📈 GPU Metrics - #5066
Draft
tessaSlice wants to merge 41 commits into
Draft
Conversation
When a task uses environmentFiles, the agent joins the S3 bucket and object key from the task definition onto the per-task envfile resource directory and then creates directories, writes, and reads files at that path. The key was used without input validation, so a key containing relative path segments could resolve to a location outside the resource directory. Validate the bucket/key with filepath.IsLocal before joining it onto the resource directory, in both the download and read paths and before MkdirAll. Keys that would resolve outside the resource directory are rejected and fail the envfile resource transition; legitimate nested keys are unaffected.
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
The test-init Makefile target was using a hardcoded `go test` instead of
the ${GOTEST} variable which includes -race on non-ARM platforms. This
meant data races in ecs-init code (e.g., volume plugin concurrency bugs)
went undetected in CI.
Bumps [github.com/container-storage-interface/spec](https://github.com/container-storage-interface/spec) from 1.9.0 to 1.12.0. - [Release notes](https://github.com/container-storage-interface/spec/releases) - [Commits](container-storage-interface/spec@v1.9.0...v1.12.0) --- updated-dependencies: - dependency-name: github.com/container-storage-interface/spec dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#5013) Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.32 to 1.7.33. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v1.7.32...v1.7.33) --- updated-dependencies: - dependency-name: github.com/containerd/containerd dependency-version: 1.7.33 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…nit (#5014) Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.32 to 1.7.33. - [Release notes](https://github.com/containerd/containerd/releases) - [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md) - [Commits](containerd/containerd@v1.7.32...v1.7.33) --- updated-dependencies: - dependency-name: github.com/containerd/containerd dependency-version: 1.7.33 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
FIS network faults impair traffic between ECS tasks and domain-named
services. Before this change, the FIS resolves domains to IPs once at
fault start and hands them to the ECS Agent, which installs tc rules
against that fixed set and never revisits it. The fault is incomplete
for ALB, API Gateway, SQS, and third-party domains:
DNS resolvers do not always return all IPs per lookup, and DNS records
rotate the IPs during the test.
Add POST /fault/v1/{network-latency|network-packet-loss}/add-sources,
which installs additional tc filters against a running fault without
restarting it. Cap the combined IP count at 16 to keep calls inside
the shared 5s requestTimeoutSeconds budget.
Add 18 //go:build linux && sudo tests for the add-sources endpoint to handlers_sudo_integ_test.go. Tests issue real tc commands against the host's default network interface and require root. Run them with `make run-sudo-tests`. Reuse the file's existing startServer, cleanupLatencyAndPacketLossFaults, and skipForUnsupportedTc helpers. Add an addSourcesEndpoint URL format and two new routes in startServer for AddSourcesNetworkLatency and AddSourcesNetworkPacketLoss. Coverage: - Happy path on latency and packet loss, with Sources, SourcesToFilter, and CIDR inputs - 404 on no fault running, wrong fault type, and after stop - 400 on empty body, over cap, within-request overlap, invalid IP, malformed JSON, and missing body; 200 at the cap boundary - Duplicate IPs across requests, add concurrent with stop, two adds concurrent - Qdisc parameters unchanged after add-sources - Stop after add returns qdisc state to baseline
Address PR #4971 review feedback. The add-sources endpoint accepts any caller, not just the FIS SSM script, so the surrounding comments and the not-running error messages should not name a specific client. Drop "FIS SSM script" / "SSM script" references from: - the add-sources route registration block in task_server_setup.go - the 404 inline comment and the no-rollback retry comment in addSourcesHandler - the AddSourcesNetworkLatency godoc Reword the latency/packet-loss not-running error strings to drop "on the task's network namespace": host-mode tasks do not have a dedicated network namespace, so the phrasing was wrong for that case. Rewrite the no-rollback retry comment to match observed behavior: `tc filter add` accepts duplicate u32 matches without error, so retries are safe; duplicates are reaped when the qdisc is torn down on stop. The previous "idempotent enough" / "fails silently" wording was wrong. Mirror the ecs-agent edits into agent/vendor/ to keep the vendored copy in sync.
Release v1.105.1
Fault update sources
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.48.0 to 0.55.0. - [Commits](golang/net@v0.48.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…agent ebpf is an indirect dependency pulled in via containerd/cgroups/v3/cgroup2. Updates the module requirements and regenerates vendor/ accordingly. Signed-off-by: Amaan Ul Haq Siddiqui <amaanulhaq.s@outlook.com>
Bumps [github.com/hectane/go-acl](https://github.com/hectane/go-acl) from 0.0.0-20190604041725-da78bae5fc95 to 1.0.0. - [Commits](https://github.com/hectane/go-acl/commits/v1.0.0) --- updated-dependencies: - dependency-name: github.com/hectane/go-acl dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.19.22 to 1.19.28. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@credentials/v1.19.22...credentials/v1.19.28) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.19.28 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…s-agent, /agent and /ecs-init (#5037)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…nd /ecs-init to 1.19.29 (#5050)
Bumps [github.com/aws/smithy-go](https://github.com/aws/smithy-go) from 1.27.3 to 1.27.4. - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.27.3...v1.27.4) --- updated-dependencies: - dependency-name: github.com/aws/smithy-go dependency-version: 1.27.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
The isolated platform provisions guest DNS solely from the interface model, so a payload without DNS servers left the guest with no nameservers. Move the host resolv.conf backfill from the debug variant to the base isolated platform.
Release 1.106.0
Upstream removed 4 us-iso/us-isob-east-1 UseDualStack=true endpoint test cases; current smithy rejects them (RuleSetTestCase: Expected StringType), breaking make gogenerate-aws-sdk. Drop them to align with upstream (53->49 tests) and unblock unpinned codegen. Test-only, no SDK behavior change.
Bumps [github.com/gorilla/mux](https://github.com/gorilla/mux) from 1.8.0 to 1.8.1. - [Release notes](https://github.com/gorilla/mux/releases) - [Commits](gorilla/mux@v1.8.0...v1.8.1) --- updated-dependencies: - dependency-name: github.com/gorilla/mux dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
ecs-init discovers per-GPU usable memory via NVML and the agent reports it in the PlatformDevice.gpuInfo field so the control plane can place GPU instances by available memory.
…nimages/csidriver (#5056) * Bump google.golang.org/grpc in /ecs-agent/daemonimages/csidriver Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.3...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * update /agent vendor --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: mye956 <michaelye956@gmail.com>
tessaSlice
marked this pull request as ready for review
July 27, 2026 23:54
tessaSlice
marked this pull request as draft
July 27, 2026 23:57
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.32.23 to 1.32.31. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.32.23...config/v1.32.31) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.32.31 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
The isolated platform pre-installs a permanent ARP entry for the subnet gateway in the task netns. IPv6-only interfaces have no IPv4 gateway to pre-resolve, even when the payload carries a subnet gateway IPv4 address; the guest resolves its IPv6 gateway via NDP, which the TAP egress filters permit. Installing the IPv4 neighbor entry on such ENIs is at best a no-op and at worst pins a gateway from a foreign subnet.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merge dev into feature/gpu-metrics.
Implementation details
Testing
New tests cover the changes: N/A
Description for the changelog
Housekeeping - Merge dev into feature/gpu-metrics
Additional Information
Does this PR include breaking model changes? If so, Have you added transformation functions?
No
Does this PR include the addition of new environment variables in the README?
No
Licensing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.