Persistent illumos pilot with scoped Talos bridge and native image distribution

toasterson commented

2026-10-06 09:27:58 +00:00

Owner

Add a scoped Talos bridge for a persistent native illumos/ipkg worker, immutable native zone-image construction, and S3-backed read-only IPS/image distribution. Selected bare Always daemon Pods bind real UUIDs and image digests, preserve metadata and foreign finalizers, and complete normal deletion only after fresh native absence and exact upstream identity/deadline checks. Failed admission before any POST can complete safely; an attempted creation with an unknown outcome remains refused. Ledger failures are logged and isolated.

Validation: 28 bridge tests pass on current bridge head daa1d5d; the preceding source and corrective deltas have independent reviews. The ce1 native payload passed all 325 workspace tests, release ELF/linkage, .13 IPS solver/install/pkgverify, automatic legacy shutdown recovery and two complete guest reboots with the same owned workload identities and real SunOS HTTP. The deployed bridge6a2 passed retained-PVC adoption/flock and a fresh Talos create/HTTP/normal grace30 deletion that removed both API objects and the zone/VNIC/dataset while preserving the original daemon. The daa1d5d admission-failure correction is built at its immutable AMD64 digest; correctness and type-expression reviews approve, while remaining review attempts fail with provider HTTP 429 after three retries (central receipts at 13:33 UTC). Full source review, exact-head CI and its rollout remain pending.

Generation 20261006-pilot5-ce1cb134 is live after Talos PR95/96 and scoped Flux readiness. All26 immutable S3 objects passed body SHA readback; encrypted backup compared26 matching objects and restored the catalog in isolation. Ordinary native public pkgrecv received all13 .13 payloads and native repository content verification passed. Public-only publisher refresh/list/remote manifest/solver checks and installed hashes passed; temporary task file origins are removed. Strict public HTTPS index/catalog/protocol hashes, image size/ETag and denied mutation/traversal checks passed. The unchanged native image retains its earlier complete public download/hash proof; the exact checked-in image-builder replay also completed natively and cleaned its temporary resources. Browser preview shows generation5 and the image links.

Scope: selected native daemons through the bridge. Kubelet/CNI, Jobs, Linux OCI workloads and Kubernetes conformance remain outside this pilot. The bridge is the sole writer of its dedicated native namespace because operator DELETE lacks atomic UID preconditions. Private credentials, VM disk snapshots, other guests and existing apex actor/WebFinger routes are preserved. Final current-head canonical AI/CI gates and corrected bridge rollout remain required before merging this PR and completing WI9.

Work item: WI9 (01a11089-89d4-7451-bceb-4a79e327dc82).

Superseded by PR12 and WI-10: native Kubernetes boundaries and Rust OCI tools per owner architecture correction. This bridge-centered plan is cancelled, not accepted as the new architecture. Existing deployed workload data and historical evidence remain protected.

Add a scoped Talos bridge for a persistent native illumos/ipkg worker, immutable native zone-image construction, and S3-backed read-only IPS/image distribution. Selected bare Always daemon Pods bind real UUIDs and image digests, preserve metadata and foreign finalizers, and complete normal deletion only after fresh native absence and exact upstream identity/deadline checks. Failed admission before any POST can complete safely; an attempted creation with an unknown outcome remains refused. Ledger failures are logged and isolated. Validation: 28 bridge tests pass on current bridge head daa1d5d; the preceding source and corrective deltas have independent reviews. The ce1 native payload passed all 325 workspace tests, release ELF/linkage, .13 IPS solver/install/pkgverify, automatic legacy shutdown recovery and two complete guest reboots with the same owned workload identities and real SunOS HTTP. The deployed bridge6a2 passed retained-PVC adoption/flock and a fresh Talos create/HTTP/normal grace30 deletion that removed both API objects and the zone/VNIC/dataset while preserving the original daemon. The daa1d5d admission-failure correction is built at its immutable AMD64 digest; correctness and type-expression reviews approve, while remaining review attempts fail with provider HTTP 429 after three retries (central receipts at 13:33 UTC). Full source review, exact-head CI and its rollout remain pending. Generation 20261006-pilot5-ce1cb134 is live after Talos PR95/96 and scoped Flux readiness. All26 immutable S3 objects passed body SHA readback; encrypted backup compared26 matching objects and restored the catalog in isolation. Ordinary native public pkgrecv received all13 .13 payloads and native repository content verification passed. Public-only publisher refresh/list/remote manifest/solver checks and installed hashes passed; temporary task file origins are removed. Strict public HTTPS index/catalog/protocol hashes, image size/ETag and denied mutation/traversal checks passed. The unchanged native image retains its earlier complete public download/hash proof; the exact checked-in image-builder replay also completed natively and cleaned its temporary resources. Browser preview shows generation5 and the image links. Scope: selected native daemons through the bridge. Kubelet/CNI, Jobs, Linux OCI workloads and Kubernetes conformance remain outside this pilot. The bridge is the sole writer of its dedicated native namespace because operator DELETE lacks atomic UID preconditions. Private credentials, VM disk snapshots, other guests and existing apex actor/WebFinger routes are preserved. Final current-head canonical AI/CI gates and corrected bridge rollout remain required before merging this PR and completing WI9. Work item: WI9 (01a11089-89d4-7451-bceb-4a79e327dc82). Superseded by PR12 and WI-10: native Kubernetes boundaries and Rust OCI tools per owner architecture correction. This bridge-centered plan is cancelled, not accepted as the new architecture. Existing deployed workload data and historical evidence remain protected.

toasterson added 1 commit

2026-10-06 09:27:58 +00:00