Conversation
…ocreate-alb # Conflicts: # CHANGELOG.md
…e-alb feat: opt-in ALB autocreation when pool capacity is exhausted
uname -m returns 'aarch64' on Linux ARM64 but the Go binaries are built as 'exec-arm64'. Normalize the value before building the binary path so the correct binary is selected on ARM64 nodes. Also add .worktrees/ to .gitignore. Co-Authored-By: el gallo Claudio <noreply@anthropic.com>
Co-Authored-By: el gallo Claudio <noreply@anthropic.com>
- Add description field to notification-channel.json.tpl files - Update default cpu_millicores from 500 to 100 - Update selectors: category to "Scope" and sub_category to specific values Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
switch_traffic calls aws (build context, verify_networking_reconciliation, publish_alb_metrics) and was missed in the initial wiring. Also adds a first-match-wins test for arn_for_selector_from_json. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Keep design specs and implementation plans local; gitignore the whole docs/superpowers/ tree. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pass the scope's dimensions to `np provider list --dimensions` when resolving the AWS IAM provider, so a dimension-scoped provider config (e.g. region-specific) is selected before matching the selector. Threads dimensions through resolve_assume_role_arn / provider_arn_for_selector / scope_config_assume_role_arn, and the step derives them from CONTEXT.scope.dimensions. Adds unit tests. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ONTEXT Replace the np provider list lookup (which did not actually filter by dimensions) with reading CONTEXT.providers["identity-access-control"], which the platform populates with the config matching the scope's dimensions (most-specific subset wins). Adds identity-access-control to provider_categories. The lib is now a pure JSON resolver (no np), reading the selector from the already-resolved provider; scope-configurations fallback also reads from CONTEXT. Supersedes the prior --dimensions approach. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Rename to the `containers` selector and `CONTAINERS_ASSUME_ROLE_*` env vars (CONTAINERS_ASSUME_ROLE_ARN / _SELECTOR / _ARN_DEFAULT) to avoid collisions across scope/service types. - Drop the scope-configurations assume_role.arn fallback (not a real field today) in the lib, the step and the README. - assume_role uses the workflow-provided `log` directly (no echo fallback). - Reword the failure hints (target role does not exist or does not trust the agent role; no role ARN configured for the selector). - CHANGELOG: "Add support to get AWS credentials via assume role". - Tests: assert every log message in full (with emojis) and assert exported AWS_* env vars directly (source in-process) instead of echoing them. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
# Conflicts: # .gitignore # CHANGELOG.md # k8s/README.md # k8s/deployment/templates/deployment.yaml.tpl # k8s/deployment/workflows/delete.yaml # k8s/deployment/workflows/finalize.yaml # k8s/deployment/workflows/initial.yaml # k8s/deployment/workflows/rollback.yaml # k8s/deployment/workflows/switch_traffic.yaml # k8s/scope/build_context # k8s/scope/networking/resolve_balancer # k8s/scope/tests/networking/resolve_balancer.bats # k8s/scope/tests/validate_alb_capacity.bats # k8s/scope/tests/wait_on_balancer.bats # k8s/scope/validate_alb_capacity # k8s/scope/workflows/create.yaml # k8s/scope/workflows/delete.yaml # k8s/values.yaml
feat(k8s): IAM assume-role support for AWS-touching scopes
Port the permissions-role half of tofu-modules .../aws/iam/agent into the k8s scope as a reusable module, mirroring lambda/scope/tofu/iam/modules. Creates an IAM role holding the agent workload policies (Route53, EKS, ELB, AVP) whose trust policy allows only the agent IRSA role (agent_role_arn) to assume it via sts:AssumeRole. The IRSA agent role itself is provisioned at cluster setup and stays out of scope. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drop the verifiedpermissions:* policy and its role attachment from the agent permissions role. The role keeps only the Route53, EKS and ELB workload policies. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
update locals
Make agent_role_arn optional (defaults to the conventional nullplatform-<cluster>-agent-role) and add additional_agent_role_arns so extra roles can be appended to the trust policy alongside the primary one. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(k8s/tofu): add IAM agent-permissions OpenTofu module
…e role Move the k8s permissions-role module from k8s/specs/tofu to k8s/requirements/aws, aligning with the lambda/static-files requirements layout. Rename the default permissions role to nullplatform_<cluster>_k8s_role (was nullplatform-<cluster>-agent-permissions-role) to follow the nullplatform_<cluster>_<scope>_role convention. BREAKING: consumers referencing //k8s/specs/tofu must update the source to //k8s/requirements/aws.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…-collision fix: avoid IAM inline policy temp file collision on concurrent scope creation
fix(k8s): repair failing unit tests and guard assume_role_lib jq exit
…s/aws) Relocate from k8s/requirements/aws to k8s/specs/requirements/aws so the requirements module lives under specs/ (consistent with the other scopes).
refactor(k8s): move IAM requirements to k8s/specs/requirements/aws + rename role to convention
Hotfix: revert PR #196 (scheduled task nodeSelector)
…ector feat: re-add scheduled task nodeSelector with correct indentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
adds nodeSelector support for scheduled task (CronJob) scopes. This supersedes #196, which was reverted (#197) because it rendered invalid YAML and broke deployments:
CronJob in version "v1" cannot be handled as a CronJob: strict decoding error:
unknown field "spec.jobTemplate.spec.template.spec.kubernetes.io/arch"
Root cause of the original breakage
nodeSelector is a map, but its content was rendered at indent 10 — the same column as the nodeSelector: key. That made the map entries (e.g. kubernetes.io/arch: arm64) siblings of nodeSelector: under template.spec instead of children. The neighboring tolerations block uses the same indent 10 and works only because it is a sequence (- markers disambiguate nesting).
Fix
Render the nodeSelector map content at indent 12, two spaces deeper than its key (the k8s deployment template already follows this rule).
Verification
Rendered the full CronJob template with the real arm64 modifier; kubernetes.io/arch: arm64 now nests correctly under nodeSelector:.
Changes
scheduled_task/deployment/templates/deployment.yaml.tpl: nodeSelector block at indent 12.
CHANGELOG.md: re-added the [Unreleased] entry removed by the revert.