Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
113 commits
Select commit Hold shift + click to select a range
852c1a2
test(sandbox): pin the identifier the AWS MicroVM calls read by
ItamarZand88 Sep 22, 2026
3795ae5
fix(sandbox): read and delete an AWS MicroVM image by ARN, not by name
ItamarZand88 Sep 22, 2026
b16cfc4
test(sandbox): pin that a restarted create needs nothing registered
ItamarZand88 Sep 22, 2026
d66d964
fix(sandbox): derive the AWS build inputs instead of reading them back
ItamarZand88 Sep 22, 2026
3f83160
fix(sandbox): delete an AWS MicroVM image without sweeping its versions
ItamarZand88 Sep 22, 2026
3012946
test(permissions): hold Lambda tag-conditioned grants to this stack's…
ItamarZand88 Sep 22, 2026
5ef034e
fix(sandbox): let the MicroVM image build apply its own boundary tags
ItamarZand88 Sep 22, 2026
bbc2f49
test(sandbox): pin that a restarted create adopts an existing image w…
ItamarZand88 Sep 24, 2026
4567728
fix(sandbox): delete an AWS MicroVM image without sweeping its versions
ItamarZand88 Sep 22, 2026
6f0f6e6
docs(sandbox): say that an image delete removes its versions everywhe…
ItamarZand88 Sep 24, 2026
9fee7e5
fix(sandbox): grant the image build's tag only where no resource is n…
ItamarZand88 Sep 24, 2026
0611826
Merge branch 'itamar/alien-957-sandbox-teardown-fails-on-aws-the-vers…
ItamarZand88 Sep 24, 2026
1d1e668
Merge branch 'itamar/alien-956-sandboxprovision-scopes-lambdatagresou…
ItamarZand88 Sep 24, 2026
6972be5
feat(core): share the sandbox build-role policy with the emitters
ItamarZand88 Sep 23, 2026
0bccce2
refactor(sandbox): derive the build role name in one place
ItamarZand88 Sep 23, 2026
2e616fa
feat(infra): create and verify the sandbox build role as setup scaffo…
ItamarZand88 Sep 23, 2026
dbd0b74
feat(deployment): run setup scaffolding in direct setup and tear it down
ItamarZand88 Sep 23, 2026
38a3614
test(infra): refuse a build role whose only inline policy is foreign
ItamarZand88 Sep 23, 2026
456f984
test(sandbox): run the state-compat test that lost its attribute
ItamarZand88 Sep 23, 2026
13c82b2
test(deployment): stop setup when the build role is refused
ItamarZand88 Sep 23, 2026
e3bd68c
feat(aws-clients): add a Cloud Control API client
ItamarZand88 Sep 23, 2026
58ab7d9
feat(core): share the sandbox egress operator role and connector state
ItamarZand88 Sep 23, 2026
95beb2d
feat(aws-clients): read prefix lists on security group rules
ItamarZand88 Sep 23, 2026
df0e5d8
feat(infra): expose the Cloud Control client through the service prov…
ItamarZand88 Sep 23, 2026
c2f9fc8
feat(infra): create a deny AWS sandbox's egress objects in direct setup
ItamarZand88 Sep 23, 2026
2f88195
fix(infra): refuse deny egress on a network the runtime creates
ItamarZand88 Sep 23, 2026
782ca67
test(infra): refuse an unrecorded group that also reaches ipv6 or a g…
ItamarZand88 Sep 23, 2026
759e89c
feat(core): resolve a runtime-built AWS sandbox's registration
ItamarZand88 Sep 23, 2026
7e25eb8
feat(infra): seed a scaffolded AWS sandbox through its importer
ItamarZand88 Sep 23, 2026
8fe72b0
feat(deployment): seed scaffolded resources before direct setup hands…
ItamarZand88 Sep 23, 2026
2b71673
test: drop comments that restate the seed test helpers' names
ItamarZand88 Sep 23, 2026
cbc3a8e
test(infra): keep a serving deny sandbox's image when setup seeds it …
ItamarZand88 Sep 23, 2026
e8efa9b
test(infra): pin a re-seed's dependencies and its resource-type guard
ItamarZand88 Sep 23, 2026
875d900
fix(deployment): hold a deployment with recorded scaffolding for tear…
ItamarZand88 Sep 23, 2026
538b6aa
test(deployment): pin the order of sandbox, scaffolding and network t…
ItamarZand88 Sep 23, 2026
3af1730
fix(infra): write a sandbox build policy only when it differs
ItamarZand88 Sep 23, 2026
66289d0
fix(infra): converge a deny sandbox's group after a lost response
ItamarZand88 Sep 23, 2026
bd1f6ff
