From 2cca03c1c0230aac41d8e056f757a5c4250b814b Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Fri, 2 Oct 2026 20:50:14 +0200 Subject: [PATCH] plane(1.7): gvisor tarball reachability documented as planned (manual, k3s) docs/deployment.md B.1: Substrate's ateom-gvisor worker runs runsc from the release tarball named in manifests/ate-install/sandboxconfig-gvisor.yaml (gs://gvisor/releases/nightly/2026-09-02//gvisor.tar.zstd, sha256-pinned per architecture), fetched by the atelet on the node; the node must reach it or a copied SandboxConfig must name a mirror with the same sha256. The check is the atelet's fetch line in the worker pod's logs, run by hand on the day k3s exists; labelled planned until then (design open question 3 stays open). Gates: docs only; mkdocs build --strict passed with this paragraph present in the 1.4 gate; no file a test or linter reads changed since the 1.5 gate. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo --- .kiro/specs/plane-on-kubernetes/tasks.md | 2 +- docs/deployment.md | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.kiro/specs/plane-on-kubernetes/tasks.md b/.kiro/specs/plane-on-kubernetes/tasks.md index 657238e..7013a6c 100644 --- a/.kiro/specs/plane-on-kubernetes/tasks.md +++ b/.kiro/specs/plane-on-kubernetes/tasks.md @@ -55,7 +55,7 @@ go-ahead** with a ceiling; steps that need a hand on a cluster that does not exi in `tests/test_plane_reconciler.py:803` moves to 550 in task 2.4 with the reason in the assertion message. - Evidence: the numbers in `record.json`. - _Requirements: 2.1_ -- [ ] 1.7 gvisor tarball reachability (open question 3) **manual** +- [x] 1.7 gvisor tarball reachability (open question 3) **manual** -- documented as planned in `docs/deployment.md` B.1; the live check waits for k3s - `docs/deployment.md` (B.1, planned): the k3s node must fetch `gs://gvisor/releases/nightly/2026-09-02//gvisor.tar.zstd` (`substrate/manifests/ate-install/sandboxconfig-gvisor.yaml`) or a mirrored copy named in a copied SandboxConfig; the check is `kubectl -n ate-system logs` of the worker diff --git a/docs/deployment.md b/docs/deployment.md index 7c8e0f2..a866be9 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -150,6 +150,14 @@ cluster. Everything else below is either a step you take or a code change that i receiver, TLS passthrough to the Workspaces' Git hosts and the Model's declared hosts. - Deploy ax (`make deploy AX_IMAGE_REPO=` in the ax checkout) **after** B.2. - Apply a WorkerPool (B.6). Substrate installs none by itself ("no free workers"). +- **gVisor on the nodes (planned, checked by hand on the day k3s exists).** Substrate does not use a Kubernetes + `RuntimeClass`: the `ateom-gvisor` worker runs `runsc` itself, from the gVisor release tarball named in + `manifests/ate-install/sandboxconfig-gvisor.yaml` of the Substrate checkout + (`gs://gvisor/releases/nightly/2026-09-02//gvisor.tar.zstd`, sha256-pinned per architecture), which + the atelet fetches on the worker node. The node must reach that URL, or a copied `SandboxConfig` must name a + mirrored copy with the same sha256 and the ActorTemplates must name that config. The check is the atelet's + fetch line in `kubectl -n ate-system logs` of the worker pod; it is labelled planned until that log has been + read on a k3s node (plane-on-kubernetes task 1.7, design open question 3). ### B.2 ax's snapshot bucket: `AX_SNAPSHOTS_BUCKET`