go
# spinifex/foundation/state/kvutil/replicas_test.go
# spinifex/foundation/state/kvutil/state_test.go
# spinifex/gateway/auth.go
# spinifex/gateway/bedrock/logging.go
# spinifex/gateway/ec2_authz_test.go
# spinifex/gateway/ecrapi/authz.go
# spinifex/gateway/eks.go
# spinifex/gateway/gateway_test.go
# spinifex/handlers/ec2/eigw/service_impl.go
# spinifex/handlers/ec2/igw/service_impl.go
# spinifex/handlers/ec2/instance/service_impl.go
# spinifex/handlers/ec2/launchtemplate/service_impl_test.go
# spinifex/handlers/ec2/placementgroup/service_impl.go
# spinifex/handlers/ec2/placementgroup/service_impl_test.go
# spinifex/handlers/ec2/routetable/service_impl.go
# spinifex/handlers/ec2/spotinstance/service_impl.go
# spinifex/handlers/ec2/volume/service_impl.go
# spinifex/handlers/ec2/vpc/eni.go
# spinifex/handlers/ec2/vpc/security_group.go
# spinifex/handlers/ec2/vpc/service_impl.go
# spinifex/handlers/ecs/tags.go
# spinifex/handlers/eks/k3s_ha_control_plane.go
# spinifex/handlers/iam/groups.go
# spinifex/handlers/iam/retry.go
# spinifex/handlers/rds/subnetgroup_test.go
# spinifex/handlers/sts/assume_role.go
# spinifex/ingress/aws/query/parser_fuzz_test.go
# spinifex/runtime/compute/cache/cache_test.go
# spinifex/runtime/roles/nats/servername.go
# spinifex/services/awsgw/awsgw.go
# spinifex/services/viperblockd/volume_dirty.go
# spinifex/utils/account.go
2026-10-01 13:31:45 +10:00
0b82e14049
refactor: establish legacy Viperblockd sync contract
2026-10-01 12:12:01 +10:00
04c80f3897
feat(iam): supply aws:CurrentTime and aws:EpochTime and accept the date operators ( #1147 )
2026-10-01 12:11:35 +10:00
94a6e7af25
refactor: establish legacy Viperblockd config contract
2026-10-01 11:57:31 +10:00
211e2b8cfc
feat(iam): accept Null and IfExists condition operators at the write path ( #1145 )
2026-10-01 11:28:44 +10:00
74243730fa
fix(iam): resolve policy and instance-profile ARNs against the stored ARN ( #1144 )
2026-10-01 11:13:30 +10:00
2230e92ec2
feat(iam): accept negated, case-insensitive and NotIpAddress condition operators ( #1143 )
2026-10-01 10:49:51 +10:00
c7513c0394
fix: flaky test
2026-10-01 10:18:04 +10:00
c782585352
feat(iam): accept NotAction and NotResource on identity policies ( #1142 )
2026-10-01 10:09:39 +10:00
c98715f7a3
feat: supply iam:PassedToService on PassRole checks ( #1141 )
2026-10-01 09:24:46 +10:00
adb55de33e
refactor: localize Viperblockd NBD transport
2026-10-01 08:43:20 +10:00
f4cb550c94
refactor: localize GP3 volume policy
2026-10-01 08:33:41 +10:00
08bd335f0a
refactor: establish node status contract
2026-10-01 08:22:26 +10:00
14ba518186
feat: source=exoscale external pool allocating Elastic IPs through the exo CLI ( #1140 )
...
* docs: add work-in-progress Exoscale integration guide with stack diagrams
* feat: source=exoscale external pool allocating Elastic IPs through the exo CLI
* docs: rewrite the Exoscale guide as a short end-user install, and test the exo fake, store and wiring
2026-09-30 15:08:26 -05:00
4b35a2a33d
refactor: establish node VM inventory contract
2026-09-30 16:27:39 +10:00
36d5788923
fix: require iam:PassRole for EKS cluster and node roles ( #1139 )
2026-09-30 16:22:16 +10:00
78fd017e03
refactor: establish telemetry sidecar contract
2026-09-30 16:05:35 +10:00
5d88a33998
refactor: establish operator storage contract
2026-09-30 15:56:13 +10:00
53a6147178
refactor: localize cluster config hash input
2026-09-30 15:49:07 +10:00
6d6275e78d
refactor: establish cluster health contract
2026-09-30 15:43:34 +10:00
dc636cac63
fix: cut fixed waits from viperblockd and cmd tests
2026-09-30 15:42:48 +10:00
8a1045b4e7
fix: ack vpc.delete-nat in tests so teardown doesn't wait out the 15 s request timeout
2026-09-30 15:37:40 +10:00
b49e55a586
refactor: establish cluster discovery contract
2026-09-30 15:35:33 +10:00
c239fd8973
refactor: colocate ENI allocation with VM runtime
2026-09-30 15:26:40 +10:00
51d855aa80
refactor: remove spx service stop/status and narrow service.Service to Start ( #1138 )
2026-09-30 15:18:49 +10:00
60c9ed47d7
refactor: establish IGW projection contract
2026-09-30 15:18:20 +10:00
ef22698f65
docs: record package-boundary contracts
2026-09-30 15:08:17 +10:00
aa0c36ff4e
refactor: establish EC2 command contract
2026-09-30 14:46:31 +10:00
a06eccfdab
test: fuzz awsec2query parser and add make fuzz
...
Fuzz QueryParamsToStruct over query bodies decoded into EC2, ELBv2 and RDS
inputs: no panic, list entries bounded by MaxSliceLen and the input size, and
an entry past the first gap never changes the parse. make fuzz runs every
Fuzz* target for FUZZTIME each.
2026-09-30 14:35:48 +10:00
520b2d1689
fix: refuse request bodies the authz gate and handler would read differently
...
bodyscope lower-cased names with strings.ToLower and decoded into a map, while
handlers decode with encoding/json. A non-ASCII name that encoding/json folds
onto an ASCII field (repoſitoryName), or a repeated name whose later value is
null or an object, let the gate authorize one resource while the handler acted
on another. Parse now decodes with encoding/json/v2, which refuses repeated
names, and refuses non-ASCII names; both yield ErrAmbiguousBody.
FuzzGateMatchesHandler checks, for every identifier the ECR, ECS, EKS, ACM and
Bedrock resolvers read, that the gate and a handler-shaped decode agree.
2026-09-30 14:17:46 +10:00
7bbf78df78
chore: cleanup preflight
2026-09-30 13:52:47 +10:00
2b4ddad78a
chore: drop dead and redundant nolint directives
...
Removes directives for linters that are not enabled (noctx, exhaustive,
deadcode) and gosec suppressions already covered by config exclusions.
Tags ochrevector QueryResult and Filter with their existing field names
so musttag passes without changing the NATS wire format, and bounds the
RDS window slot conversion instead of suppressing G115.
2026-09-30 13:46:11 +10:00
39fdd132ee
fix: verify cluster CA on peer and predastore readiness probes
...
Peer /health and predastore readiness probes skipped TLS verification.
Both now trust the cluster CA (nats.cacert) that issues every node's server
cert. A node without the CA stops peer probing, leaving peers reachable,
and reports predastore not ready.
2026-09-30 13:43:22 +10:00
524a7a519f
chore: centralise arn splitting
2026-09-30 12:30:25 +10:00
a3ea962d1e
chore: shared e2e ssh harness
2026-09-30 12:21:57 +10:00
5f21fd27e3
chore: inline more
2026-09-30 12:01:21 +10:00
1344a8e3ca
chore: inline function wrappers
2026-09-30 11:55:40 +10:00
joshsiv-mulga