test(deployment): end teardown of a group never released within its s…
ItamarZand88 Sep 23, 2026
7a4cd1c
fix(deployment): refuse an update that changes a sandbox's setup scaf…
ItamarZand88 Sep 23, 2026
8e7a8e6
test(infra): switch a serving sandbox's egress by running setup again
ItamarZand88 Sep 23, 2026
3ce79f0
fix(deployment): tear down scaffolding a lost checkpoint left unrecorded
ItamarZand88 Sep 23, 2026
b178c44
style(infra): drop comments that restate their function names
ItamarZand88 Sep 23, 2026
c04876d
fix(infra): mark an unrecorded connector as setup's by its operator role
ItamarZand88 Sep 23, 2026
63ffd28
test: hold setup-required refusals to their code, and word gone group…
ItamarZand88 Sep 23, 2026
c1b1117
style(infra): drop the partition the operator role ARN helper replaced
ItamarZand88 Sep 23, 2026
c166c87
fix(deployment): keep a failed setup step's scaffolding record
ItamarZand88 Sep 23, 2026
baeb8b3
fix(infra): read a connector's Cloud Control request once per call
ItamarZand88 Sep 23, 2026
cb0c84e
test(infra): import at the top of the setup scaffolding tests
ItamarZand88 Sep 23, 2026
09c7f84
refactor(infra): derive a sandbox's egress network in one place
ItamarZand88 Sep 23, 2026
4320106
fix(deployment): keep the scaffolding record on every failed setup step
ItamarZand88 Sep 23, 2026
39b86ef
test(aws-clients): import at the top of the ec2 tests module
ItamarZand88 Sep 23, 2026
a98da7f
fix(aws-clients): type every Cloud Control handler error code
ItamarZand88 Sep 23, 2026
e635532
fix(infra): claim only the scaffolding objects setup tagged
ItamarZand88 Sep 23, 2026
e4af466
fix(infra): recover each unrecorded scaffolding object at teardown
ItamarZand88 Sep 23, 2026
a77f6eb
test(infra): lock the deny group and the Terraform connector to the d…
ItamarZand88 Sep 23, 2026
6e19de6
fix(infra): settle a failed connector request only by its operation
ItamarZand88 Sep 23, 2026
16ead40
fix(infra): wait out EC2's read lag on the deny group
ItamarZand88 Sep 23, 2026
82daf56
fix(infra): apply the build role's policy before any egress object
ItamarZand88 Sep 23, 2026
0514399
fix(infra): refuse a dual-stack connector and an unreadable role policy
ItamarZand88 Sep 23, 2026
1b37fc9
fix(deployment): refuse a direct update with nothing installed to com…
ItamarZand88 Sep 23, 2026
4e48a00
test(cloudformation): import at the top of the sandbox tests
ItamarZand88 Sep 23, 2026
9b53646
refactor(sandbox): one owner for which network an AWS deny sandbox's …
ItamarZand88 Sep 23, 2026
0d908db
fix(sandbox): drop the build role's logs grant, which no build uses
ItamarZand88 Sep 23, 2026
5a5fe1e
fix(sandbox): let the egress operator role tag only the interface it …
ItamarZand88 Sep 23, 2026
f2e20e1
test(sandbox): a deny sandbox attaches to the first of two networks
ItamarZand88 Sep 23, 2026
2395654
fix(sandbox): pull a private base image from its one repository only
ItamarZand88 Sep 23, 2026
e23289b
test(infra): let the controller test executor declare other stack res…
ItamarZand88 Sep 23, 2026
7aba6bb
fix(sandbox): deny management any write to a sandbox's setup roles
ItamarZand88 Sep 23, 2026
95effe0
fix(sandbox): match the setup-roles guard by setup's tags, not names
ItamarZand88 Sep 24, 2026
e14468f
fix(sandbox): budget sandbox ids for the egress role and keep its nam…
ItamarZand88 Sep 24, 2026
c95066e
fix(aws-clients): map EC2's InvalidPermission.NotFound to not found
ItamarZand88 Sep 24, 2026
51a816c
fix(infra): stop retrying scaffolding failures a retry cannot change
ItamarZand88 Sep 24, 2026
2288dea
fix(deployment): treat a sandbox setup never recorded as new on update
ItamarZand88 Sep 24, 2026
4de4b6b
fix(infra): settle EC2 rule lag and delete every deny group setup made
ItamarZand88 Sep 24, 2026
7d8fbf3
fix(infra): log AWS's reason when a deny group rule write is read again
ItamarZand88 Sep 24, 2026
c7912d4
test(preflights): check the setup-roles guard exemption against prepa…
