mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-23 20:57:02 +00:00
Josh Siviour
93db7e4d1b
* feat(ecs): ecs-agent skeleton + containerd image pull (Sprint 4c) Add the ecs-agent binary that runs inside an ECS container instance: it resolves host identity from IMDS, registers on the Layer-2 NATS bus, and heartbeats while alive. Image pulls go through a containerd-backed ImagePuller behind an interface, with an ECR resolver that mints GetAuthorizationToken creds from the instance role. Extract the IMDS-credential and ECR-auth flow out of ecr-credential-provider into internal/imdscreds and internal/ecrauth so the agent and the kubelet provider share one implementation. Add spinifex/handlers/ecs/bus as the single source of truth for Layer-2 subject builders and wire payloads, shared by the agent now and the scheduler in Sprint 4e. * build: pin genproto via replace to fix containerd/v2 ambiguous import go.opencensus.io -> grpc@v1.33.2 drags the pre-split monolithic genproto into the module graph; it still ships googleapis/rpc/status, which collides with the split genproto/googleapis/rpc module that containerd/ttrpc needs. The main module never imports the monolith, so a plain require bump is dropped by 'go mod tidy'. Pin it with a replace to a post-split version so the fix survives tidy and contributors can run 'go mod tidy' freely. * fix(ecs): agent boot failsafes from runtime verify - Build the ECR gateway HTTP client lazily on first image pull instead of at boot. A missing/malformed gateway CA no longer kills the agent before it can register + heartbeat, matching the best-effort containerd path. - Actively probe containerd with IsServing in runtime.New. The client dials lazily, so a dead socket previously slipped past the boot-time 'containerd unavailable' warn and only surfaced on the first pull. - Make the heartbeat interval configurable via ECS_HEARTBEAT_INTERVAL (default 30s) for test/verify and slow-link tuning.
37 lines
1.2 KiB
Go
37 lines
1.2 KiB
Go
// Package runtime is the ecs-agent's container-runtime seam. The agent pulls
|
|
// task images and (from Sprint 4e) runs containers through an ImagePuller; the
|
|
// real implementation drives containerd, but the interface lets tests and the
|
|
// scheduler-only build run against a fake.
|
|
package runtime
|
|
|
|
import "context"
|
|
|
|
// PullSpec describes one image to pull.
|
|
type PullSpec struct {
|
|
// Ref is the full image reference, e.g.
|
|
// "123456789012.dkr.ecr.us-east-1.spinifex.internal/app:latest".
|
|
Ref string
|
|
}
|
|
|
|
// Image identifies a pulled image in the runtime's content store.
|
|
type Image struct {
|
|
Ref string
|
|
Digest string
|
|
Size int64
|
|
}
|
|
|
|
// Resolver supplies registry credentials for a given image reference. The
|
|
// ecs-agent backs this with ECR GetAuthorizationToken (see ecrresolver.go).
|
|
type Resolver interface {
|
|
// Authorize returns the username, password and registry endpoint to use for
|
|
// ref. An empty user/pass means anonymous pull.
|
|
Authorize(ctx context.Context, ref string) (user, pass, endpoint string, err error)
|
|
}
|
|
|
|
// ImagePuller pulls images into the local runtime. Close releases the runtime
|
|
// client connection.
|
|
type ImagePuller interface {
|
|
Pull(ctx context.Context, spec PullSpec, r Resolver) (Image, error)
|
|
Close() error
|
|
}
|