agent: implement initial preflight check command - #335
Merged
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
hbc (bcho)
changed the title
…into agent-preflight-implementation
hbc (bcho)
marked this pull request as ready for review
June 25, 2026 21:48
Member
Author
|
Latest preflight output from ubuntu2404 -> ubuntu2404 initial join ubuntu2404 -> ubuntu2404 rejoin fedora -> azlinux3 initial join fedora -> azlinux3 rejoin ubuntu2604 -> ubuntu2604 initial join ubuntu2604 -> ubuntu2604 rejoin |
hbc (bcho)
enabled auto-merge (squash)
June 25, 2026 21:51
Jason Wilder (jwilder)
approved these changes
Jun 25, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces an initial “preflight” capability to the agent, providing a reusable framework for running non-mutating host/config checks and exposing them via unbounded-agent preflight, with e2e-kind collecting the resulting reports as artifacts.
Changes:
- Add
pkg/agent/preflightrunner/reporting framework (severity, ignore handling, fail-on-warnings). - Add phase-owned preflight checkers (host, nodestart, rootfs) plus an
unbounded-agent preflightcommand with text/JSON output. - Update agent Kind e2e bootstrap to run preflight and collect text/JSON reports from the VM.
Show a summary per file
| File | Description |
|---|---|
| pkg/agent/preflight/preflight.go | Core preflight runner/report model and helper constructors. |
| pkg/agent/preflight/preflight_test.go | Unit tests for report aggregation, ignore handling, formatting, and concurrency/order. |
| pkg/agent/phases/rootfs/preflight_local.go | Rootfs-local checker for nspawn provisioning paths and machine dir sanity. |
| pkg/agent/phases/rootfs/preflight_local_test.go | Tests for nspawn provisioning path validation behavior. |
| pkg/agent/phases/rootfs/preflight_goal_state.go | Rootfs goal-state validation checker(s) used by preflight. |
| pkg/agent/phases/rootfs/preflight_goal_state_test.go | Tests for rootfs goal-state validation behavior. |
| pkg/agent/phases/nodestart/preflight_api_server.go | Checker validating API server endpoint/credentials and reachability (with redaction). |
| pkg/agent/phases/nodestart/preflight_api_server_test.go | Tests for API server reachability checker behaviors and redaction. |
| pkg/agent/phases/host/preflight_host.go | Host environment check suite (packages, OS config, nspawn runtime, swap, disk, cgroups, etc.). |
| pkg/agent/phases/host/preflight_host_test.go | Tests for host preflight check behaviors via dependency injection. |
| pkg/agent/internal/utilio/fs.go | Add ProbeWritableDir helper used by several checkers. |
| pkg/agent/internal/utilio/fs_test.go | Test ensuring ProbeWritableDir leaves no durable state behind. |
| pkg/agent/config/config.go | Add AgentConfig.Validate() for basic required-field and API server URL validation. |
| pkg/agent/config/config_test.go | Tests for AgentConfig.Validate() expectations. |
| hack/agent/e2e-kind/e2e.py | Run unbounded-agent preflight during bootstrap and collect reports as artifacts. |
| cmd/agent/internal/cmd/preflight.go | Implement unbounded-agent preflight command (text/JSON output, ignore, fail-on-warnings). |
| cmd/agent/internal/cmd/preflight_test.go | Command-level tests for JSON and text output behaviors (including redaction). |
| cmd/agent/internal/cmd/cmd.go | Wire the new preflight subcommand into the agent CLI. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 18/18 changed files
- Comments generated: 2
Comment on lines
+86
to
+92
| var wg sync.WaitGroup | ||
|
|
||
| for i, check := range checks { | ||
| wg.Go(func() { | ||
| checkResults[i] = check.Check(ctx) | ||
| }) | ||
| } |
Comment on lines
+15
to
+18
| const ( | ||
| checkGoalStateName = "goal-state" | ||
| checkOCIImageReachableName = "oci-image-reachable" | ||
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
unbounded-agent preflightwith text/JSON output, ignore handling, and fail-on-warnings support.Implemented checkers
is-privileged-useragent-configcluster-credentialshost-packageshost-os-configurationnspawn-runtimedocker-activeswap-activedisk-spacecgroupsapi-server-reachablegoal-statenspawn-machine-provisioningFollow-up checkers
Download, registry, GPU, and offline policy checks are intentionally left for follow-up PRs:
oci-image-reachablemanifest resolution without pulling layerskubernetes-artifactscri-artifactscni-artifactsgpu-confignvidia-devicesnvidia-driver-librariesnvidia-runtimeoffline-no-upstream-urlsallowed-hostsmirror-reachabilityReferences
Verification
python3 -m py_compile hack/agent/e2e-kind/e2e.pynix-shell -p golangci-lint openssl pkg-config --run 'make test'