ops
00ee941e9f
[bug-pqhgbnh8pqws] chore: upgrade Go toolchain to 1.27.0
...
flock PR validation / validate (pull_request) Successful in 1m47s
Bump build base from golang:1.26.5-alpine to golang:1.27.0-alpine.
Update go.mod directive to 1.27.
2026-08-24 09:11:56 +00:00
ops
8aed24f132
[bug-ma3v4dg2c9y3] build: bundle BIRD 2.19.1
flock PR validation / validate (pull_request) Successful in 1m47s
2026-08-09 23:43:54 +00:00
dev
c7f89dd0f8
[bug-kj8d7pdc0d7q] build: bump Go builder to 1.26.5 (crypto/tls + os security fix) ( #3 )
flock / release (push) Successful in 1m53s
2026-08-07 15:13:43 +00:00
Donavan Fritz and Claude Sonnet 4.6
39ede9130b
netpol: NetworkPolicy v1 enforcement via nftables
...
Build flock Image / build (push) Has been cancelled
New pkg/agent/netpol implementing standard networking.k8s.io/v1
NetworkPolicy. Pipeline:
pods + policies + namespaces → Translate → Render → Apply
Supports ingress + egress, all three peer types (podSelector,
namespaceSelector, ipBlock with except), numeric ports + port ranges,
default-deny semantics derived from PolicyTypes (or inferred from
non-empty Spec.Egress when unset).
Apply path is `nft -f -` shell-out — single transaction, atomic, kernel
guarantees partial-failure rollback. Idempotent dedup via last-applied
script. Reconcile triggers: informer events, 30s self-heal tick, every
CNI ADD/DEL.
Verified against the three live cluster NetPols (calico-apiserver,
remote-proxies/lodge-home-assistant, storage/garage-admin-restrict).
Fuzz target stitches Translate + Render with random selector and peer
inputs; 21 unit tests cover the policy semantics.
Named ports skip with a warn — deferred until kubelet exposes them in a
form that doesn't require shadowing pod state.
Dockerfile: + nftables.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com >
2026-04-25 09:25:58 -05:00
Donavan Fritz and Claude Sonnet 4.6
0e1833dc7a
ci: fix bird package name (alpine ships 'bird', not 'bird2')
...
Build flock Image / build (push) Has been cancelled
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com >
2026-04-24 22:36:15 -05:00
Donavan Fritz and Claude Sonnet 4.6
eb1f5e0d8d
M2: netlink, IPAM/handler wiring, BIRD sidecar, CNI installer
...
Build flock Image / build (push) Has been cancelled
Code (Linux build, with no-op stubs for macOS dev):
- pkg/agent/netns_linux.go: ensureVeth → host-side configure (addrgenmode
none, fe80::1/64, proxy_arp, forwarding) → move peer to pod ns →
configure pod side (addr, default route via fe80::1, v4 169.254.1.1
on-link gateway) → host /128 + /32 routes. Idempotent.
- pkg/agent/hostiface.go: deterministic host iface name flock<8hex> from
FNV-1a-32(containerID).
- pkg/agent/annotations.go: parse flock.fritzlab.net/{ipv6,ipv4,cidr6,
cidr4,ip-algo,anycast} with design-doc defaults; ParseCNIArgs for the
K8S_POD_* keys kubelet sets.
- pkg/agent/podinfo.go: shared informer scoped to spec.nodeName==NODE,
WaitForPod helper for ADD-vs-informer-sync race.
- pkg/agent/handlers.go: PodHandler does
cache lookup → annotations → IPAM → store(pending) → SetupFunc →
store(committed) → Result. Idempotent on retry. Del symmetric.
- pkg/routing/bird/config.go: text/template render with stable ordering;
golden tests for host001 + anycast injection + sort stability.
- pkg/agent/bird.go: writes /etc/flock/bird/bird.conf, debounces 500ms,
execs `birdc -s /run/flock/bird.ctl configure`. Installs blackhole
kernel routes for the node summary CIDRs so BIRD's protocol kernel
imports them.
- pkg/agent/runtime_linux.go: at startup, waits up to 60s for the per-
node NodeConfig, reconciles committed allocations into IPAM.used,
garbage-collects pending entries, builds PodHandler, swaps RPC
handlers in.
- cmd/flock-installer: init-container binary that copies /opt/cni/bin/
flock and writes 01-flock.conflist (lex-first so kubelet picks it
over Calico's 10-calico.conflist on flock-labeled nodes).
Deploy:
- Dockerfile: alpine + iproute2 + bird2; multi-binary image.
- deploy/daemonset.yaml: install-cni init container; bird sidecar
sharing /etc/flock/bird + /run/flock with the agent; ConfigMap-seeded
bootstrap bird.conf so the sidecar boots before the agent renders.
Privileged on flock-agent + install-cni; bird sidecar uses
NET_ADMIN/RAW only.
- RBAC: pods + networkpolicies get/list/watch (the latter is reserved
for M8 — harmless to grant now).
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com >
2026-04-24 22:33:48 -05:00
Donavan Fritz and Claude Sonnet 4.6
e0ae98ad6c
ci: move go test into Dockerfile build stage
...
Build flock Image / build (push) Has been cancelled
The runner runs jobs via act + DinD; `docker run -v "$PWD:/src"` from
inside the job container mounts the runner-job filesystem, not the
docker daemon's host fs, so the mount appears empty and `go test ./...`
fails with "directory prefix . does not contain main module".
Run tests in the same container that builds — same workspace, no mount.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com >
2026-04-24 21:19:10 -05:00
Donavan Fritz and Claude Sonnet 4.6
20f47916af
flock M1 scaffold: CNI plugin + agent + NodeConfig CRD
...
Build flock Image / build (push) Has been cancelled
- cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return
ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON.
- pkg/agent/state.go: durable allocations.json (atomic write + fsync +
parent fsync); pending/committed lifecycle. Tests cover round-trip,
replace-by-cid, version mismatch, no-leak-on-tmp.
- pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96
nibble distribution table from the design doc, determinism, prefix
preservation, N-nibble isolation, digest-vs-fallback divergence.
- pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet).
- deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet
pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in
nodes.
- .gitea/workflows/main.yaml + Dockerfile: build + push to
code.fritzlab.net/fritzlab/flock; runs go test in CI.
Design doc: dfritzlab/k8s-manager/dfritz-cni.md.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com >
2026-04-24 21:17:42 -05:00
ops
dev
