mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 09:01:31 +00:00
Ben Duncan
b6d01370dd
* fix: render northstar's recursion allowlist so a node is not an open resolver northstar.toml is written with allow_recursion = false and an allow_recursion_from list built from cluster membership, so a freshly formed node serves recursion to the cluster and refuses it to the internet. The list is the node's own bind and advertise addresses plus every peer's host, with any port stripped. Both local addresses matter: a node's resolv.conf points at its own advertised address, so the query arrives from that public IP over lo rather than from 127.0.0.1, and an allowlist of loopback alone would stop every node resolving internal names. Guests are covered without appearing in the list. vpcd's per-tap DNS shim relays guest queries to a node's :5300 from a node address, so trusting the nodes trusts every guest behind them and no guest CIDR is needed. The template comment carries the caveats for allow_recursion = true, since the cost of setting it is remote from the setting: an open resolver is found by scanners within hours and gets the node's whole address range blocklisted, which is an outage for every tenant on it. The list is rendered at formation, so a node added later is not in its peers' files. Regenerating it live from membership, as the daemon already does for peers.nft, is follow-on work tracked on mulga-t3mub. * chore: pin northstar to the recursion ACL and atomic zone reload The recursion allowlist this branch renders is enforced by northstar's RecursionPolicy, which lands in dev at a0e741e. CI resolves northstar from go.mod rather than the workspace, so the build failed on NewRecursionPolicy being undefined until this pin moved. The AWS SDK bumps come with it.
228 lines
11 KiB
Modula-2
228 lines
11 KiB
Modula-2
module github.com/mulgadc/spinifex
|
|
|
|
go 1.27.0
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go v1.55.8
|
|
github.com/aws/aws-sdk-go-v2 v1.44.0
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.40
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.39
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40
|
|
github.com/cenkalti/backoff/v4 v4.3.0
|
|
github.com/charmbracelet/bubbles v1.0.0
|
|
github.com/charmbracelet/bubbletea v1.3.10
|
|
github.com/charmbracelet/lipgloss v1.1.0
|
|
github.com/containerd/containerd/v2 v2.3.4
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/go-chi/chi/v5 v5.3.2
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/insomniacslk/dhcp v0.0.0-20260719225207-c76316d4aa82
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/klauspost/cpuid/v2 v2.4.0
|
|
github.com/miekg/dns v1.1.73
|
|
github.com/mulgadc/bluebottle v1.18.1-0.20260903003911-3d26c3a8def8
|
|
github.com/mulgadc/northstar v1.18.1-0.20260903173023-a0e741e2831f
|
|
github.com/mulgadc/predastore v1.18.1-0.20260831064140-ff6a1dc42441
|
|
github.com/mulgadc/viperblock v1.18.0
|
|
github.com/nats-io/nats-server/v2 v2.14.5
|
|
github.com/nats-io/nats.go v1.53.1
|
|
github.com/opencontainers/runtime-spec v1.3.0
|
|
github.com/ovn-kubernetes/libovsdb v0.8.1
|
|
github.com/pelletier/go-toml/v2 v2.4.3
|
|
github.com/pterm/pterm v0.12.83
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.12.1
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0
|
|
go.opentelemetry.io/otel v1.46.0
|
|
go.opentelemetry.io/otel/metric v1.46.0
|
|
go.opentelemetry.io/otel/sdk v1.46.0
|
|
go.opentelemetry.io/otel/sdk/metric v1.46.0
|
|
go.opentelemetry.io/otel/trace v1.46.0
|
|
go.uber.org/goleak v1.3.1-0.20260602155401-5f791e3ef83b
|
|
go.yaml.in/yaml/v3 v3.0.5
|
|
golang.org/x/crypto v0.55.0
|
|
golang.org/x/sync v0.22.0
|
|
golang.org/x/sys v0.47.0
|
|
golang.org/x/time v0.15.0
|
|
golang.org/x/tools v0.49.0
|
|
gopkg.in/ini.v1 v1.67.3
|
|
)
|
|
|
|
require (
|
|
atomicgo.dev/cursor v0.2.0 // indirect
|
|
atomicgo.dev/keyboard v0.2.9 // indirect
|
|
atomicgo.dev/schedule v0.1.0 // indirect
|
|
github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
|
|
github.com/Microsoft/hcsshim v0.15.0-rc.1 // indirect
|
|
github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op // indirect
|
|
github.com/armon/go-metrics v0.4.1 // indirect
|
|
github.com/atotto/clipboard v0.1.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 // indirect
|
|
github.com/aws/smithy-go v1.28.1 // indirect
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/boltdb/bolt v1.3.1 // indirect
|
|
github.com/buraksezer/consistent v1.0.0 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cenkalti/hub v1.0.2 // indirect
|
|
github.com/cenkalti/rpc2 v1.0.5 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/charmbracelet/colorprofile v0.4.1 // indirect
|
|
github.com/charmbracelet/x/ansi v0.11.6 // indirect
|
|
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
|
|
github.com/charmbracelet/x/term v0.2.2 // indirect
|
|
github.com/clipperhouse/displaywidth v0.9.0 // indirect
|
|
github.com/clipperhouse/stringish v0.1.1 // indirect
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
|
github.com/containerd/cgroups/v3 v3.1.3 // indirect
|
|
github.com/containerd/console v1.0.5 // indirect
|
|
github.com/containerd/containerd/api v1.11.1 // indirect
|
|
github.com/containerd/continuity v0.5.0 // indirect
|
|
github.com/containerd/errdefs v1.0.0 // indirect
|
|
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
