Repository navigation
fcvm fleet: an aggregated-streaming switch, off (ejc3/fcvm#1232) - #671
Conversation
local.fcvm_fleet_aggregated (false) gates everything the aggregated streams need, so with it off the agent arguments, the coordinator command, its task definition and both security groups are what they were: - Hosts: --aggregate-port 20300 (private: layout, stats; not admitted) and --aggregate-tls-port, the port after the slots' (20208), which the fleet security group's IPv4 range then includes. Over IPv6 a host aggregator has its own address, <prefix>::1, on 443, already admitted. - Coordinator: --ec2-aggregate-listen on loopback and --ec2-aggregate-tls with its certificate in /run/fcvm-fleet/tls; the task gets a volume there (the root file system is read-only), net.ipv4.ip_unprivileged_port_start=443 (the image runs as 65534), 443 in its security group over IPv4 and IPv6, and the account's dualStackIPv6 ECS setting so the task has an IPv6 address. The coordinator already holds ec2:Describe*, which reading its own interface's public IPv4 address needs. scripts/test-fcvm-fleet.py: the coordinator security group admits nothing but the gated 443 rule, the slot range ends at the aggregator port only with the switch on, and AggregatedTests pins the switch off and every addition gated by it.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 57 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
|
@codex security review |
|
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Adds
local.fcvm_fleet_aggregated(false) for ejc3/fcvm#1232: the GPU hosts' aggregators and the EC2 half's aggregator beside the coordinator serve browsers with TLS under per-launch names, so the stage page can run its aggregated mode. Off, every string and resource staging uses is unchanged.fcvm side: ejc3/fcvm#1266 → #1267 → #1268 (stacked). Turn the switch on only with a host AMI and a coordinator image built from that stack: an older image refuses
--aggregate-tls-port/--ec2-aggregate-tlsand does not start.With the switch on
--aggregate-port 20300(private: layout and stats; not admitted) and--aggregate-tls-port 20208, the port after the slots' (base + slots), which the fleet security group's IPv4 range then includes. Over IPv6 a host aggregator has its own address,<host prefix>::1, on 443, which the group already admits.--ec2-aggregate-listen 127.0.0.1:20300 --ec2-aggregate-tls --ec2-aggregate-tls-dir /run/fcvm-fleet/tls. The task gets a volume at/run/fcvm-fleet(its root file system is read-only),net.ipv4.ip_unprivileged_port_start=443(the image runs as 65534 and the aggregator binds 443), 443 in its security group over IPv4 and IPv6 (direct, no tunnel, no Cloudflare in the media path), and the ECSdualStackIPv6account setting so the task gets an IPv6 address. The coordinator reads its own interface's public IPv4 address withec2:DescribeNetworkInterfaces, which its existingec2:Describe*statement covers.Off
join(" ", concat([...], [] )), the same string.merge({...}, [for ... in []]...)gives the same JSON. Checked with a scratch Terraform for both values of the switch: off, the JSON and the argument string are identical to the literal they replace.dynamic "ingress"with no element; description unchanged (a description change would replace the group).for_each/countempty.Tests
python3 scripts/test-fcvm-fleet.py: 36 tests OK. Changed: the coordinator group admits nothing but the gated 443 rule; the slot range ends at the aggregator port only with the switch on. NewAggregatedTests: the switch is off, every addition is gated by it, the aggregator port follows the slots and the private port is outside the admitted range.scripts/test-fcvm-fleet-account.py: OK.terraform validatewas not run: this box's Terraform (1.16.6) is outside the repository's version constraint.Not verified until applied with the switch on: that a Fargate task volume takes the image's ownership of
/run/fcvm-fleet(fcvm#1268 creates it owned by 65534), and thatip_unprivileged_port_startis accepted as a FargatesystemControlsentry.