Repository navigation
feat(service): Take origins and value patterns from the run - #12
Merged
Merged
Conversation
sentry-junior Bot
added a commit
to getsentry/junior
that referenced
this pull request
Oct 16, 2026
A new origin or value pattern now needs only a change to recording-rules.ts. getsentry/roach#12 removes the copies in roach.tfvars. Co-Authored-By: David Cramer <david@sentry.io>
A run now sends its own `allow` origins and value patterns, and the service config no longer has them. A tenant that calls a new origin or uses a new pattern changes only its own config: no Roach PR, no Terraform apply, and no VM restart. Two checks replace the fixed lists, so one run cannot harm the others: - The proxy sends requests only to public addresses. It checks the address of each connection after DNS, so neither an IP address nor a host name can point a run at the metadata server or the VPC. `privateNetworks` turns this off for tests. - Value patterns have a time limit, enforced with the `vm` timeout: 1 s to compile when the run starts, and 1 s plus 0.5 s per MiB of body for the key of each request. A slow pattern fails only its own run or request with HTTP 400. The certificate authority keeps at most 1000 host certificates and deletes its temporary files, because runs now name their own hosts. `allow` is now required in a run config. Co-Authored-By: David Cramer <david@sentry.io>
sentry-junior
Bot
force-pushed
the
feat/client-run-config
branch
from
October 16, 2026 01:02
4b27f78 to
8e5ab57
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Each run now sends its own
alloworigins and value patterns, so they leave the service config. Before, a new origin or pattern for a tenant needed a Roach PR, aroach.tfvarschange, a Terraform apply, and a VM reset. After this change,recording-rules.tsin Junior is the only copy.The fixed lists kept clients from doing harm. Two checks now do that job:
src/addresses.ts). The proxy refuses an upstream that is loopback, private, link-local (the metadata server), or another address that is not public. It checks the address that the connection uses, after DNS, so a host name cannot pass the check and then connect to a private address.privateNetworksturns the check off for tests.src/values.ts), with thevmtimeout: 1 s to compile all patterns when the run starts, and 1 s plus 0.5 s per MiB of body for the key of each request. A slow pattern fails only its own run or request with HTTP 400.A run can have at most 32 origins, 64 rules, 32 values per rule, and 2048 characters per pattern. The CA keeps at most 1000 host certificates and deletes its temporary files, because runs now choose their hosts.
Runs without the token still can only replay. Mismatched config from such a run only causes misses.
Breaking:
allowis now required inRunConfig. Junior already sends it. The service ignores the oldallowandvaluePatternsfields of its config, so the image and the Terraform apply can ship in either order.Deploy:
terraform apply -var-file=roach.tfvars, thengcloud compute instances reset roach --zone us-east1-b --project roach-511216.via David Cramer.
--
View Junior Session [Sentry]