Skip to content

Commit c9b7993

Browse files
harshsharmanvharshsharmanv
committed
fix(nebius): updaing ufw rules
1 parent 1f66f10 commit c9b7993

1 file changed

Lines changed: 84 additions & 83 deletions

File tree

‎v1/providers/nebius/instance.go‎

Lines changed: 84 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -1227,84 +1227,8 @@ func (c *NebiusClient) buildDiskCreateRequest(ctx context.Context, diskName stri
12271227
}
12281228

12291229
// First, try to resolve and use image family
1230-
imageFamily, resolveErr := c.resolveImageFamily(ctx, attrs.ImageID)
1231-
c.logger.Info(ctx, "buildDiskCreateRequest: resolveImageFamily result",
1232-
v1.LogField("attrs.ImageID", attrs.ImageID),
1233-
v1.LogField("resolvedFamily", imageFamily),
1234-
v1.LogField("err", fmt.Sprintf("%v", resolveErr)))
1235-
1236-
if resolveErr == nil {
1237-
publicImagesParent := c.getPublicImagesParent()
1238-
1239-
// Skip validation for known-good common families to speed up instance start
1240-
knownFamilies := []string{"ubuntu24.04-cuda13.0", "ubuntu24.04-cuda12", "ubuntu22.04-cuda12", "mk8s-worker-node-v-1-32-ubuntu24.04", "mk8s-worker-node-v-1-32-ubuntu24.04-cuda12.8"}
1241-
isKnownFamily := false
1242-
for _, known := range knownFamilies {
1243-
if imageFamily == known {
1244-
isKnownFamily = true
1245-
break
1246-
}
1247-
}
1248-
c.logger.Info(ctx, "buildDiskCreateRequest: known-family check",
1249-
v1.LogField("imageFamily", imageFamily),
1250-
v1.LogField("isKnownFamily", isKnownFamily),
1251-
v1.LogField("publicImagesParent", publicImagesParent))
1252-
1253-
if isKnownFamily {
1254-
c.logger.Info(ctx, "buildDiskCreateRequest: BRANCH=known-family (skipping validation)",
1255-
v1.LogField("imageFamily", imageFamily))
1256-
// Use known family without validation
1257-
baseReq.Spec.Source = &compute.DiskSpec_SourceImageFamily{
1258-
SourceImageFamily: &compute.SourceImageFamily{
1259-
ImageFamily: imageFamily,
1260-
ParentId: publicImagesParent,
1261-
},
1262-
}
1263-
baseReq.Metadata.Labels["image-family"] = imageFamily
1264-
return baseReq, nil
1265-
}
1266-
1267-
// For unknown families, validate first and check architecture
1268-
latestImage, err := c.sdk.Services().Compute().V1().Image().GetLatestByFamily(ctx, &compute.GetImageLatestByFamilyRequest{
1269-
ParentId: publicImagesParent,
1270-
ImageFamily: imageFamily,
1271-
})
1272-
latestName, latestID, latestArch := "", "", ""
1273-
if latestImage != nil {
1274-
if latestImage.Metadata != nil {
1275-
latestName = latestImage.Metadata.Name
1276-
latestID = latestImage.Metadata.Id
1277-
}
1278-
if latestImage.Spec != nil {
1279-
latestArch = latestImage.Spec.GetCpuArchitecture().String()
1280-
}
1281-
}
1282-
c.logger.Info(ctx, "buildDiskCreateRequest: GetLatestByFamily result",
1283-
v1.LogField("imageFamily", imageFamily),
1284-
v1.LogField("err", fmt.Sprintf("%v", err)),
1285-
v1.LogField("latestImageID", latestID),
1286-
v1.LogField("latestImageName", latestName),
1287-
v1.LogField("latestImageArch", latestArch))
1288-
1289-
if err == nil {
1290-
isARM64 := latestImage.Spec != nil && latestImage.Spec.GetCpuArchitecture() == compute.ImageSpec_ARM64
1291-
if !isARM64 {
1292-
c.logger.Info(ctx, "buildDiskCreateRequest: BRANCH=validated-family (non-ARM64)",
1293-
v1.LogField("imageFamily", imageFamily),
1294-
v1.LogField("latestImageID", latestID))
1295-
baseReq.Spec.Source = &compute.DiskSpec_SourceImageFamily{
1296-
SourceImageFamily: &compute.SourceImageFamily{
1297-
ImageFamily: imageFamily,
1298-
ParentId: publicImagesParent,
1299-
},
1300-
}
1301-
baseReq.Metadata.Labels["image-family"] = imageFamily
1302-
return baseReq, nil
1303-
}
1304-
c.logger.Info(ctx, "buildDiskCreateRequest: validated-family is ARM64, falling through to scoring",
1305-
v1.LogField("imageFamily", imageFamily))
1306-
// ARM64 family — fall through to getWorkingPublicImageID which filters by architecture
1307-
}
1230+
if c.tryApplyImageFamilySource(ctx, baseReq, attrs.ImageID) {
1231+
return baseReq, nil
13081232
}
13091233

13101234
// Family approach failed, try to use a known working public image ID
@@ -1327,6 +1251,87 @@ func (c *NebiusClient) buildDiskCreateRequest(ctx context.Context, diskName stri
13271251
return nil, fmt.Errorf("could not resolve image %s to either a working family or image ID: %w", attrs.ImageID, err)
13281252
}
13291253

