e2e: check an actor's address families against its worker pod's - #1354
Draft
Yuan Gao (ygao-g) wants to merge 1 commit into
Draft
e2e: check an actor's address families against its worker pod's#1354Yuan Gao (ygao-g) wants to merge 1 commit into
Yuan Gao (ygao-g) wants to merge 1 commit into
Conversation
Nothing outside a sandbox can see which address families the actor inside it ended up with, and the two sandbox classes reach that state by different routes -- gVisor's runsc adopts the interior netns wholesale, while a micro-VM guest has to be told over the kata-agent channel. The counter demo now serves /netinfo, reporting its own interfaces and the addresses on them, and TestActorAddressFamilies compares that against the worker pod's own IPs. The assertion is an equivalence rather than "expect IPv6", so it means something on every cluster: on a dual-stack one it is the positive check, and on the IPv4-only clusters CI runs today it asserts that an actor was not given an address its pod cannot route. Link-local does not count as IPv6 -- every link has an fe80::, so counting it would make the check vacuous. Part of agent-substrate#246
Collaborator
|
... are we assuming that these will ever mismatch? why? does it even matter if we're sending traffic through the tunnel? |
Yuan Gao (ygao-g)
marked this pull request as draft
September 1, 2026 15:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #246.
Nothing outside a sandbox can see which address families the actor inside it
ended up with, and the two sandbox classes reach that state by different
routes: gVisor's runsc adopts the interior netns wholesale, while a micro-VM
guest has to be told over the kata-agent channel. The counter demo now serves
/netinfo, reporting its interfaces and the addresses on them, andTestActorAddressFamiliescompares that against the worker pod's own IPs.The assertion is an equivalence rather than "expect IPv6", so it means
something on every cluster: on a dual-stack one it is the positive check, and
on the IPv4-only clusters CI runs today it asserts that an actor was not
given an address its pod cannot route. It runs on both sandbox classes through
E2E_SANDBOX_CLASS, so the merge-gatinge2e-testjob picks it up for bothwithout any workflow change. Link-local does not count as IPv6 — every link
has an
fe80::, so counting it would make the check vacuous.🤖 Generated with Claude Code