flock

fritzlab-public/flock

Fork 0

Commit Graph

Author SHA1 Message Date

Author	SHA1	Message	Date
Donavan Fritz	65b2fb5b17	ip-algo: rename `pod` field to `app`; image from pod spec Build flock Image / build (push) Has been cancelled Details The `pod` field hashed pod.Name, which differs per replica because of the ReplicaSet pod-template-hash + 5-char random suffix. With namespace,pod,image, all replicas of the same Deployment got distinct hextets even though they were the same workload. Replace `pod` with `app` — a stable workload identifier derived from the controller chain: - Deployment → ReplicaSet → Pod: strip the pod-template-hash suffix from the RS name (`traefik-789df685f` → `traefik`). - StatefulSet/DaemonSet/Job → Pod: use controller name as-is. - Bare pod: pod name. Image now comes from pod.Spec.Containers[0].Image (the spec'd reference). 64-hex-char values are treated as sha256 digests and parsed as before; everything else (image:tag, short SHA) is FNV-1a-64'd as a string. This makes `traefik:v3.5` deterministic across replicas without needing the runtime-resolved digest. Net effect: namespace,app,image yields identical hextets across all replicas of the same Deployment except the trailing random N nibble. embed.Values.Pod → App; AllocRequest.Pod kept for log context only, new App and Image fields drive the embed call. handlers.go computes both via deriveAppName + podImageRef helpers. Tests: 7 new TestDeriveAppName_* cases (Deploy/STS/DS/bare/RS-without- hash/non-controller-owner) + TestPodImageRef. Existing fuzz seeds updated for the new keyword. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-25 11:42:06 -05:00
Donavan Fritz	20f47916af	flock M1 scaffold: CNI plugin + agent + NodeConfig CRD Build flock Image / build (push) Has been cancelled Details - cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON. - pkg/agent/state.go: durable allocations.json (atomic write + fsync + parent fsync); pending/committed lifecycle. Tests cover round-trip, replace-by-cid, version mismatch, no-leak-on-tmp. - pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96 nibble distribution table from the design doc, determinism, prefix preservation, N-nibble isolation, digest-vs-fallback divergence. - pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet). - deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in nodes. - .gitea/workflows/main.yaml + Dockerfile: build + push to code.fritzlab.net/fritzlab/flock; runs go test in CI. Design doc: dfritzlab/k8s-manager/dfritz-cni.md. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>	2026-04-24 21:17:42 -05:00

Donavan Fritz

65b2fb5b17

ip-algo: rename pod field to app; image from pod spec

Build flock Image / build (push) Has been cancelled

Details

The `pod` field hashed pod.Name, which differs per replica because of
the ReplicaSet pod-template-hash + 5-char random suffix. With
namespace,pod,image, all replicas of the same Deployment got distinct
hextets even though they were the same workload.

Replace `pod` with `app` — a stable workload identifier derived from
the controller chain:

  - Deployment → ReplicaSet → Pod: strip the pod-template-hash suffix
    from the RS name (`traefik-789df685f` → `traefik`).
  - StatefulSet/DaemonSet/Job → Pod: use controller name as-is.
  - Bare pod: pod name.

Image now comes from pod.Spec.Containers[0].Image (the spec'd
reference). 64-hex-char values are treated as sha256 digests and
parsed as before; everything else (image:tag, short SHA) is FNV-1a-64'd
as a string. This makes `traefik:v3.5` deterministic across replicas
without needing the runtime-resolved digest.

Net effect: namespace,app,image yields identical hextets across all
replicas of the same Deployment except the trailing random N nibble.

embed.Values.Pod → App; AllocRequest.Pod kept for log context only,
new App and Image fields drive the embed call. handlers.go computes
both via deriveAppName + podImageRef helpers.

Tests: 7 new TestDeriveAppName_* cases (Deploy/STS/DS/bare/RS-without-
hash/non-controller-owner) + TestPodImageRef. Existing fuzz seeds
updated for the new keyword.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-25 11:42:06 -05:00

Donavan Fritz

20f47916af

flock M1 scaffold: CNI plugin + agent + NodeConfig CRD

Build flock Image / build (push) Has been cancelled

Details

- cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return
  ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON.
- pkg/agent/state.go: durable allocations.json (atomic write + fsync +
  parent fsync); pending/committed lifecycle. Tests cover round-trip,
  replace-by-cid, version mismatch, no-leak-on-tmp.
- pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96
  nibble distribution table from the design doc, determinism, prefix
  preservation, N-nibble isolation, digest-vs-fallback divergence.
- pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet).
- deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet
  pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in
  nodes.
- .gitea/workflows/main.yaml + Dockerfile: build + push to
  code.fritzlab.net/fritzlab/flock; runs go test in CI.

Design doc: dfritzlab/k8s-manager/dfritz-cni.md.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

2026-04-24 21:17:42 -05:00

2 Commits