mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-19 10:52:04 +00:00
Josh Siviour
4793b5ac09
* fix(eks-node): stop the DHCP MTU overriding the pinned link MTU
Pinning eth0 to 1320 was never enough. This image runs dhcpcd, which
honours DHCP option 26 and stamps the advertised MTU onto every route it
installs:
default via 10.32.101.1 dev eth0 proto dhcp src 10.32.101.7 \
metric 1002 mtu 1442
Linux prefers a route's MTU metric over the device MTU, so the node kept
advertising an MSS derived from 1442 while the real path MTU through the
NAT gateway is 1408. Small packets pass and full-MSS inbound segments —
a TLS ServerHello with its certificate chain, image layers — are
silently dropped. It presents as `net/http: TLS handshake timeout` on
image pulls, not as anything MTU-shaped, and it only affects the host
netns, so containerd pulls fail while pod traffic sized off cni0 is
fine. Per-destination PMTU exceptions expiring in and out of the route
cache made it look intermittent and host-specific.
Three changes, innermost first:
- dhcpcd.conf gets `nooption interface_mtu`, so no lease can stamp a
route MTU. mulga-vpc-mtu is the single source of truth for the MTU
of these nodes.
- mulga-vpc-mtu re-stamps any route that already carries a different
MTU, covering an image built before this fix or a dhcpcd already
running. Routes with no MTU metric inherit the device MTU and are
left alone.
- the subnet DHCP option drops 1442 to 1408. 1442 is geneve-only and
ignores the IPsec ESP overhead on the NAT egress path, so it
overstates the usable MTU for every guest, not just these nodes.
Also corrects the header comment, which claimed Alpine's udhcpc ignores
option 26 — this image runs dhcpcd, which honours it. That wrong premise
is why the route metric was never considered.
Adds a stubbed-`ip` test covering the rewrite, the dev token that
`ip route show dev X` omits, idempotency, and routes without an MTU
metric.
* fix(eks): sweep the CP VPC by identity so teardown can finish
DeleteClusterCPVPC finds the managed control-plane VPC's subnets and SGs
by role tag. A create that fails partway — the first control-plane
server failing to launch, say — leaves resources behind that never got
tagged, so the sweep cannot see them.
DeleteVpc rejects while any subnet or non-default SG remains, and
teardown is re-driven on a timer, so the cluster sits in DELETING
forever retrying the same doomed delete every couple of minutes:
eks-deleting: re-driving wedged DELETING teardown cluster=toc
eks-deleting: re-drive teardown failed
err="delete managed CP VPC: eks: delete cp vpc vpc-...: DependencyViolation"
Nothing converges: the cluster name cannot be reused and terraform's
delete wait can never pass. Observed on env19, wedged for ~11 hours
until this change went in, at which point the next re-drive cleared it.
After the tagged sweep, clear anything still in the VPC scoped by
vpc-id: subnets, and non-default SGs (the default SG goes with the VPC
cascade). Teardown had no SG surface, so CPVPCDeps gains an optional SG
provisioner — nil is tolerated, since only teardown uses it.
* chore: pin viperblock + predastore to the merged storage fixes
viperblock f8cfd77 (#42) makes read-modify-write atomic per block,
removing the lost update that silently reverted a 4096-byte block to a
previous generation of itself. Confirmed as the env19 corruption cause
by an A/B: the pre-fix build corrupted image layers within ~15 minutes
(failed to extract layer / invalid tar header / unpigz: corrupted) while
the fixed build ran 5+ hours clean, absorbing 6407 same-block RMW
conflicts on the worker root disks.
predastore c0a90d2 (#63) batches FSM.Restore. Without it, any predastore
restart on a store whose metadata set outgrew one badger transaction
fails with "Txn is too big to fit into one request" on every node at
once, taking the metadata plane — and with it the AMI catalogue and
cluster creation — down permanently.
Both were verified in the built artifact rather than from go.mod alone:
go version -m reports the new pseudo-versions, and the rmw_conflicts
counter plus the batched-restore error strings are present in the
binary. Pinning by go.mod while the submodule pointer says otherwise is
how an earlier analysis ended up reading dead code.