|
github.com/containerd/fifo v1.1.0 // indirect
|
|
github.com/containerd/log v0.1.0 // indirect
|
|
github.com/containerd/platforms v1.0.0-rc.4 // indirect
|
|
github.com/containerd/plugin v1.1.0 // indirect
|
|
github.com/containerd/ttrpc v1.2.8 // indirect
|
|
github.com/containerd/typeurl/v2 v2.2.3 // indirect
|
|
github.com/dgraph-io/badger/v4 v4.9.6 // indirect
|
|
github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
|
github.com/fatih/color v1.19.0 // indirect
|
|
github.com/felixge/httpsnoop v1.1.0 // indirect
|
|
github.com/fsnotify/fsnotify v1.10.1 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
|
github.com/go-logr/logr v1.4.4 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.30.1 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
|
|
github.com/google/flatbuffers v25.12.19+incompatible // indirect
|
|
github.com/google/go-tpm v0.9.8 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/gookit/color v1.6.0 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
|
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
|
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
github.com/hashicorp/go-metrics v0.5.4 // indirect
|
|
github.com/hashicorp/go-msgpack/v2 v2.1.5 // indirect
|
|
github.com/hashicorp/golang-lru v1.0.2 // indirect
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
|
|
github.com/hashicorp/raft v1.7.3 // indirect
|
|
github.com/hashicorp/raft-boltdb/v2 v2.3.1 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/josharian/native v1.1.0 // indirect
|
|
github.com/klauspost/compress v1.19.2 // indirect
|
|
github.com/klauspost/reedsolomon v1.14.2 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/lithammer/fuzzysearch v1.1.8 // indirect
|
|
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mattn/go-localereader v0.0.1 // indirect
|
|
github.com/mattn/go-runewidth v0.0.21 // indirect
|
|
github.com/mdlayher/packet v1.1.2 // indirect
|
|
github.com/mdlayher/socket v0.5.1 // indirect
|
|
github.com/minio/crc64nvme v1.1.1 // indirect
|
|
github.com/minio/highwayhash v1.0.4 // indirect
|
|
github.com/moby/locker v1.0.1 // indirect
|
|
github.com/moby/sys/capability v0.4.0 // indirect
|
|
github.com/moby/sys/mountinfo v0.7.2 // indirect
|
|
github.com/moby/sys/sequential v0.6.0 // indirect
|
|
github.com/moby/sys/signal v0.7.1 // indirect
|
|
github.com/moby/sys/user v0.4.0 // indirect
|
|
github.com/moby/sys/userns v0.1.0 // indirect
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/nats-io/jwt/v2 v2.8.2 // indirect
|
|
github.com/nats-io/nkeys v0.4.16 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.1.1 // indirect
|
|
github.com/opencontainers/runtime-tools v0.9.1-0.20251114084447-edf4cb3d2116 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.18 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/prometheus/client_golang v1.23.2 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.67.5 // indirect
|
|
github.com/prometheus/procfs v0.20.1 // indirect
|
|
github.com/quic-go/quic-go v0.61.0 // indirect
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
|
github.com/sirupsen/logrus v1.9.4 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/tidwall/btree v1.8.1 // indirect
|
|
github.com/u-root/uio v0.0.0-20230220225925-ffce2a382923 // indirect
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
|
go.etcd.io/bbolt v1.4.3 // indirect
|
|
go.opencensus.io v0.24.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/bridges/otelslog v0.20.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/runtime v0.71.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.22.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // indirect
|
|
go.opentelemetry.io/otel/log v0.22.0 // indirect
|
|
go.opentelemetry.io/otel/sdk/log v0.22.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
|
|
go.uber.org/nilaway v0.0.0-20260721205819-4a0f7653488a // indirect
|
|
go.yaml.in/yaml/v2 v2.4.4 // indirect
|
|
golang.org/x/exp/typeparams v0.0.0-20260611194520-c48552f49976 // indirect
|
|
golang.org/x/mod v0.39.0 // indirect
|
|
golang.org/x/net v0.58.0 // indirect
|
|
golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 // indirect
|
|
golang.org/x/term v0.45.0 // indirect
|
|
golang.org/x/text v0.41.0 // indirect
|
|
golang.org/x/vuln v1.6.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
|
|
google.golang.org/grpc v1.83.1 // indirect
|
|
google.golang.org/protobuf v1.36.12 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
sigs.k8s.io/yaml v1.6.0 // indirect
|
|
tags.cncf.io/container-device-interface v1.1.0 // indirect
|
|
tags.cncf.io/container-device-interface/specs-go v1.1.0 // indirect
|
|
)
|
|
|
|
// go.opencensus.io -> grpc@v1.33.2 drags in the pre-split monolithic genproto,
|
|
// which still ships google.golang.org/genproto/googleapis/rpc/status and so
|
|
// collides with the split genproto/googleapis/rpc module that containerd/ttrpc
|
|
// needs ("ambiguous import"). The main module never imports the monolith, so a
|
|
// plain require is dropped by `go mod tidy`; pin it via replace to a post-split
|
|
// version (no rpc/status) so the fix survives tidy. Remove if grpc/opencensus
|
|
// stop requiring the monolith.
|
|
replace google.golang.org/genproto => google.golang.org/genproto v0.0.0-20260622175928-b703f567277d
|
|
|
|
tool (
|
|
go.uber.org/nilaway/cmd/nilaway
|
|
golang.org/x/vuln/cmd/govulncheck
|
|
)
|