chore: promote staging to main (ops pod removal, agentcore-demo observability, docs refresh) - #66
Merged
Merged
Conversation
…ops pod - drop the ops pod, its manifest and the doctor ops rows: no command installed it and no caller used the long-lived exec path - awsbnkctl-test is created on first use, in phase 12, and by the new bnk heal test-namespace repair (doctor row from the same detection) - wire the k8s backend client initialiser (SetK8sInit was never called, so --backend k8s failed before creating a Job) - pin the Job UID to 1000 (public images without USER failed RunAsNonRoot), delete Jobs whose pod never starts, surface the backend error in throughput and dns failures - commands return an exit-code error instead of calling os.Exit so the deferred fixture teardown runs; cobra no longer prints errors twice Verified on bnk-singapore-pe (2.3.2) and bnk-agentcore-demo (2.4.0): bnk heal FIXED test-namespace, doctor rows green, test throughput --backend k8s pass on both. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
feat(heal): test-namespace repair; k8s backend runs Jobs without the ops pod
…ability (#63) ## Summary This PR brings full parity between `bnk-agentcore-demo` (AWS) and `bnk-agentfoundry-demo` (Azure) in Forge LLM Observability, ensuring continuous traffic generation and repeatable execution every time. ### Key Changes 1. **Continuous Dual-Leg Traffic Generator** (`traffic-generator-deployment.yaml`): - Deploys an in-cluster generator simulating live Bedrock reasoning calls (Leg A) and BNK VIP MCP tool calls (Leg B). - Generates 200 OK tool calls, 403 Forbidden unauthorized sensitive tool calls, 200 OK discovery requests, and 401 unauthenticated requests. 2. **Dual-Leg Token Shipper** (`mcp-bedrock-token-shipper.yaml`): - Adds an HTTP receiver on port `:9090` with internal Kubernetes service (`bedrock-token-shipper.llm-egress.svc.cluster.local`) to calculate pricing and push model reasoning metrics to Loki. - Retains background CloudWatch log polling for accounts with AWS Bedrock model invocation logging enabled. 3. **iRule Rate Limiter Robustness** (`mcp-security-policy.yaml`): - Replaced fragile `table incr` with minute-bucketed keys (`"${gov_key}:${cur_window}"`) using `table lookup` / `table set` to eliminate BIG-IP TMM type error faults. - Enhanced JSON parsing in HTTP payload inspections to support spaces after property keys. 4. **Out-of-the-Box Demo Runner Reliability** (`setup-agentcore-network.sh`, `teardown-agentcore-network.sh`, `demo.sh`): - Automatically ensures `AmazonSSMManagedInstanceCore` is attached to the jumphost IAM role so `demo.sh` executes via SSM without manual intervention. - Switched Act 5 TLS validation in `demo.sh` to use `AGENT_TOKEN` to prevent false 429 failures caused by Act 4's intentional rate-limit exhaustion. 5. **Rebuild & Documentation Updates** (`rebuild.sh`, `README.md`): - Integrated `traffic-generator-deployment.yaml` directly into `rebuild.sh` step 7 and updated README documentation. ### Verification - [x] Pre-commit quality gates (`gofmt`, `go vet`, `go test -race ./internal/... ./cmd/...`) passed 100%. - [x] Verified live in Forge: `http://localhost:8000/api/k8s/clusters/18/llm-observability/` displays active Anthropic usage curves, token counts, cost calculations, and model rankings matching `bnk-agentfoundry-demo`. - [x] Verified `demo.sh --quick` successfully executes all acts with zero failures. --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
## What Three audits of the documentation against the code, applied. - **Counts and names.** 41 phases everywhere (39 was pre metrics-server and tmm-log-stream). PHASES.md now lists the `up` flags, the down order including `metrics-server`, the phases with no down step, and describes `preflight`, `forge-register`, `ebs-csi-hugepages`, `k8s-foundation` and `activation-poll` as the code behaves (9-minute poll cap, no EULA check, no gp3 StorageClass). - **Heal registry.** README, COMMANDS, AGENTS, CLAUDE, CONTRIBUTING and ARCHITECTURE describe `bnk heal` (10 repairs after #64), the `doctor --backend k8s` rows it feeds, and the `awsbnkctl-test` namespace `test --backend k8s` Jobs run in. CONTRIBUTING gains "Adding a Heal Repair" and the missing CI jobs and `gosec` gate. - **Commands.** COMMANDS.md and AGENTS.md carry the subcommands and flags that were missing (`bnk heal/upgrade/migrate-2.4/mcp-session` flags, `forge scan/telemetry`, `benchmark ingest`, `targets scan`, `test dns/throughput/traffic` flags). `AWSBNKCTL_K8S_LONG_LIVED` removed. - **RELEASE.md** rewritten: staging→main, squash titles for release-please, `workflow_dispatch` rebuild, `make release` gates, and the tools images that are actually published. - **FORGE_INTEGRATION, UPGRADE-2.4, SCENARIOS, BGP-ROUTE-SERVER.** Env-variable precedence, the `AWSBNKCTL_FORGE_PROJECT` purge caveat, link lifecycle commands, the full `-o json` field list, scenario assertions stated as the code makes them, no dated lab provenance. - **Removed or reduced.** `docs/ALIGNMENT.md` deleted (unreferenced cross-repo comparison). The Local Zones report is now a results table. The upstream issue has a status line. - **Code help text.** `--skip-activation-poll` says 9 min, `test throughput` no longer says "not yet implemented", `k_aliases.go` comment no longer claims a host-side `exec` command. Depends on #64 for the tenth repair (`test-namespace`); merge #64 first. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes staging to main. Contains:
feat(heal): the never-installed ops pod and its doctor rows are gone;awsbnkctl-testis created on first use, in phase 12 and by the newbnk healrepairtest-namespace(ten repairs); the k8s execution backend is wired (--backend k8snever worked), Job pods run as UID 1000, Jobs whose pod never starts are deleted, exit-code error instead ofos.Exit, cobra no longer prints errors twice.feat(agentcore-demo): continuous traffic generator and dual-leg token shipper, with synthetic records labelledsource=synthetic, the CloudWatch leg repaired, the VIP rendered from the live Gateway, and the shipper role's trust refreshed to the live OIDC provider.docs: guides refreshed against the code (41 phases, heal registry, missing flags, RELEASE.md rewritten, scenario assertions as coded).Release-please will cut the next 2.x release from this merge.
🤖 Generated with Claude Code