57/F2b: influxdb serves its org and bucket from its settings (issue 696) #290

Merged

mesh-admin merged 1 commits from pkg/57-f2b-served-keys into feat/57-config-and-provisioning 2026-10-14 05:15:54 +00:00

Conversation 1 Commits 1 Files Changed 1

+21 -3

mesh-admin commented 2026-10-14 05:03:33 +00:00

Contributor

Copy Link

Copy Source

Work package F2b of hq design 57, issue 696 (a settings layer still overrides what a provider serves), ADR 0348 clause 11.

Merge order: this pull request first, then mesh-controller's F2b pull request (Settle stops replacing served keys). Merged the other way round, grafana's data source on ace would name the served literal default instead of the bucket ace's layer sets.

What changed

• modules/influxdb/module.json declares two settings, org (default mesh) and bucket (default default), both preference with a why. These defaults are today's served literals.
• influxdb-api serves ${setting:org} and ${setting:bucket} in place of those literals, the way mailu serves domain and keycloak serves issuer.
• A module that declares settings must name the keys each mergeable file takes (ADR 0326 §3). runtime-config (config.json) now names bucket, org and url, which are the keys influxdb's client reads (cfg.org, cfg.url), and says trusted: true. That keeps it terminal-only, as it was as a trusted mergeable file. A module's default never reaches a mergeable file, so config.json stays {} where no layer is set.

Why

The controller's Settle lets a settings layer replace a provider's served keys. influxdb on ace is the one live layer that relies on this: its layer sets org and bucket over the served literals, and grafana on ace writes ${bound:influxdb-api:bucket} into its data source file. Once influxdb serves its settings, the controller change can stop the override without changing what grafana is told. Only forms the running controller accepts are used.

How it is proven

• The running controller (built from mesh-controller main) and the integration branch's controller both accept every manifest: module check modules/*/module.json exits 0 with the same counts as before (66 long-running resources without health, 25 files without a trust statement).
• MESH_CHECK_BASE=feat/57-config-and-provisioning MESH_GATE=<main controller> sh merge-check.sh exits 0. The same command with the controller from the F2b controller branch also exits 0.
• On the controller side, TestGrafanaComposesTheSameOnceInfluxdbServesItsSettings uses a seed like ace: influxdb's layer with org, bucket and endpoints (made-up values) and grafana consuming influxdb-api. It compares grafana's composed resources (the data source file and the binding file) byte for byte with golden files composed from the old manifest and the old Settle. They match with this manifest under both the old and the new Settle.

One change to influxdb's own file on ace

Today's form writes every key of ace's layer into influxdb's config.json, including endpoints, which only the mesh reads. With takes-settings, config.json on ace keeps org and bucket and drops endpoints. No influxdb code reads endpoints, and the file has no restart-on. Grafana's files and every consumer's binding stay byte-identical. endpoints is a mesh word and cannot be named in takes-settings (ADR 0164 §14), so this file change cannot be avoided once settings are declared.

Left for other packages

• K6 (issue 665) serves these as ${config:} once modules move from settings to config.
• K5 (issue 664) moves ace's layer into mesh-config.

Reviewer's checklist

1. Does what issue 696's step 1 says (serve the settings, today's literals as defaults), nothing else: yes.
2. Done-when proof: the controller pull request's tests (above). This repository has no test of the manifest's served values.
3. Byte-identical composition: grafana's data source and binding, by the controller test. influxdb's own config.json loses endpoints (above).
4. No secret anywhere; the operator's values from ace's layer are not in this change. No database change.
5. Strict parsers: settings, takes-settings and trusted are fields that both the running and the integration controller already accept (module check above). The node-engine sees no new field, because the composer strips them.
6. merge-check.sh passes with both controllers (commands above). The TypeScript check is not affected because no TypeScript changed.
7. Words: setting, config value, controller. Issue and ADR numbers are given with what they are.

