feat(discovery): standalone proxy workload classification, ConfigMap backend extraction, and K8s hardening - #217
Conversation
Review —
|
21c954f to
1f55238
Compare
Addressed Review Feedback & Re-Review RequestAll findings from the adversarial review have been addressed: 1. Major 2 — Envoy ConfigMap Linear Parsing & Content Ceiling
2. Major 3 — INV-1 Tenant/Cluster Scoping
3. Minor 1 — 403 Forbidden Logging
4. Minor 2 — OpenAPI Validation Bypass on Upgrade
5. Minor 3 — ThreadPoolExecutor Shutdown Bounds
6. Track B Stack Rebase
Re-review requested @bonnyr-f5. |
71c1809 to
8815238
Compare
…n_for_agent tests
…nect drain
MAJOR-1: the initial POST dispatch marked the first child RUNNING with a plain
ORM write committed only AFTER the blocking dispatch_to_agent round-trip, while
the group+children were already committed PENDING. A WS (re)connect firing in
that window found the row PENDING, won claim_pending_run, and sent a SECOND
{"type":"run"} for the same run. Now the initial dispatch claims the child
ATOMICALLY (claim_pending_run, group-guarded) and PERSISTS the claim BEFORE the
send round-trip, and reverts on send failure -- so initial-dispatch and
connect-drain are mutually exclusive on the row; the loser skips.
MAJOR-2: the connect-drain guarded agent-wide while _dispatch_next_group_child
claimed next-in-group, so on a run_completed+reconnect interleave the two paths
could claim different sibling rows and put two children of one group RUNNING.
claim_pending_run now takes group_id and adds a NOT-EXISTS group-sequential
guard (refuse if any sibling is RUNNING); _dispatch_next_group_child uses it, and
the connect-drain routes grouped runs through _dispatch_next_group_child -- one
serialization point, so two siblings can never both be RUNNING.
MINOR-3: add deterministic state-level tests for the group guard (two siblings
can't both be RUNNING), the MAJOR-1 initial-vs-drain claim race, and async tests
for the drain's claim -> send_command_to_agent -> group PENDING->RUNNING path and
the release_claimed_run rollback on send failure.
MINOR-4: pre-existing WS-identity weakness (drain auto-sends a run config to any
JWT socket when BENCHMARK_AGENT_AUTH_REQUIRED is off) left for a separate issue --
a matching-agent_id guard would reject the flag-off built-in agent (whose token
legitimately carries no agent_id claim), so it is not a safe one-liner here.
Claude-Session: https://claude.ai/code/session_01UCsZXDxBsWV2s4kT47DwDW
… send - MAJOR-A (INV-8): Lock BenchmarkRunGroup row with with_for_update() in claim_pending_run to serialize sibling claims across concurrent transactions under PostgreSQL READ COMMITTED - MINOR-B: Commit claimed run state before awaiting WebSocket send in _dispatch_next_group_child and release+commit on failure - MINOR-C: Remove duplicate .trivyignore entry now included in staging - NIT-D: Atomically transition run-group PENDING to RUNNING in connect-drain via mark_run_group_running_if_pending
…d proxies and align HAProxy 10080 port mapping - Resolve nodeport service external IP and internal IP for deployed proxies - Set HAProxy service and container port to 10080 in helm chart values - Prioritize deploy.external_url for benchmark dispatch - Add Layer 3 Kubernetes pod fallback check during target validation
…ng to benchmarks UI - Expose cluster_name on BenchmarkTarget, BenchmarkRun, and BenchmarkRunGroup - Add cluster_id query filter and eager loading to benchmark listing APIs - Integrate ClusterPicker fleet selector on Benchmarks page header - Display cluster column and badges in target lists and benchmark wizards
…and update test fixtures
…ate stale OpenAPI/TypeScript definitions
…igMap backends for HAProxy, NGINX, and Envoy - Classify standalone proxy deployments across namespaces by image and container names - Parse backend servers from ConfigMaps for HAProxy, NGINX, and Envoy - Match discovered proxy deployments to benchmark targets - Synthesize Ingress definitions from parsed ConfigMaps in migration translator
…ERT_FILE, and optimize connection pools - Add --disable-openapi-validation to Helm upgrade/install to prevent WAN timeouts - Auto-export SSL_CERT_FILE in kubeconfig wrapper for corporate SSL intercepting proxies - Configure urllib3 connection pool size to 32 and add connect/read timeout tuples - Parallelize fleet health and consumption queries with thread-isolated DB sessions - Refine BNK Resources consumption cards, node capacity metrics, and provider badges
…ed inventory query, and k8s logging
8815238 to
43ccdd4
Compare
43ccdd4 to
46b9882
Compare
CI 100% Green UpdateBranch has been cleanly rebased against
Ready for re-review. |
3 participants
Summary
This PR introduces standalone proxy discovery (HAProxy, NGINX, Envoy, Traefik, Kong, Caddy), parses upstream backend targets directly from ConfigMaps, hardens Helm & Kubernetes API calls against corporate proxy TLS interception and WAN latency, and optimizes fleet health queries with thread-isolated database sessions.
Key Changes
_classify_deploymentinProxyDiscoveryServiceto detect standalone proxy deployments by container images, labels, and names across all cluster namespaces._extract_backends_from_configmapsto parse upstream backends fromhaproxy.cfg(server),nginx.conf(proxy_pass), and Envoy configurations.translate_to_bnkto synthesize Ingress definitions from parsed ConfigMaps when no native Ingress/HTTPRoute exists.--disable-openapi-validationto Helm install/upgrade to prevent timeout stalls when downloading schema definitions over high-latency WAN/tunnels.SSL_CERT_FILE=/home/bnkforge/.bnk-forge-ca-bundle.crtwhen present in kubeconfig execution wrapper so CLI and client tools trust corporate MITM root certificates.(5, 15)to prevent hangs on default TCP OS timeouts.SessionLocal()) andconcurrent.futures.as_completed.Overview,BNK Resources,Fleets).BnkResourcesPanel.Verification
test_proxy_inventory.py,test_proxy_translate_service.py,test_kubernetes_eks_token_region.py,test_d019_e1_resolve_resource_type.py,test_routes_operators_fleet.py).