* test: record the corrected DHCP MTU in the kitchen-sink golden
The NB golden pins the DHCP options published per subnet, including the
advertised MTU. Dropping the subnet option from 1442 to 1408 changes
what the reconciler writes, so the golden diverged and the live scenario
test failed — the test doing exactly its job.
Regenerated with UPDATE_GOLDEN=1. The diff is only mtu:1442 -> mtu:1408
on the two subnet DHCP records; nothing else in the snapshot moves.
219 lines
11 KiB
Modula-2
219 lines
11 KiB
Modula-2
module github.com/mulgadc/spinifex
|
|
|
|
go 1.26.5
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go v1.55.8
|
|
github.com/aws/aws-sdk-go-v2 v1.42.1
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.30
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.29
|
|
github.com/cenkalti/backoff/v4 v4.3.0
|
|
github.com/charmbracelet/bubbles v1.0.0
|
|
github.com/charmbracelet/bubbletea v1.3.10
|
|
github.com/charmbracelet/lipgloss v1.1.0
|
|
github.com/containerd/containerd/v2 v2.3.3
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/go-chi/chi/v5 v5.3.1
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/insomniacslk/dhcp v0.0.0-20260407060928-11b94ed970f2
|
|
github.com/klauspost/cpuid/v2 v2.4.0
|
|
github.com/miekg/dns v1.1.72
|
|
github.com/mulgadc/northstar v1.13.0
|
|
github.com/mulgadc/predastore v1.13.1-0.20260722023246-c0a90d23b3a0
|
|
github.com/mulgadc/viperblock v1.13.1-0.20260722023228-f8cfd7740bf4
|
|
github.com/nats-io/nats-server/v2 v2.14.3
|
|
github.com/nats-io/nats.go v1.52.0
|
|
github.com/opencontainers/runtime-spec v1.3.0
|
|
github.com/ovn-kubernetes/libovsdb v0.8.1
|
|
github.com/pelletier/go-toml/v2 v2.4.3
|
|
github.com/pterm/pterm v0.12.83
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.11.1
|
|
go.opentelemetry.io/contrib/bridges/otelslog v0.19.0
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
|
|
go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0
|
|
go.opentelemetry.io/otel v1.44.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.20.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
|
|
go.opentelemetry.io/otel/log v0.20.0
|
|
go.opentelemetry.io/otel/metric v1.44.0
|
|
go.opentelemetry.io/otel/sdk v1.44.0
|
|
go.opentelemetry.io/otel/sdk/log v0.20.0
|
|
go.opentelemetry.io/otel/sdk/metric v1.44.0
|
|
go.opentelemetry.io/otel/trace v1.44.0
|
|
go.uber.org/goleak v1.3.0
|
|
go.yaml.in/yaml/v3 v3.0.4
|
|
golang.org/x/crypto v0.54.0
|
|
golang.org/x/sync v0.22.0
|
|
golang.org/x/sys v0.47.0
|
|
gopkg.in/ini.v1 v1.67.3
|
|
)
|
|
|
|
require (
|
|
atomicgo.dev/cursor v0.2.0 // indirect
|
|
atomicgo.dev/keyboard v0.2.9 // indirect
|
|
atomicgo.dev/schedule v0.1.0 // indirect
|
|
github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
|
|
github.com/Microsoft/hcsshim v0.15.0-rc.1 // indirect
|
|
github.com/antithesishq/antithesis-sdk-go v0.7.0 // indirect
|
|
github.com/armon/go-metrics v0.4.1 // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.105.2 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.4.1 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.32.1 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.44.1 // indirect
|
|
github.com/aws/smithy-go v1.27.4 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/boltdb/bolt v1.3.1 // indirect
|
|
github.com/buraksezer/consistent v0.10.0 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cenkalti/hub v1.0.2 // indirect
|
|
github.com/cenkalti/rpc2 v1.0.5 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.1 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.6 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
|
|
github.com/charmbracelet/x/term v0.2.2 // indirect
|
|
github.com/clipperhouse/displaywidth v0.9.0 // indirect
|
|
github.com/clipperhouse/stringish v0.1.1 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/containerd/cgroups/v3 v3.1.3 // indirect
|
|
github.com/containerd/console v1.0.5 // indirect
|
|
github.com/containerd/containerd/api v1.11.1 // indirect
|
|
github.com/containerd/continuity v0.5.0 // indirect
|
|
github.com/containerd/errdefs v1.0.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/containerd/fifo v1.1.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/containerd/platforms v1.0.0-rc.4 // indirect
|
|