Work package F2b of hq design 57, issue 696 (a settings layer still overrides what a provider serves), ADR 0348 clause 11. **Merge order: this pull request first, then mesh-controller's F2b pull request (Settle stops replacing served keys).** Merged the other way round, grafana's data source on ace would name the served literal `default` instead of the bucket ace's layer sets. ## What changed - `modules/influxdb/module.json` declares two settings, `org` (default `mesh`) and `bucket` (default `default`), both `preference` with a why. These defaults are today's served literals. - `influxdb-api` serves `${setting:org}` and `${setting:bucket}` in place of those literals, the way mailu serves `domain` and keycloak serves `issuer`. - A module that declares settings must name the keys each mergeable file takes (ADR 0326 §3). `runtime-config` (config.json) now names `bucket`, `org` and `url`, which are the keys influxdb's client reads (`cfg.org`, `cfg.url`), and says `trusted: true`. That keeps it terminal-only, as it was as a trusted mergeable file. A module's default never reaches a mergeable file, so config.json stays `{}` where no layer is set. ## Why The controller's `Settle` lets a settings layer replace a provider's served keys. influxdb on ace is the one live layer that relies on this: its layer sets org and bucket over the served literals, and grafana on ace writes `${bound:influxdb-api:bucket}` into its data source file. Once influxdb serves its settings, the controller change can stop the override without changing what grafana is told. Only forms the running controller accepts are used. ## How it is proven - The running controller (built from mesh-controller main) and the integration branch's controller both accept every manifest: `module check modules/*/module.json` exits 0 with the same counts as before (66 long-running resources without health, 25 files without a trust statement). - `MESH_CHECK_BASE=feat/57-config-and-provisioning MESH_GATE=<main controller> sh merge-check.sh` exits 0. The same command with the controller from the F2b controller branch also exits 0. - On the controller side, `TestGrafanaComposesTheSameOnceInfluxdbServesItsSettings` uses a seed like ace: influxdb's layer with org, bucket and endpoints (made-up values) and grafana consuming influxdb-api. It compares grafana's composed resources (the data source file and the binding file) byte for byte with golden files composed from the old manifest and the old Settle. They match with this manifest under both the old and the new Settle. ## One change to influxdb's own file on ace Today's form writes every key of ace's layer into influxdb's config.json, including `endpoints`, which only the mesh reads. With `takes-settings`, config.json on ace keeps `org` and `bucket` and drops `endpoints`. No influxdb code reads `endpoints`, and the file has no `restart-on`. Grafana's files and every consumer's binding stay byte-identical. `endpoints` is a mesh word and cannot be named in `takes-settings` (ADR 0164 §14), so this file change cannot be avoided once settings are declared. ## Left for other packages - K6 (issue 665) serves these as `${config:}` once modules move from settings to config. - K5 (issue 664) moves ace's layer into mesh-config. ## Reviewer's checklist 1. Does what issue 696's step 1 says (serve the settings, today's literals as defaults), nothing else: yes. 2. Done-when proof: the controller pull request's tests (above). This repository has no test of the manifest's served values. 3. Byte-identical composition: grafana's data source and binding, by the controller test. influxdb's own config.json loses `endpoints` (above). 4. No secret anywhere; the operator's values from ace's layer are not in this change. No database change. 5. Strict parsers: `settings`, `takes-settings` and `trusted` are fields that both the running and the integration controller already accept (module check above). The node-engine sees no new field, because the composer strips them. 6. merge-check.sh passes with both controllers (commands above). The TypeScript check is not affected because no TypeScript changed. 7. Words: setting, config value, controller. Issue and ADR numbers are given with what they are.

mesh-admin added 1 commit 2026-10-14 05:03:34 +00:00

influxdb: serve org and bucket from its settings (issue 696) ... 2dd6510ded

A settings layer will stop replacing what a provider serves (ADR 0348
clause 11). influxdb on ace relies on that today: its layer sets org and
bucket over the served literals, and grafana writes the bucket into its
data source. Serving ${setting:org} and ${setting:bucket}, with today's
literals as defaults, keeps every consumer's binding the same before and
after the controller change. Declaring settings means runtime-config names
the keys it takes; it keeps every key its client reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mesh-admin commented 2026-10-14 05:04:11 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-catalog@2dd6510ded29 — delivered since 2026-10-14T05:16:16Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Group pkg/57-f2b-served-keys, in order: novox/mesh-catalog@2dd6510ded → novox/mesh-controller@c5fe7d4795

• composed together: pass — the change touches no module of the mesh's graph

Transitions

• 2026-10-14 05:04 (new) → proposed (announced): novox/mesh-catalog#290's head announced
• 2026-10-14 05:04 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-14 05:04 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-14 05:16 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-14 05:16 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@2dd6510ded29` — **delivered** since 2026-10-14T05:16:16Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Group** `pkg/57-f2b-served-keys`, in order: novox/mesh-catalog@2dd6510ded29 → novox/mesh-controller@c5fe7d4795d7 - composed together: pass — the change touches no module of the mesh's graph **Transitions** - 2026-10-14 05:04 (new) → proposed (announced): novox/mesh-catalog#290's head announced - 2026-10-14 05:04 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-14 05:04 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-14 05:16 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-14 05:16 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin reviewed 2026-10-14 05:15:11 +00:00

mesh-admin left a comment

Author

Contributor

Copy Link

Copy Source

Verdict: APPROVE at 2dd6510ded

Independent review for issue 696 (a settings layer still overrides what a provider serves). Merge before mesh-controller#321.

What I ran on 2dd6510:

• MESH_CHECK_BASE=feat/57-config-and-provisioning MESH_GATE=<controller> sh merge-check.sh with three controllers I built myself: the running main controller (2959c81), the integration branch (dc36536) and mesh-controller#321 (c5fe7d4). All three exit 0, with 66 long-running resources without health, as kept.
• module check modules/influxdb/module.json with each of the three: ok, and 0 files asking for a setting without a trust statement.
• The TypeScript check was not run, because no TypeScript changed.

