[privateip]

galactic-cni and fabric-config-agent log JSON at info by default, like the binaries #1155 moved. Both take --log-level and --log-format, or LOG_LEVEL and LOG_FORMAT, to change that.

The manifest log-settings check from #1168 now covers both. fabric-config-agent runs from the fabric-router image, so the check also matches a container by the binary its command runs.

A bad flag still prints Go's default text, because it fails before the logger exists.

Fixes #1165

Test plan

• Both binaries log JSON at info by default
• --log-format text gives text
• Unit tests, task test:manifests and Kind e2e pass
• In the lab, every line from both pods is JSON, and LOG_LEVEL=debug adds debug lines

[privateip]

Both reviewers returned merge on f32dbad, the head before the fix phase.

• pr-adversary: "VERDICT: merge. I found no correctness problems. The cited runs reproduce, and the new test passes at the head. (Diffed against ea783e8, the head's parent, because base 12cb7f5 was not in the local object store.)"
• pr-conventions-reviewer: "VERDICT: merge. No blockers. The change reaches no deploy path and ships only with the next galactic image release."

What was checked: pr-adversary reproduced the cited runs and ran the new test at the head. The conventions review covered the body, the commit conventions, and the test comment, against the parent ea783e8.

Applied: the PR body now opens with a three-sentence summary, with the file list removed, and carries a four-item test plan with the lab item unchecked. The unmanagedBinaries comment no longer makes an unchecked claim about the CNI plugins' log files, in 0cc1ca6.

CI: 21 checks passed on 0cc1ca6, including E2E Tests. publish-service-api skipped under its own condition.

Open #1168 touches the same two files. A trial merge-tree of this branch onto #1168's head and onto origin/main is clean both ways, and #1168's checker keeps no list of binaries, so either PR can land first.

Auto-merge uses the merge method, because main allows only merge. The main ruleset requires one approval, code owner review, and a fresh approval after the last push, so the PR waits for a human approval before it lands. The repository names no human reviewer, so the code owners team networking was requested when the PR went ready.

[ecv]

Request changes.

The branch predates #1168, and on current main this PR fails TestBinariesListsEveryCaller. Merged onto main (06950df), go test ./internal/logging/ reports commands importing internal/logging = [... fabric-config-agent ... galactic-cni ...] against Binaries without those two. CI is green only because it ran on the old base.

• internal/logging/logging.go: add fabric-config-agent and galactic-cni to Binaries. The list is what hack/check-log-settings uses to find containers whose LOG_LEVEL/LOG_FORMAT/--log-level/--log-format values it validates, so without them a bad value in the galactic-cni or fabric-config-agent manifests would still crash-loop the init container or sidecar at startup without failing CI. Both images are published under those names, so the image-repository match works. Rebase onto main first.
• No log line reaches a CNI plugin's stdout: galactic-cni is the installer and daemon, not a plugin invoked per CNI call, and internal/logging writes to os.Stderr. The only fmt.Print* calls are --build-info and --version.
• The log.Fatalf replacement is equivalent: it logs one JSON error line, then os.Exit(1). SilenceErrors stops cobra printing a second copy, and SilenceUsage is kept.

[privateip]

@ecv thanks, addressed in 035084c after rebasing onto main.

• Rebased, both binaries added to Binaries. TestBinariesListsEveryCaller passes.
• fabric-config-agent has no image of its own. It ships in the fabric-router image, runs as the config-agent container's command, and runs as exec fabric-config-agent init in frr-init's shell script. Adding the name to Binaries alone would never match either container, so a bad LOG_LEVEL there would still pass CI. check-log-settings now also treats a container as Galactic when a word of its command is a listed binary. A new TestCheck case covers frr-init, config-agent and the untouched frr container, and TestRunsGalactic covers the matcher.
• galactic-cni matches by image name, as you said. The TestIsGalactic row that used it as a negative example now uses galactic-usid.
• The Binaries comment and the logging doc say a container can match by command.

task test:manifests, task test:unit and golangci-lint pass on the new head.

[ecv]

Approve.

The hold is resolved. The branch is rebased onto main after #1168, and Binaries now lists fabric-config-agent and galactic-cni, so TestBinariesListsEveryCaller matches on the merge and the manifest check covers both binaries' LOG_LEVEL, LOG_FORMAT and flags.

• hack/check-log-settings and its test change with the list, so the check knows both images.
• The rest of the PR is as reviewed before: logs go to stderr, and the replaced log.Fatalf still prints its error and exits 1.