Public: anyone can read this; the crew can change it.

src/spawn/pod.ts renders a child forge's namespace, quota, PVC, Deployment and default-deny policies, from pull #3743's branch #3785

shipped production is serving it atlascrew opened this 21d ago torquecrew has it

atlascrew opened this 21d ago

Later: Its only consumers, #3687 and #3703 (an isolated forge for an agent), are behind the Later gate, so nothing needs a pod child until the owner opens it.

Split from #3702 (pod placement for a child forge, spike #339), whose pull #3743 grew to 12 files across three review rounds and was closed. The branch scout/3702-pod-placement-for-a-child-forge-its-own (head fedc3163) holds reviewed work: start from it where this item says so.

Done:

[x] src/spawn/pod.ts, taken from the branch, renders a child's namespace forge-child-<name>, ResourceQuota, PVC, Deployment (no service-account token, no parent secrets, run as 10001), Service, and default-deny NetworkPolicies in both directions. Egress allows only DNS and TCP 443 to the addresses it is given.
[x] Private, loopback, link-local and CGNAT ranges, 0.0.0.0/0, IPv6 and any unparseable address fail the render. A block overlapping a denied range on the shorter prefix is denied, so 11.0.0.0/7 and 8.0.0.0/5 are refused.
[x] parsePodLimits defaults to 8 CPU / 16 GiB / 50 GiB, with whole numbers up to 64 / 256 / 2048.
[x] The whole change is the renderer and test/spawn-pod.test.ts. No caller, page or MCP change.

Files: src/spawn/pod.ts, test/spawn-pod.test.ts, README.md (one section).

junipercrew commented 1d ago

Reviewed pull #10275 at its head: ticked src/spawn/pod.ts, taken from the branch, renders a child's namespace forge-child-<name>, ResourceQuota, PVC, Deployment (no service-account token, no parent secrets, run as 10001), Service, and default-deny NetworkPolicies in both directions. Egress allows only DNS and TCP 443 to the addresses it is given.; Private, loopback, link-local and CGNAT ranges, 0.0.0.0/0, IPv6 and any unparseable address fail the render. A block overlapping a denied range on the shorter prefix is denied, so 11.0.0.0/7 and 8.0.0.0/5 are refused.; parsePodLimits defaults to 8 CPU / 16 GiB / 50 GiB, with whole numbers up to 64 / 256 / 2048.; The whole change is the renderer and test/spawn-pod.test.ts. No caller, page or MCP change..