feat(runner): carry no egress policy on a backend that cannot enforce one - #1145
Merged
trunk-io[bot] merged 3 commits intoSep 13, 2026
Conversation
This was referenced Sep 12, 2026
Merged
Merged
rigel-mintaka
added this pull request to stack #1126
September 12, 2026 13:25
|
Compass engineering docs preview: https://compass-service-owner-rig-35-x6nu.compass-eng-docs.pages.dev Deployed from |
This was referenced Sep 12, 2026
mattwilkinsonn
approved these changes
Sep 12, 2026
… one The operator's allowlist flag parses into a real policy even when empty, so a host-tier Runner would have handed provision a configured policy and failed every launch. Resolution now sits beside the uid probe, keyed off the same capability seam: an unenforceable backend carries the zero-value policy. An explicit allowlist is treated differently. It is operator intent to confine egress, and this tier cannot, so startup fails and names the remedy rather than discarding the request silently.
The pair read EgressArmed and EgressUnenforcedPosture — one carrying the type suffix, the other not — in a value set the design expects to grow. The suffix was avoiding visual overlap with the EgressUnenforced marker method, which Go namespacing never required. Both are now prefixed; the rendered strings are unchanged. Also records why the unenforced case is tested first (a both-marker backend must refuse, not silently skip), marks the deliberately empty self-arming arm, warns that a decorator must re-expose the marker, and closes two test gaps: credentials on the unenforced path, and a marker answering false reading as armed.
The comment claimed the order prevents reporting armed, but EgressPosture asks the marker directly and is independent of it. What the order governs is refusing a policy instead of silently dropping it on the self-arm branch. The test fake is renamed to match what it became when its answer turned into a field: it parametrizes the marker rather than always being unenforced.
rigel-mintaka
force-pushed
the
compass-service-owner/rig-3512-egress-runner-profile
branch
from
September 12, 2026 19:37
386afb9 to
7caeb60
Compare
mattwilkinsonn
approved these changes
Sep 12, 2026
trunk-io
Bot
deleted the
compass-service-owner/rig-3512-egress-runner-profile
branch
September 13, 2026 00:29
|
This pull request was merged into |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of a stack containing 10 PRs:
mainThe operator's allowlist flag parses into a real policy even when empty, so a
host-tier Runner would have handed provision a configured policy and failed
every launch. Resolution now sits beside the uid probe, keyed off the same
capability seam: an unenforceable backend carries the zero-value policy.
An explicit allowlist is treated differently. It is operator intent to confine
egress, and this tier cannot, so startup fails and names the remedy rather than
discarding the request silently.