fix: restrict supervisor drain to loopback

This commit is contained in:
Josh Creek
2026-08-31 21:49:22 +01:00
parent faede927fc
commit 6253b620a9
4 changed files with 42 additions and 2 deletions
+3 -1
View File
@@ -130,7 +130,9 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md).
- [ ] Benchmark native x86_64 boot, p99 CPU/RSS/network and tick health; set
requests/limits and node density from measurements plus 30% headroom.
- [ ] Add 30 s no-show handling, Go PID-1 TERM/drain supervision, PDB/Fleet
drain, signed result annotation/retry, RPO <=5 m and RTO <=30 m.
drain, signed result annotation/retry, RPO <=5 m and RTO <=30 m. The Go
drain boundary is now authenticated and loopback-only; lifecycle/PDB/Fleet
integration remains.
- [ ] Rehearse migration only after the second provider's EU/NA locations have
Valve approval, POP/certs, public UDP/firewall and coordinator trust.