github.com/containerd/plugin v1.1.0 // indirect
|
|
github.com/containerd/ttrpc v1.2.8 // indirect
|
|
github.com/containerd/typeurl/v2 v2.2.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/dgraph-io/badger/v4 v4.9.4 // indirect
|
|
github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/fatih/color v1.19.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.10.1 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.30.1 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
|
|
github.com/google/flatbuffers v25.12.19+incompatible // indirect
|
|
github.com/google/go-tpm v0.9.8 // indirect
|
|
github.com/gookit/color v1.6.0 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
|
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
github.com/hashicorp/go-metrics v0.5.4 // indirect
|
|
github.com/hashicorp/go-msgpack/v2 v2.1.5 // indirect
|
|
github.com/hashicorp/golang-lru v1.0.2 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/raft v1.7.3 // indirect
|
|
github.com/hashicorp/raft-boltdb/v2 v2.3.1 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/josharian/native v1.1.0 // indirect
|
|
github.com/klauspost/compress v1.18.6 // indirect
|
|
github.com/klauspost/reedsolomon v1.14.1 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/lithammer/fuzzysearch v1.1.8 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-localereader v0.0.1 // indirect
|
|
github.com/mattn/go-runewidth v0.0.21 // indirect
|
|
github.com/mdlayher/packet v1.1.2 // indirect
|
|
github.com/mdlayher/socket v0.5.1 // indirect
|
|
github.com/minio/crc64nvme v1.1.1 // indirect
|
|
github.com/minio/highwayhash v1.0.4 // indirect
|
|
github.com/moby/locker v1.0.1 // indirect
|
|
github.com/moby/sys/capability v0.4.0 // indirect
|
|
github.com/moby/sys/mountinfo v0.7.2 // indirect
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
github.com/moby/sys/signal v0.7.1 // indirect
|
|
github.com/moby/sys/user v0.4.0 // indirect
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/nats-io/jwt/v2 v2.8.2 // indirect
|
|
github.com/nats-io/nkeys v0.4.16 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/opencontainers/runtime-tools v0.9.1-0.20251114084447-edf4cb3d2116 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.18 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/prometheus/client_golang v1.23.2 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.67.5 // indirect
|
|
github.com/prometheus/procfs v0.20.1 // indirect
|
|
github.com/quic-go/quic-go v0.60.0 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.4 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/u-root/uio v0.0.0-20230220225925-ffce2a382923 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
go.etcd.io/bbolt v1.4.3 // indirect
|
|
go.opencensus.io v0.24.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.4 // indirect
|
|
golang.org/x/mod v0.37.0 // indirect
|
|
golang.org/x/net v0.56.0 // indirect
|
|
golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect
|
|
golang.org/x/term v0.45.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
golang.org/x/tools v0.47.0 // indirect
|
|
golang.org/x/vuln v1.4.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260618152121-87f3d3e198d3 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260618152121-87f3d3e198d3 // indirect
|
|
google.golang.org/grpc v1.81.1 // indirect
|
|
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
sigs.k8s.io/yaml v1.6.0 // indirect
|
|
tags.cncf.io/container-device-interface v1.1.0 // indirect
|
|
tags.cncf.io/container-device-interface/specs-go v1.1.0 // indirect
|
|
)
|
|
|
|
// go.opencensus.io -> grpc@v1.33.2 drags in the pre-split monolithic genproto,
|
|
// which still ships google.golang.org/genproto/googleapis/rpc/status and so
|
|
// collides with the split genproto/googleapis/rpc module that containerd/ttrpc
|
|
// needs ("ambiguous import"). The main module never imports the monolith, so a
|
|
// plain require is dropped by `go mod tidy`; pin it via replace to a post-split
|
|
// version (no rpc/status) so the fix survives tidy. Remove if grpc/opencensus
|
|
// stop requiring the monolith.
|
|
replace google.golang.org/genproto => google.golang.org/genproto v0.0.0-20260622175928-b703f567277d
|
|
|
|
tool golang.org/x/vuln/cmd/govulncheck
|