Establish native illumos cluster baseline and repair API/TLS blockers #1

Merged

toasterson merged 6 commits from codex/native-cluster-baseline-20261001 into main

2026-10-01 19:45:50 +00:00

toasterson commented

2026-10-01 10:09:43 +00:00

Owner

The real illumos runtime failed to compile, both pod-list HTTP routes returned 500 before reconciliation could run, and serve stayed alive after API bind/TLS failure. Newly generated CA and server certificates also shared the same default subject, causing OpenSSL clients to reject the chain.

Repair the native imports, separate namespaced and cluster-wide pod list/watch routes, propagate API failures, and give generated certificates distinct subjects plus an authority key identifier. Add a router regression and repeatable native build/API checks, exclude the mock NAT reload fixture on illumos, and correct the test fixture lints found by strict native Clippy. Existing TLS files are reused; this does not rotate an installed CA or certificate.

Validation on native OpenIndiana x86 with Rust 1.97.1, GCC 14, two build jobs and a dedicated Cargo target directory:

bash tools/check-native.sh: 189 workspace tests; binary build; formatting; Clippy across all targets with warnings denied; SMF manifest validation and method syntax.
Process smoke: occupied-port and missing-TLS failure, health endpoints, namespace/pod/node/service API, status/spec separation, termination/finalization, database restart, CA-validated HTTPS, certificate reuse and SIGTERM cleanup.

Update the stale README and document six dependency-linked cluster milestones: shared control plane/workers, component supervision, native images/zones, owned networking, API identity, and a packaged CI/runner pilot. Those milestones remain draft. No zone workload, host networking change, SMF activation, production deployment or multi-host cluster was performed. Native Anima CI configuration remains a pilot prerequisite.

The real illumos runtime failed to compile, both pod-list HTTP routes returned 500 before reconciliation could run, and `serve` stayed alive after API bind/TLS failure. Newly generated CA and server certificates also shared the same default subject, causing OpenSSL clients to reject the chain. Repair the native imports, separate namespaced and cluster-wide pod list/watch routes, propagate API failures, and give generated certificates distinct subjects plus an authority key identifier. Add a router regression and repeatable native build/API checks, exclude the mock NAT reload fixture on illumos, and correct the test fixture lints found by strict native Clippy. Existing TLS files are reused; this does not rotate an installed CA or certificate. Validation on native OpenIndiana x86 with Rust 1.97.1, GCC 14, two build jobs and a dedicated Cargo target directory: - `bash tools/check-native.sh`: 189 workspace tests; binary build; formatting; Clippy across all targets with warnings denied; SMF manifest validation and method syntax. - Process smoke: occupied-port and missing-TLS failure, health endpoints, namespace/pod/node/service API, status/spec separation, termination/finalization, database restart, CA-validated HTTPS, certificate reuse and SIGTERM cleanup. Update the stale README and document six dependency-linked cluster milestones: shared control plane/workers, component supervision, native images/zones, owned networking, API identity, and a packaged CI/runner pilot. Those milestones remain draft. No zone workload, host networking change, SMF activation, production deployment or multi-host cluster was performed. Native Anima CI configuration remains a pilot prerequisite.

toasterson added 6 commits

2026-10-01 10:09:44 +00:00