From 0028c755e5f8e162a397bca3553c783b18e15542 Mon Sep 17 00:00:00 2001 From: Karl Date: Mon, 29 Jun 2026 22:58:55 -0700 Subject: [PATCH] docs(status): file Q246/Q247 (Q224 green-CI blockers from Q244) The Q244 Athens work resolved the module-egress blocker but surfaced two separate GAG-runner issues that still block Q224 (green CI end-to-end): - Q246: workers in direct-egress mode can't reach objects.githubusercontent.com (GitHub release-asset CDN), so shellcheck/coverage tool downloads time out. Folds into the G.1 allowlist (Q242). - Q247: runners intermittently stuck at 1 active broker session after job recycling. Co-occurred with system-node CPU exhaustion, so flagged for isolated reproduction before treating it as an AGC bug. Cross-linked from Q224's note. --- docs/STATUS.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index f92a9ac72..2df154f45 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -52,7 +52,9 @@ Specific actionable items in priority order. Pick from the top; skip 🚫 items | ID | Item | Labels | St | Sz | Notes | |---|---|---|---|---|---| -| Q224 | [GKE dogfood: route production CI (green CI blocked)](plan/gke-dogfood.md) | `milestone` `infra` | 🔲 | M | rc.4 turn-on validated; toolchain unblocked (Q239). Egress blocker for vendor-check/tidy-check resolved: Athens in-cluster cache deployed (Q244). Run `scripts/dogfood-start.sh` + validate CI green end-to-end. On-demand. | +| Q224 | [GKE dogfood: route production CI (green CI blocked)](plan/gke-dogfood.md) | `milestone` `infra` | 🔲 | M | rc.4 turn-on validated; toolchain unblocked (Q239). Egress blocker for vendor-check/tidy-check resolved: Athens in-cluster cache deployed (Q244). Run `scripts/dogfood-start.sh` + validate green CI; blockers [Q246](#Q246)/[Q247](#Q247). On-demand. | +| Q246 | [Worker egress to GitHub release CDN (objects.githubusercontent.com)](plan/q242-g1-proxy-destination-allowlist.md) | `security` `infra` | 🔲 | S | GAG workers (direct egress) can't reach `objects.githubusercontent.com` (GitHub release-asset CDN); `shellcheck`/`coverage` downloads time out, failing CI. Add the CDN to the egress allowlist (G.1, [Q242](#Q242)). Blocks green CI ([Q224](#Q224)). | +| Q247 | [AGC runner session recovery after job recycling](plan/gke-dogfood.md) | `infra` | 🔲 | M | Q244 dogfood CI: runners intermittently stuck at 1 active broker session after job recycling, stranding queued jobs. Co-occurred with system-node CPU exhaustion; reproduce in isolation before calling it an AGC bug. Blocks [Q224](#Q224). | | Q242 | [Implement G.1 proxy destination allowlist](plan/q242-g1-proxy-destination-allowlist.md) | `security` `infra` | ▶ | L | Impl merged #460–#464. Dogfood vendor-check/tidy-check unblocked via Athens (Q244). Remaining: flip `GAG_RUNNER`, validate green CI ([Q224](#Q224)); FQDN intent/backend split ([Q245](#Q245)). v2beta1 blocker. | | Q243 | [Per-tenant egress-IP reference architecture (cloud)](plan/gke-dogfood.md) | `security` `infra` `docs` | 🔲 | L | Substantiate the per-tenant egress-IP isolation claim: spike + validate Cilium Egress Gateway vs per-tenant NAT on a cloud; doc single-tenant-direct vs production topology + cost. Dogfood stays direct (single-tenant). v2beta1 blocker. | | Q245 | [FQDN egress: split intent from CNI backend + GKE backend](plan/q242-g1-proxy-destination-allowlist.md#provider-fqdn-egress-fragmentation-post-implementation-finding) | `security` `infra` | 🔲 | L | egressPolicyMode FQDN variants encode a per-CNI kind, fragmented across GKE/AKS/EKS/OVN. Decouple tenant intent (CIDR\|FQDN) from a platform --fqdn-policy-backend; add gke backend (networking.gke.io FQDNNetworkPolicy). Fold into v2beta1 (Q74). |