What I checked:

• Nothing outside the package. The defaults mesh and default are today's served literals, and the served keys ask for ${setting:org} and ${setting:bucket} the same way mailu and keycloak do.
• Grafana's files stay byte-identical. I re-ran mesh-controller#321's golden test on the integration branch's old Settle with both the old and the new manifest, and it passes. Its seed has the same key shape as influxdb's layer on ace (org, bucket, and endpoints.api with label, port and reach). I did not copy any of the values.
• The endpoints key leaves config.json. Only client.ts reads the file (through MESH_INFLUXDB_CONFIG_FILE, keys url, org and token), no other module names it, and the file has no restart-on. Losing endpoints is safe.
• trusted: true is right. url in that file redirects influxdb's own tools, so it must stay a key only the terminal can set.

Findings. None of them blocks the merge, and both can follow:

1. The pull request's description is wrong about who may set what (modules/influxdb/module.json:140-145). It says trusted: true "keeps it terminal-only, as it was". Before this change, influxdb's whole layer could be set only at the terminal (TrustedMergeable, issue 340). Once the file names its keys, only bucket, org and url (plus the served port and scheme, places and accesses) stay terminal keys. ports, expose and endpoints (including reach) of influxdb become settable through the settings verb, by agents too. The operator can do the same as before at the terminal. This is the same rule every module without a trusted mergeable file already follows (mosquitto's endpoints on ace, for example), so I accept it, but the description should say so.
2. bucket in takes-settings is not read by client.ts. Listing it keeps today's file content on ace, which is fine, but the description says the client reads it. A one-line correction is enough.
3. Scope check against ADR 0348 clause 11 and issue 696: complete for this repository. server.env keeps the literals mesh and default, which only matter at influxdb's first start, as each setting's why says.

Verdict: APPROVE at 2dd6510ded29 Independent review for issue 696 (a settings layer still overrides what a provider serves). Merge before mesh-controller#321. What I ran on 2dd6510: - `MESH_CHECK_BASE=feat/57-config-and-provisioning MESH_GATE=<controller> sh merge-check.sh` with three controllers I built myself: the running main controller (2959c81), the integration branch (dc36536) and mesh-controller#321 (c5fe7d4). All three exit 0, with 66 long-running resources without health, as kept. - `module check modules/influxdb/module.json` with each of the three: ok, and 0 files asking for a setting without a trust statement. - The TypeScript check was not run, because no TypeScript changed. What I checked: - Nothing outside the package. The defaults `mesh` and `default` are today's served literals, and the served keys ask for `${setting:org}` and `${setting:bucket}` the same way mailu and keycloak do. - Grafana's files stay byte-identical. I re-ran mesh-controller#321's golden test on the integration branch's old Settle with both the old and the new manifest, and it passes. Its seed has the same key shape as influxdb's layer on ace (org, bucket, and endpoints.api with label, port and reach). I did not copy any of the values. - The `endpoints` key leaves config.json. Only `client.ts` reads the file (through `MESH_INFLUXDB_CONFIG_FILE`, keys `url`, `org` and `token`), no other module names it, and the file has no `restart-on`. Losing `endpoints` is safe. - `trusted: true` is right. `url` in that file redirects influxdb's own tools, so it must stay a key only the terminal can set. Findings. None of them blocks the merge, and both can follow: 1. The pull request's description is wrong about who may set what (modules/influxdb/module.json:140-145). It says `trusted: true` "keeps it terminal-only, as it was". Before this change, influxdb's whole layer could be set only at the terminal (TrustedMergeable, issue 340). Once the file names its keys, only `bucket`, `org` and `url` (plus the served `port` and `scheme`, `places` and `accesses`) stay terminal keys. `ports`, `expose` and `endpoints` (including `reach`) of influxdb become settable through the settings verb, by agents too. The operator can do the same as before at the terminal. This is the same rule every module without a trusted mergeable file already follows (mosquitto's endpoints on ace, for example), so I accept it, but the description should say so. 2. `bucket` in `takes-settings` is not read by `client.ts`. Listing it keeps today's file content on ace, which is fine, but the description says the client reads it. A one-line correction is enough. 3. Scope check against ADR 0348 clause 11 and issue 696: complete for this repository. `server.env` keeps the literals `mesh` and `default`, which only matter at influxdb's first start, as each setting's `why` says.

mesh-admin merged commit dae7602245 into feat/57-config-and-provisioning 2026-10-14 05:15:54 +00:00

mesh-admin deleted branch pkg/57-f2b-served-keys 2026-10-14 05:15:55 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

mesh-admin

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jschoubben miel.truyen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#290