Merge remote-tracking branch 'origin/feat/eks-node-lifecycle' into e2e/integration

test(e2e): check the live worker's Node and wait out nodegroup deletes
WorkerNodeReady accepted any Ready Node, the tolerate-all DaemonSet check dropped pods with no Ready condition, and nodegroup cleanup returned before the nodegroup was gone. Scope the Ready check to the CPIsolation nodegroup, count a pod with no Ready condition as not Ready, wait for each nodegroup delete, and assert that deleted nodegroups leave no Node behind.
2026-11-01 16:59:45 +00:00 · 2026-11-02 00:52:09 +10:00 · 2026-11-02 00:49:42 +10:00 · 2026-11-02 00:49:42 +10:00 · 2026-11-02 00:44:14 +10:00
2 changed files with 1 additions and 21 deletions
@@ -1203,16 +1203,6 @@ jobs:
          sleep 2
          rm -f "$TMPDIR"/tmp.*.qcow2 "$TMPDIR"/tmp.*.log "$TMPDIR"/tmp.*-node.log

-      # The ISO build runs as root inside the workspace, and the next job on
-      # this runner, from any workflow, cannot remove what it leaves there.
-      - name: Release the workspace
-        if: always()
-        run: |
-          sudo umount -R -l "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache/rootfs 2>/dev/null || true
-          sudo rm -rf --one-file-system "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache \
-              "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/dist
-          sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE"
-
  iso-multi:
    name: cell-22 (iso/dhcp/three-node)
    # After cell-21 rather than beside it: same concurrency group, and running
@@ -1364,16 +1354,6 @@ jobs:
          rm -rf /tmp/cell22-artifacts-$GITHUB_RUN_ID /tmp/cell22-$GITHUB_RUN_ID.log \
                 "$WORK_DIR"

-      # The ISO build runs as root inside the workspace, and the next job on
-      # this runner, from any workflow, cannot remove what it leaves there.
-      - name: Release the workspace
-        if: always()
-        run: |
-          sudo umount -R -l "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache/rootfs 2>/dev/null || true
-          sudo rm -rf --one-file-system "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache \
-              "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/dist
-          sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE"
-
  # Predastore throughput ("cell 23"). Predastore has no runners of its own and
  # spinifex depends on it, so the benchmark lives here and checks predastore
  # out as a sibling.
@@ -431,7 +431,7 @@ func eksUncased() map[string]string {
 	// These name the cluster's account in the path or body. AuthorizeInternal
 	// refuses every tenant principal outright and binds a control-plane VM to
 	// the cluster it serves, so no tenant ARN reaches the evaluator.
-	for _, action := range []string{"GetRecoveryDirective", "ListInternalAddons", "ListInternalWorkers", "PublishInternal", "WebhookTokenReview"} {
+	for _, action := range []string{"GetRecoveryDirective", "ListInternalAddons", "PublishInternal", "WebhookTokenReview"} {
 		uncased[action] = "internal control-plane route: refused to tenants, bound to the caller's own cluster"
 	}
 	for _, action := range []string{
Author	SHA1	Message	Date
Ben Duncan	04c4229c90	Merge remote-tracking branch 'origin/feat/eks-node-lifecycle' into e2e/integration	2026-11-02 00:52:09 +10:00
Ben Duncan	99b9fc982b	test(e2e): check the live worker's Node and wait out nodegroup deletes WorkerNodeReady accepted any Ready Node, the tolerate-all DaemonSet check dropped pods with no Ready condition, and nodegroup cleanup returned before the nodegroup was gone. Scope the Ready check to the CPIsolation nodegroup, count a pod with no Ready condition as not Ready, wait for each nodegroup delete, and assert that deleted nodegroups leave no Node behind.	2026-11-02 00:49:42 +10:00
Ben Duncan	b845f7c802	fix(eks): delete the Node of a terminated nodegroup worker K3s runs no AWS cloud provider, and its own reports every instance as existing, so a worker terminated by DeleteNodegroup, scale-down or reclaim stayed a NotReady Node forever. Its pods stayed bound to it, and once most Nodes were NotReady the node lifecycle controller stopped evicting, leaving metrics-server on a dead Node. Add an internal-workers route the control plane pulls the cluster's live nodegroup workers from, and a mulga-eks-node-gc agent on every server that deletes a nodegroup Node only when it is not Ready and its instance is no longer one of those workers, as the AWS cloud controller does.	2026-11-02 00:49:42 +10:00
Ben Duncan	497a8b8bf3	fix(setup): keep NetworkManager from replacing the resolved stub link NetworkManager restarted while /etc/resolv.conf is a plain file runs in rc-manager=symlink mode and writes resolv.conf on its first DNS update, which can land after the installer links the stub. Write a conf.d drop-in (dns=systemd-resolved, rc-manager=unmanaged) before the restart, refuse a later file that overrides rc-manager, wait for NetworkManager to settle, and assert the link holds with bounded relinks. A rerun after an older handover adds the drop-in, reloads NetworkManager and relinks the stub.	2026-11-02 00:44:14 +10:00