Repository navigation
Sync release-1.0 with upstream backports - #108
Merged
Merged
Conversation
… ko release image with backoff (agent-substrate#3459) Cherry-pick of agent-substrate#3446 onto `release-1.0`, with no changes (`git cherry-pick -x` of both commits). Needed for the 1.0 release: the v1.0.0-rc.1 release run (https://github.com/agent-substrate/substrate/actions/runs/40925903340) failed in **Publish images** with `DENIED: permission_denied`. ghcr.io can briefly deny pushes to a package it has just created, and this is the first release that creates them. `ate-setup publish release-images` now builds each ko image in its own `ko build`. If an image fails, it logs the error and retries that image, for up to 3 attempts, waiting 10s then 20s (`retry.OnError` with a `wait.Backoff`). AI use: AI-assisted. - [x] Tests pass --------- Signed-off-by: Anna Pendleton <13793293+annapendleton@users.noreply.github.com> Co-authored-by: Anna Pendleton <13793293+annapendleton@users.noreply.github.com>
… image's USER and WORKDIR, with layer file owners kept (agent-substrate#3473) Cherry-pick of agent-substrate#2392 onto `release-1.0` (`git cherry-pick -x` of the squash commit), it applied cleanly with no changes. Containers run as the image's `USER` and start in its `WORKDIR`, and atelet keeps the file owners recorded in image layers. Fixes agent-substrate#2036 for 1.0. AI use: AI-assisted. Clean pick. This carries the same breaking changes as agent-substrate#2392: - After an upgrade or rollback, atelet refuses the existing image cache. Delete `/var/lib/ate/image-cache` on each node once no actor runs on it, as atelet's error says. After an upgrade, a node reboot also works. - A custom atelet securityContext needs `CHOWN`, `DAC_OVERRIDE`, `FOWNER` and `FSETID`. - Images with a `USER` stop running as root, and images with a `WORKDIR` stop starting in `/`. A non-root `USER` has no effective capabilities, so `securityContext.capabilities.add` no longer helps it. - gVisor snapshots of such images don't restore, because `runsc restore` checks each container's user and working directory. Recreate those templates. MicroVM snapshots resume as they were. - Files an earlier run wrote as root into a durable dir stay root-owned. - [x] Tests pass - [x] Docs updated Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com> Signed-off-by: Davanum Srinivas <davanum@gmail.com> Signed-off-by: Benjamin Elder <bentheelder@google.com> Co-authored-by: Anish Ramasekar <anish.ramasekar@gmail.com> Co-authored-by: Davanum Srinivas <davanum@gmail.com>
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bring upstream
release-1.0at0c662eba7onto the fork's cutoff baseline,926dab7f8. This imports ko publishing retries and support for image USER, WORKDIR, and file ownership. Give the Helm atelet the capabilities required to preserve image ownership and permissions.The #106 release-workflow backport is tracked separately in #109 and is needed before creating a release tag. Merge this PR with a merge commit to preserve upstream ancestry.
The image-cache layout changes from v2 to v3. Stop actors on each node before deleting its old image cache, as described in the Helm upgrade notes.
Validation:
hack/verify-all.sh, Helm lint, all 41 chart tests, manifest rendering, CRD parity, migration immutability, and site-content generation pass. The image-cache, tar, and OCI tests pass as root with-race -count=3 -shuffle=on. The capability regression test fails against the old chart.The full local race run has one failure:
TestUnpackLayer_UnprivilegedKeepsUnpackingUserexpects primary GID 1003, but this account can apply supplementary GID 1000. It reproduces three times on unmodified upstream0c662eba7. CI passed, including gVisor and microVM with preview off/on and Helm runtime coverage.AI use: Codex audited the fork changes, prepared the merge, ran checks, and performed an independent review.