1254+
// tryApplyImageFamilySource attempts to set baseReq's disk source via image-family lookup.
1255+
// Returns true if a family-based source was applied (caller should return baseReq).
1256+
// Returns false if the caller should fall back to scoring (getWorkingPublicImageID).
1257+
func (c *NebiusClient) tryApplyImageFamilySource(ctx context.Context, baseReq *compute.CreateDiskRequest, imageID string) bool {
1258+
imageFamily, resolveErr := c.resolveImageFamily(ctx, imageID)
1259+
c.logger.Info(ctx, "buildDiskCreateRequest: resolveImageFamily result",
1260+
v1.LogField("attrs.ImageID", imageID),
1261+
v1.LogField("resolvedFamily", imageFamily),
1262+
v1.LogField("err", fmt.Sprintf("%v", resolveErr)))
1263+
if resolveErr != nil {
1264+
return false
1265+
}
1266+
1267+
publicImagesParent := c.getPublicImagesParent()
1268+
knownFamilies := []string{"ubuntu24.04-cuda13.0", "ubuntu24.04-cuda12", "ubuntu22.04-cuda12", "mk8s-worker-node-v-1-32-ubuntu24.04", "mk8s-worker-node-v-1-32-ubuntu24.04-cuda12.8"}
1269+
isKnownFamily := false
1270+
for _, known := range knownFamilies {
1271+
if imageFamily == known {
1272+
isKnownFamily = true
1273+
break
1274+
}
1275+
}
1276+
c.logger.Info(ctx, "buildDiskCreateRequest: known-family check",
1277+
v1.LogField("imageFamily", imageFamily),
1278+
v1.LogField("isKnownFamily", isKnownFamily),
1279+
v1.LogField("publicImagesParent", publicImagesParent))
1280+
1281+
if isKnownFamily {
1282+
c.logger.Info(ctx, "buildDiskCreateRequest: BRANCH=known-family (skipping validation)",
1283+
v1.LogField("imageFamily", imageFamily))
1284+
applyImageFamilySource(baseReq, imageFamily, publicImagesParent)
1285+
return true
1286+
}
1287+
1288+
latestImage, err := c.sdk.Services().Compute().V1().Image().GetLatestByFamily(ctx, &compute.GetImageLatestByFamilyRequest{
1289+
ParentId: publicImagesParent,
1290+
ImageFamily: imageFamily,
1291+
})
1292+
latestName, latestID, latestArch := "", "", ""
1293+
if latestImage != nil {
1294+
if latestImage.Metadata != nil {
1295+
latestName = latestImage.Metadata.Name
1296+
latestID = latestImage.Metadata.Id
1297+
}
1298+
if latestImage.Spec != nil {
1299+
latestArch = latestImage.Spec.GetCpuArchitecture().String()
1300+
}
1301+
}
1302+
c.logger.Info(ctx, "buildDiskCreateRequest: GetLatestByFamily result",
1303+
v1.LogField("imageFamily", imageFamily),
1304+
v1.LogField("err", fmt.Sprintf("%v", err)),
1305+
v1.LogField("latestImageID", latestID),
1306+
v1.LogField("latestImageName", latestName),
1307+
v1.LogField("latestImageArch", latestArch))
1308+
if err != nil {
1309+
return false
1310+
}
1311+
1312+
if latestImage.Spec != nil && latestImage.Spec.GetCpuArchitecture() == compute.ImageSpec_ARM64 {
1313+
c.logger.Info(ctx, "buildDiskCreateRequest: validated-family is ARM64, falling through to scoring",
1314+
v1.LogField("imageFamily", imageFamily))
1315+
return false
1316+
}
1317+
1318+
c.logger.Info(ctx, "buildDiskCreateRequest: BRANCH=validated-family (non-ARM64)",
1319+
v1.LogField("imageFamily", imageFamily),
1320+
v1.LogField("latestImageID", latestID))
1321+
applyImageFamilySource(baseReq, imageFamily, publicImagesParent)
1322+
return true
1323+
}
1324+
1325+
func applyImageFamilySource(baseReq *compute.CreateDiskRequest, imageFamily, publicImagesParent string) {
1326+
baseReq.Spec.Source = &compute.DiskSpec_SourceImageFamily{
1327+
SourceImageFamily: &compute.SourceImageFamily{
1328+
ImageFamily: imageFamily,
1329+
ParentId: publicImagesParent,
1330+
},
1331+
}
1332+
baseReq.Metadata.Labels["image-family"] = imageFamily
1333+
}
1334+
13301335
// getWorkingPublicImageID gets a working public image ID based on the requested image type.
13311336
// It scores every non-ARM64 image and returns the highest-scored one, this is done to handle change in ordering of images from nebius api.
13321337
func (c *NebiusClient) getWorkingPublicImageID(ctx context.Context, requestedImage string) (string, error) {
@@ -1945,11 +1950,7 @@ packages:
19451950
// DEBIAN_FRONTEND=noninteractive writes empty rules.v4/v6, and the service
19461951
// flushes the UFW + DOCKER-USER rules we just applied (Launchpad #1949643).
19471952
// With autosave=true, postinst snapshots the currently-applied iptables state.
1948-
commands = append(commands,
1949-
`echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections`,
1950-
`echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections`,
1951-
"sudo DEBIAN_FRONTEND=noninteractive apt-get install -y iptables-persistent",
1952-
)
1953+
// removing from here ip tables
19531954

19541955
// Save the complete iptables state (UFW chains + DOCKER-USER rules) so it
19551956
// survives instance stop/start cycles. Cloud-init runcmd only executes on

0 commit comments

Comments
 (0)