feat(agent): gate netprobe lifecycle on its AddonAssignment (#3425) #3483

Merged

mfreeman451 merged 2 commits from feat/netprobe-assignment-cutover into staging

2026-06-01 02:59:39 +00:00

mfreeman451 commented

2026-06-01 02:41:19 +00:00

Owner

Summary

migrate-netprobe-to-native-addon §2.2 cutover. Moves netprobe off the always-on agent-launched visibility path onto the systemd-service add-on lifecycle, gated on its AddonAssignment — building on the attach mode from #3482.

Routing (`push_loop_config.go`)

applyVisibilityConfig now takes systemdManaged bool, derived from netprobeSystemdAssignmentPresent(configResp.GetAddons()) (an enabled netprobe systemd_service assignment):

systemd-managed → applyVisibilityConfigSystemd: switches the supervisor to attach mode (Mode()-gated Stop+StartAttach, so a previously agent-launched netprobe is stopped before systemd owns the socket — no double-run) and hands the config to the sidecar. It always returns true so the apply never aborts before applyAddonAssignments installs the unit later in the same cycle (a synchronous failing ApplyConfig there would deadlock the cutover).
not assigned → applyVisibilityConfigLaunched: the original launch path, byte-for-byte for un-assigned fleets (zero regression), plus a Stop + SetDesiredConfig(nil) revert if coming from attach.

Apply-on-connect (`netprobe/sidecar.go`)

SetDesiredConfig stores the latest VisibilityConfig (atomic) and asynchronously pushDesired (serialized via applyMu, last-write-wins); setClient re-triggers it on every (re)connect. So a systemd-managed netprobe gets its full config over IPC — including device bindings, which the bootstrap file does not carry — on startup and after any restart, independent of the gateway poll cadence and the NotModified short-circuit. The push primitive is injectable (applyFn) for tests.

sidecarLifecycleManager gained Mode() + StartAttach(); the netprobe sidecar takes a Logger.

Why this is safe to land now

The cutover is inert until the control plane seeds a netprobe AddonAssignment (§3.1) — with no assignment, every fleet stays on the unchanged launch path.

Validation

go test -race green: routing → attach + revert → stop (TestApplyVisibilityConfigRoutesNetprobeBySupervision), assignment-detection table (TestNetprobeSystemdAssignmentPresent), apply-on-connect applies + nil-clears (TestSidecarSetDesiredConfigApplies). These run in CI via go test ./... (tests-golang.yml).
golangci-lint run clean; agent packages build.
An adversarial multi-agent review of the diff confirmed the routing/handoff and apply-on-connect (latest-wins, no data race) are correct — 0 confirmed defects of 8 candidates.

Next (§2.2 remainder + beyond)

The local-override/cache fallback across an agent restart while the control plane is unreachable (in-memory desiredConfig is lost on agent restart; relies on the agent's cached-config replay — verify in §4.x).
§2.3 status, §2.4 rollback.
§4.3 scratch-Linux-agent e2e is the full-flow gate (systemd installs+starts netprobe → agent attaches → config pushed → events ingested → restart re-applies); bundles can't build/run on darwin.

🤖 Generated with Claude Code

## Summary `migrate-netprobe-to-native-addon` §2.2 **cutover**. Moves netprobe off the always-on agent-launched visibility path onto the **systemd-service add-on lifecycle, gated on its `AddonAssignment`** — building on the attach mode from #3482. ## Routing (`push_loop_config.go`) `applyVisibilityConfig` now takes `systemdManaged bool`, derived from `netprobeSystemdAssignmentPresent(configResp.GetAddons())` (an **enabled netprobe `systemd_service` assignment**): - **systemd-managed → `applyVisibilityConfigSystemd`**: switches the supervisor to **attach mode** (`Mode()`-gated `Stop`+`StartAttach`, so a previously agent-launched netprobe is stopped before systemd owns the socket — **no double-run**) and hands the config to the sidecar. It **always returns `true`** so the apply never aborts before `applyAddonAssignments` installs the unit later in the same cycle (a synchronous failing `ApplyConfig` there would deadlock the cutover). - **not assigned → `applyVisibilityConfigLaunched`**: the original launch path, **byte-for-byte for un-assigned fleets (zero regression)**, plus a `Stop` + `SetDesiredConfig(nil)` revert if coming from attach. ## Apply-on-connect (`netprobe/sidecar.go`) `SetDesiredConfig` stores the latest `VisibilityConfig` (atomic) and asynchronously `pushDesired` (serialized via `applyMu`, **last-write-wins**); `setClient` re-triggers it on every **(re)connect**. So a systemd-managed netprobe gets its **full config over IPC — including device bindings, which the bootstrap file does not carry** — on startup and after any restart, independent of the gateway poll cadence and the `NotModified` short-circuit. The push primitive is injectable (`applyFn`) for tests. `sidecarLifecycleManager` gained `Mode()` + `StartAttach()`; the netprobe sidecar takes a `Logger`. ## Why this is safe to land now The cutover is **inert until the control plane seeds a netprobe `AddonAssignment` (§3.1)** — with no assignment, every fleet stays on the unchanged launch path. ## Validation - `go test -race` green: routing → attach + revert → stop (`TestApplyVisibilityConfigRoutesNetprobeBySupervision`), assignment-detection table (`TestNetprobeSystemdAssignmentPresent`), apply-on-connect applies + nil-clears (`TestSidecarSetDesiredConfigApplies`). These run in CI via `go test ./...` (tests-golang.yml). - `golangci-lint run` clean; agent packages build. - An **adversarial multi-agent review** of the diff confirmed the routing/handoff and apply-on-connect (latest-wins, no data race) are correct — **0 confirmed defects** of 8 candidates. ## Next (§2.2 remainder + beyond) - The local-override/cache fallback across an **agent** restart while the control plane is unreachable (in-memory `desiredConfig` is lost on agent restart; relies on the agent's cached-config replay — verify in §4.x). - §2.3 status, §2.4 rollback. - **§4.3 scratch-Linux-agent e2e** is the full-flow gate (systemd installs+starts netprobe → agent attaches → config pushed → events ingested → restart re-applies); bundles can't build/run on darwin. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Rows
Columns