kacerrandClaude Fable 5.1
791988b5a0
Registers "kvm" in the provider builtins, mounts an optional kvm-ssh Secret at /etc/proxy-operator/kvm, adds a kvm-home providers-config sample and a proxy_kvm.yaml Proxy sample, documents the provider in docs/kvm-provider.md (prerequisites, config reference, image cache and its do-not-replace-in-use rule, known gaps), and updates the README and architecture provider sections and decision log. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2.7 KiB
2.7 KiB
Changelog
2026-09-08 11:00 UTC — KVM/libvirt provider
- New
kvmprovider type: Managed proxies as VMs on your own libvirt/KVM hosts. Each host is reached over SSH with the libvirt unix socket forwarded through the connection (pure Go, nothing to expose on the hypervisors beyond sshd); one provider instance can span several hosts, selected byplacement.zone. - Base images (
images:map or a direct URL inplacement.image) are downloaded by the operator into each host's storage pool on first use, verified by sha256 when configured, and cached there. Per-VM disks are qcow2 overlays; cloud-init arrives on a NoCloud seed ISO built in-process. GC identity lives in the domain's<metadata>element. - Wiring:
"kvm": kvm.Newincmd/main.go; optionalkvm-sshSecret mounted at/etc/proxy-operator/kvm; samplesconfig/samples/proxy_kvm.yamland akvm-homeblock inproviders-config.yaml;docs/kvm-provider.md; opt-in integration test (make test-integration-kvm) against a real hypervisor. - Not yet validated on a real host — that is the next step on the branch.
2026-08-10 09:34 CEST — kind e2e verified; fix Squid OOM in containers; quickstart goes in-cluster
- Full end-to-end pass on a throwaway kind cluster: Squid pod Ready with a real CONNECT probe (89 ms), lease grant/report/cooldown-409/release through the discovery API, finalizer cleanup on delete.
- Fixed the kubernetes provider's generated squid.conf:
max_filedescriptors 1024(squid sizes FD tables from the container's effectively-unlimited RLIMIT_NOFILE and was OOM-killed at startup under kind/containerd) +cache_mem 16 MB. - README quickstart now deploys the operator in-cluster:
make run-devon a laptop cannot reach kind pod IPs, so health probes fail by construction there (documented).
2026-08-09 17:27 CEST — Operator wired end to end: reconciler, health, leases, discovery, GC, two providers
cmd/main.gois now the full composition root:--providers-config(required, fail-fast),--discovery-addr,--proxy-namespace,--health-workers,--gc-interval,--gc-min-age,--gc-allow-namespaced,--lease-cooldown,--max-lease-ttl; wires the kubernetes + gcp providers (metrics-instrumented), health engine, lease store, discovery API, orphan GC, and Prometheus metrics onto one manager.- Deploy manifests: providers ConfigMap mount, optional
DISCOVERY_TOKENSecret env, discovery port 8090 + Service; pods RBAC for the kubernetes provider. - Samples for all three proxy flavors + providers-config;
make run-devfor local development. - README rewritten (kind quickstart, GCP setup, the two load-bearing caveats); architecture doc completed with components table and the full decision log.