From 488fb5160ae2a364da130a110b19041cbc64d411 Mon Sep 17 00:00:00 2001 From: dawn Date: Wed, 2 Sep 2026 21:53:07 +0900 Subject: [PATCH] spindle/engines/microvm: constrain host cache checks to operator upstreams Signed-off-by: dawn --- spindle/engines/microvm/engine.go | 2 +- spindle/engines/microvm/read_cache_proxy.go | 10 ++++++++++ spindle/engines/microvm/upload_cache_http.go | 1 + spindle/engines/microvm/upload_cache_proxy.go | 2 +- 4 files changed, 13 insertions(+), 2 deletions(-) diff --git a/spindle/engines/microvm/engine.go b/spindle/engines/microvm/engine.go index 37755181..9c599a3e 100644 --- a/spindle/engines/microvm/engine.go +++ b/spindle/engines/microvm/engine.go @@ -709,7 +709,7 @@ func (e *Engine) activateConfig(ctx context.Context, wid models.WorkflowId, stat } func (e *Engine) anyCacheHasPath(ctx context.Context, state *workflowState, storePath string) bool { - upstreams, err := BuildCacheUpstreams(e.cfg.NixCache.ReadURLs, state.CacheReadURLs) + upstreams, err := BuildCacheUpstreams(e.cfg.NixCache.ReadURLs, nil) if err != nil { e.l.Warn("config cache check: build upstreams failed; treating as absent", "path", storePath, "error", err) return false diff --git a/spindle/engines/microvm/read_cache_proxy.go b/spindle/engines/microvm/read_cache_proxy.go index a1bf7620..cb0b3e3f 100644 --- a/spindle/engines/microvm/read_cache_proxy.go +++ b/spindle/engines/microvm/read_cache_proxy.go @@ -192,6 +192,16 @@ func mergeCacheUpstreams(trusted, guarded []*url.URL) []CacheUpstream { return merged } +func operatorCacheUpstreams(upstreams []CacheUpstream) []CacheUpstream { + trusted := make([]CacheUpstream, 0, len(upstreams)) + for _, upstream := range upstreams { + if !upstream.guarded { + trusted = append(trusted, upstream) + } + } + return trusted +} + func listenRandomVsockPort(ctx context.Context) (*vsock.Listener, uint32, error) { var lastErr error for range 32 { diff --git a/spindle/engines/microvm/upload_cache_http.go b/spindle/engines/microvm/upload_cache_http.go index a622d103..0aece347 100644 --- a/spindle/engines/microvm/upload_cache_http.go +++ b/spindle/engines/microvm/upload_cache_http.go @@ -65,6 +65,7 @@ func (b *httpUploadBackend) ServeHTTP(w http.ResponseWriter, r *http.Request) { func (b *httpUploadBackend) Close() error { return nil } func uploadProxyHandler(target *url.URL, readUpstreams []CacheUpstream, logger *slog.Logger) http.Handler { + readUpstreams = operatorCacheUpstreams(readUpstreams) rp := httputil.NewSingleHostReverseProxy(target) rp.ErrorLog = slog.NewLogLogger(logger.Handler(), slog.LevelError) diff --git a/spindle/engines/microvm/upload_cache_proxy.go b/spindle/engines/microvm/upload_cache_proxy.go index 961fad52..cad543d5 100644 --- a/spindle/engines/microvm/upload_cache_proxy.go +++ b/spindle/engines/microvm/upload_cache_proxy.go @@ -55,7 +55,7 @@ func StartUploadCacheProxy(ctx context.Context, cid uint32, uploadURL string, re } logger = logger.With("where", "upload_cache_proxy", "cid", cid, "uploadURL", uploadURL) - backend, err := newUploadCacheBackend(uploadURL, readUpstreams, stagingDir, logger, opts.TrustedPublicKeys...) + backend, err := newUploadCacheBackend(uploadURL, operatorCacheUpstreams(readUpstreams), stagingDir, logger, opts.TrustedPublicKeys...) if err != nil { return nil, err } -- 2.51.2