Repository navigation
fleet coord hosts: name each override's instance type in CreateFleet - #1328
Conversation
On staging every GPU host launch was refused: CreateFleet: UnauthorizedOperation, explicit deny by the coordinator role's FleetTypesOnly statement, which denies ec2:CreateFleet on instance/* unless ec2:InstanceType is a fleet type. For CreateFleet IAM takes ec2:InstanceType only from the request; the launch template's type is not in the request context (the decoded authorization message carried no ec2:InstanceType key), so the key was absent and the deny applied. The fcvm half of the wall had no hosts after the auto scaling groups were removed. - AwsHosts reads each host template's instance type from its latest version (DescribeLaunchTemplateVersions, covered by the role's ec2:Describe*) and reuses it for 5 minutes. - create_fleet_params takes (template, type) pairs and sets LaunchTemplateConfigs.N.Overrides.M.InstanceType on every override. - The fake EC2 in tests/test_fleet_coord.rs refuses a CreateFleet whose override names no host type with 403 UnauthorizedOperation, as IAM does. Test: the_aws_host_driver_launches_through_an_instant_fleet fails on the previous hosts.rs (the launch is refused) and passes with this change.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 22 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Local review of 1dbd329 (
DISAGREE: not blocking; it needs a lost CreateFleet answer and a host template type change inside the same retry window, and without this PR every launch is refused. Tracked in #1329. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Every GPU host launch on staging was refused, so the fcvm half of the wall had no hosts after the host auto scaling groups were removed (#1282).
The decoded authorization message names the coordinator role's
FleetTypesOnlystatement (denyec2:CreateFleetoninstance/*unlessec2:InstanceTypeis a fleet type) and its request context has noec2:InstanceTypekey: forCreateFleet, IAM takes the type only from the request, not from the launch template.Change
AwsHostsreads each host template's instance type from its latest version (DescribeLaunchTemplateVersions, allowed by the role'sec2:Describe*) and reuses it for 5 minutes.create_fleet_paramstakes (template, type) pairs and setsLaunchTemplateConfigs.N.Overrides.M.InstanceTypeon every override.tests/test_fleet_coord.rsrefuses aCreateFleetwhose override names no host type with 403UnauthorizedOperation, as IAM does.Tests
the_aws_host_driver_launches_through_an_instant_fleetfails on the previoushosts.rs(panicked at tests/test_fleet_coord.rs:3490, the spot launch is refused) and passes with this change;create_fleet_asks_for_the_market_over_every_template_and_subnetchecks the override types.make lintpasses.