ItamarZand88 Sep 24, 2026
d07283c
fix(permissions): deny the management identity any write to its own role
ItamarZand88 Sep 24, 2026
35d561c
fix(deployment): name what AWS has not released when setup teardown r…
ItamarZand88 Sep 24, 2026
1555207
docs(sandbox): say which registry and which policy the ECR comments mean
ItamarZand88 Sep 24, 2026
278e893
fix(preflights): hold only a deny sandbox's id to the egress role's l…
ItamarZand88 Sep 24, 2026
d00acd7
refactor(infra): fail loudly if a deny group is recorded before its e…
ItamarZand88 Sep 24, 2026
4e792e0
fix(permissions): label the management guards and snapshot what custo…
ItamarZand88 Sep 24, 2026
ac820a8
docs: plainer wording in two comments
ItamarZand88 Sep 24, 2026
b240e46
docs: tighten the guard and teardown comments to what the code cannot…
ItamarZand88 Sep 24, 2026
e79aa86
docs(core): only a deny sandbox's id is budgeted for the egress role …
ItamarZand88 Sep 24, 2026
2ba9ddd
fix(preflights): exempt only the management-role guard from profile d…
ItamarZand88 Sep 24, 2026
65b7978
feat(infra): build a Frozen AWS sandbox through direct setup
ItamarZand88 Sep 24, 2026
7cae33f
feat(infra): delete a Frozen sandbox's image in direct setup teardown
ItamarZand88 Sep 24, 2026
1f6cb76
feat(infra): roll a directly set-up Frozen sandbox when setup runs again
ItamarZand88 Sep 24, 2026
4bbde5f
fix(infra): delete a sandbox's image only when its state says it is Live
ItamarZand88 Sep 24, 2026
60e4f80
fix(infra): let only setup build a Frozen image, once it has granted …
ItamarZand88 Sep 24, 2026
a381f0c
fix(infra): recover a Frozen sandbox's image only while it still exists
ItamarZand88 Sep 24, 2026
fb7cb4f
docs(infra): one doc per helper, and the importer's docs within three…
ItamarZand88 Sep 24, 2026
30aec1d
fix(sandbox): grant a published AWS sandbox its remote access during …
ItamarZand88 Sep 24, 2026
e439c71
Merge branch 'itamar/alien-957-sandbox-teardown-fails-on-aws-the-vers…
ItamarZand88 Sep 24, 2026
c162795
test(terraform): snapshot the management guards as typed statements
ItamarZand88 Sep 24, 2026
9b31f4e
Merge branch 'itamar/alien-956-sandboxprovision-scopes-lambdatagresou…
ItamarZand88 Sep 24, 2026
d5d44ee
fix(sandbox): leave the tag-on-create exclusion's partition a wildcard
ItamarZand88 Sep 24, 2026
c090ab1
Merge branch 'itamar/alien-956-sandboxprovision-scopes-lambdatagresou…
ItamarZand88 Sep 24, 2026
5da1fcc
fix(deployment): destroy a direct setup that failed before its manage…
ItamarZand88 Sep 24, 2026
b368b32
fix(preflights): let an update add the sandbox setup-role guard too
ItamarZand88 Sep 24, 2026
a077900
fix(deployment): check setup teardown's stack state before checkpointing
ItamarZand88 Sep 24, 2026
d85f984
docs(sandbox): say why a runtime-built sandbox still registers its bu…
ItamarZand88 Sep 24, 2026
b3e399a
Merge branch 'itamar/alien-955-a-live-aws-sandbox-that-fails-during-c…
ItamarZand88 Sep 24, 2026
2778aab
docs(aws-clients): describe what the image-delete probe does
ItamarZand88 Sep 24, 2026
e1c6cb4
Merge branch 'itamar/alien-957-sandbox-teardown-fails-on-aws-the-vers…
ItamarZand88 Sep 24, 2026
a4aea63
fix(deployment): skip runtime cleanup only when nothing it acts on ca…
ItamarZand88 Sep 24, 2026
efb28c4
docs(aws-clients): say what the image-delete probe answers
ItamarZand88 Sep 24, 2026
e728383
Merge branch 'itamar/alien-957-sandbox-teardown-fails-on-aws-the-vers…
ItamarZand88 Sep 24, 2026
4afe6eb
docs(deployment): state the destroy-without-runtime rule as it now reads
ItamarZand88 Sep 24, 2026
0b0e413
Merge remote-tracking branch 'origin/main' into itamar/alien-966-make…
ItamarZand88 Sep 25, 2026
d93e494
Merge remote-tracking branch 'origin/main' into itamar/alien-966-make…
ItamarZand88 Sep 25, 2026
771ebb5
Merge remote-tracking branch 'origin/main' into itamar/alien-966-make…
ItamarZand88 Sep 25, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading