novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

nats: the tools run on the process account nats-tools with its own secret, and take the release sdk, so the bus grants them only the four removals (issue 1952 N1-N3)

Browse Source
This commit is contained in:
jschoubben
2026-10-29 21:46:15 +01:00
parent aee377765e
commit f7d821b023
5 changed files with 25 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nats/cmd/nats-tools/bus.go
+1 -1
View File
@@ -12,7 +12,7 @@ import (
// LiveBus is the bus as the module's own credential reaches it. Nothing connects until a tool that changes the
// bus is called, so the tools that read (through the monitoring endpoint) answer as they did with no credential.
// MESH_BROKER_FILE names the credential (the manifest's own secret `broker`); MESH_NATS_SERVER where the bus is as
// MESH_BROKER_FILE names the credential (the process nats-tools's own secret `broker-nats-tools`); MESH_NATS_SERVER where the bus is as
// seen from this machine (default: its own port on loopback).
func LiveBus() Bus {
return func(ctx context.Context) (jetstream.JetStream, func(), error) {
modules/nats/cmd/nats-tools/manifest_test.go
+2 -2
View File
@@ -123,8 +123,8 @@ func TestTheBussManifestMountsItsProgramsIntoTheUpstreamImage(t *testing.T) {
}
}
for _, a := range m.Build.Artifacts {
if a.Name == "tools" && a.Env["MESH_BROKER_FILE"] != "${dir:mesh-state}/broker" {
t.Errorf("the tools' credential is %q: the module's own secret broker", a.Env["MESH_BROKER_FILE"])
if a.Name == "tools" && a.Env["MESH_BROKER_FILE"] != "${dir:mesh-state}/broker-nats-tools" {
t.Errorf("the tools' credential is %q: the process nats-tools' own secret broker-nats-tools", a.Env["MESH_BROKER_FILE"])
}
}
args, _ := server["args"].([]any)