ROX-33555: Wire VM relay ACK flow with rate limiting and UMH#19321
Draft
vikin91 wants to merge 1 commit intopiotr/ROX-32316-umh-node-ackfrom
Draft
ROX-33555: Wire VM relay ACK flow with rate limiting and UMH#19321vikin91 wants to merge 1 commit intopiotr/ROX-32316-umh-node-ackfrom
vikin91 wants to merge 1 commit intopiotr/ROX-32316-umh-node-ackfrom
Conversation
Contributor
Author
|
This change is part of the following stack: Change managed by git-spice. |
|
Skipping CI for Draft Pull Request. |
11 tasks
Contributor
|
Images are ready for the commit at 283b771. To use with deploy scripts, first |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## piotr/ROX-32316-umh-node-ack #19321 +/- ##
================================================================
- Coverage 49.68% 49.62% -0.07%
================================================================
Files 2695 2696 +1
Lines 202798 203349 +551
================================================================
+ Hits 100757 100908 +151
- Misses 94527 94921 +394
- Partials 7514 7520 +6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
vikin91
force-pushed
the
piotr/ROX-32316-vm-relay-ack-flow
branch
from
63a45ce to
0ad5d24
Compare
This was referenced Mar 6, 2026
vikin91
changed the title
11 tasks
vikin91
force-pushed
the
piotr/ROX-32316-umh-node-ack
branch
from
7faf2a3 to
d136021
Compare
vikin91
force-pushed
the
piotr/ROX-32316-vm-relay-ack-flow
branch
from
0ad5d24 to
c795476
Compare
vikin91
changed the title
vikin91
force-pushed
the
piotr/ROX-32316-umh-node-ack
branch
from
d136021 to
0ea378c
Compare
vikin91
force-pushed
the
piotr/ROX-32316-vm-relay-ack-flow
branch
from
c795476 to
cbee5a2
Compare
vikin91
force-pushed
the
piotr/ROX-32316-umh-node-ack
branch
from
0ea378c to
d3322c9
Compare
vikin91
force-pushed
the
piotr/ROX-32316-umh-node-ack
branch
from
d3322c9 to
0085a80
Compare
vikin91
force-pushed
the
piotr/ROX-32316-vm-relay-ack-flow
branch
from
cbee5a2 to
283b771
Compare
vikin91
force-pushed
the
piotr/ROX-32316-umh-node-ack
branch
from
6492540 to
950ed7c
Compare
Integrates the VM relay with the per-resource UMH from the previous commit. The relay now rate-limits reports per VSOCK ID (leaky bucket), tracks ACK metadata for stale-ACK detection, and delegates retry responsibility to UMH instead of retrying inline in the sender. The sender is simplified to a single-attempt send. Adds handleVMIndexACK in compliance to forward ComplianceACK messages to the VM relay's UMH. Also fixes type mismatch in relay where handleIncomingReport passed *IndexReport to sender.Send() which expects *VMReport. AI-assisted: code was extracted from the feature branch by AI, with bug fixes applied during the split. Reviewed and verified by the author.
vikin91
force-pushed
the
piotr/ROX-32316-vm-relay-ack-flow
branch
from
283b771 to
a9270b7
Compare
Contributor
🚀 Build Images ReadyImages are ready for commit a9270b7. To use with deploy scripts: export MAIN_IMAGE_TAG=4.11.x-612-ga9270b7b6e |
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Integrates the VM relay with the per-resource UMH (from the parent PR) and replaces the sender's
inline retry loop with a single-attempt send. Retry responsibility now lives in the UMH, which
tracks ACK state per VSOCK ID.
What changed:
compliance/virtualmachines/relay/relay.go): Added per-VSOCK rate limiting (leakybucket via
golang.org/x/time/rate), UMH integration (ObserveSending/OnACK), and a metadatacache that tracks
updatedAt/lastAckedAtper VM for stale-ACK detection. Reports that exceedthe rate limit are dropped with a metric — the agent will resubmit on its own schedule.
index_report_sender.go): Removed the 10-retryretry.WithRetryloop andisRetryableGRPCErrorhelper. The sender now makes a single gRPC call; failures are reportedback so the UMH can schedule a retry at the appropriate backoff interval. Added per-attempt
latency and result metrics.
compliance.go): AddedumhVMIndexfield dhandleVMIndexACKto forwardComplianceACKmessages forVM_INDEX_REPORTto the relay's UMH. The VM relay startup now readsROX_VM_RELAY_MAX_REPORTS_PER_MINUTEandROX_VM_RELAY_STALE_ACK_THRESHOLDfrom env.relay/metrics/metrics.go): New counters/histograms for send attempts, rate limiting,and ACKs received.
pkg/env/virtualmachine.go):ROX_VM_RELAY_MAX_REPORTS_PER_MINUTE(default1.0)and
ROX_VM_RELAY_STALE_ACK_THRESHOLD(default4h).Bug fix during split: The feature branch passed
*v1.IndexReporttosender.Send()whichexpects
*v1.VMReport. FixedhandleIncomingReportto carry the fullVMReportthrough.Depends on:
piotr/ROX-32316-umh-node-ack(UMH per-resource refactor).AI-assisted: code was extracted and adapted from a larger feature branch by AI,
with a type mismatch bug fix applied during the split. Reviewed and verified by the author.
User-facing documentation
Testing and quality
Automated testing
How I validated my change