A module may need a secret of its own, and the provisioner watches
Two things, both found by trying to write a real postgres module and discovering it could not be said. A database has a superuser password, a broker an administrator, a registry an account. None of them is *for* anybody — they are not the credential a consumer is given, and the mechanism that hands those out has a consumer in the middle of it. So a module may declare what it needs and where to put it, and the mesh generates one per node, seals it, and reads it no more than it reads any other. Per node, deliberately: a module running on three machines has three passwords. One in the manifest instead would put the same secret on every machine that ever runs it, in a file anybody can read, for ever. Made once and kept, or a running database would be handed a password it was not started with; remade when the machine's sealing key changes, like everything else sealed here. A need declared and not made is refused rather than skipped, because a module whose own credential is silently absent starts, fails to authenticate, and the reason is three layers from the machine reporting it. And the provisioner can watch. That is what lets it be a module rather than a binary somebody places: run once, it needs invoking after every declaration by a timer or a unit wired to a file; watching, it is an ordinary long-running service the host already supervises. It polls rather than watching the filesystem, because the host writes atomically — the file is replaced, so a watch on the path stops seeing anything after the first replacement, and a watcher that silently stops working is worse than a poll. Credentials are compared by digest and never held: this runs for as long as the machine is up.
This commit is contained in:
@@ -44,6 +44,10 @@ type Grant struct {
|
||||
|
||||
// Rendering is everything needed to turn a resolution into the declaration a node is sent.
|
||||
type Rendering struct {
|
||||
// Needed is each module's own secrets, sealed to this node, keyed by module and then by the
|
||||
// name the module gave it.
|
||||
Needed map[string]map[string]string
|
||||
|
||||
Settings SettingsBy
|
||||
Generators map[string]Generator
|
||||
// Grants are the credentials this node must create, for the provisions it offers. Passed in
|
||||
@@ -74,6 +78,19 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
|
||||
var out []map[string]any
|
||||
for _, m := range r.Modules {
|
||||
resources := m.Resources
|
||||
for _, name := range sortedKeys(m.Needs) {
|
||||
sealed := with.Needed[m.Module][name]
|
||||
if sealed == "" {
|
||||
// Declared and not made. Refused rather than skipped: a module whose own
|
||||
// credential is silently absent starts, fails to authenticate, and the reason is
|
||||
// three layers away from the machine reporting it.
|
||||
return nil, fmt.Errorf(
|
||||
"%s needs a secret called %q and none was made for it", m.Module, name)
|
||||
}
|
||||
resources = append(append([]map[string]any{}, resources...), map[string]any{
|
||||
"id": NeedID(name), "type": "file", "path": m.Needs[name], "sealed": sealed,
|
||||
})
|
||||
}
|
||||
for _, to := range sortedKeys(m.Secrets) {
|
||||
var found *Needed
|
||||
for i, n := range r.Needs {
|
||||
|
||||
@@ -199,6 +199,19 @@ type Manifest struct {
|
||||
// makes `restart-on` precise.
|
||||
Secrets map[string]string `json:"secrets,omitempty"`
|
||||
|
||||
// Needs is a secret this module needs for itself, and where to put it.
|
||||
//
|
||||
// Not tied to a consumer. A database has a superuser password, a broker has an administrator,
|
||||
// a registry has an account — each is a secret the module needs in order to be itself, and
|
||||
// none of them is *for* anybody. Keyed by a name of the module's choosing, valued by the file
|
||||
// it lands in.
|
||||
//
|
||||
// **Generated per node and sealed to it**, like everything else the mesh hands out, so a
|
||||
// module running on three machines has three passwords and the mesh can read none of them. A
|
||||
// manifest carrying one instead would put the same secret on every machine that ever runs the
|
||||
// module, in a file anybody can read, for ever.
|
||||
Needs map[string]string `json:"needs,omitempty"`
|
||||
|
||||
// Grants is a directory this module wants the credentials of its consumers written into, per
|
||||
// provision it offers — one file per consumer, named for it, holding the value alone.
|
||||
//
|
||||
@@ -235,6 +248,9 @@ const (
|
||||
ArtifactArchive = "archive"
|
||||
)
|
||||
|
||||
// NeedID is the resource identity of the file a module's own secret lands in.
|
||||
func NeedID(name string) string { return "needs-" + name }
|
||||
|
||||
// SecretID is the resource identity of the file a module is given a credential in.
|
||||
func SecretID(requirement string) string { return "secret-" + requirement }
|
||||
|
||||
@@ -374,6 +390,15 @@ func ParseManifest(raw []byte) (Manifest, error) {
|
||||
"%s binds %q and does not require it", m.Module, to))
|
||||
}
|
||||
}
|
||||
for name, where := range m.Needs {
|
||||
if !strings.HasPrefix(where, "/") {
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s needs %q at %q, which is not an absolute path", m.Module, name, where))
|
||||
}
|
||||
if name == "" {
|
||||
problems = append(problems, m.Module+" needs a secret with no name")
|
||||
}
|
||||
}
|
||||
for to, where := range m.Secrets {
|
||||
if !strings.HasPrefix(where, "/") {
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
|
||||
@@ -0,0 +1,94 @@
|
||||
package catalogue
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// A secret a module needs in order to be itself.
|
||||
//
|
||||
// A database has a superuser password, a broker an administrator, a registry an account. None is
|
||||
// *for* anybody — it is not the credential a consumer is given, and the mechanism that hands
|
||||
// those out has a consumer in the middle of it.
|
||||
|
||||
func needy() Manifest {
|
||||
return Manifest{
|
||||
Module: "postgres", Version: "1",
|
||||
Needs: map[string]string{"superuser": "/var/lib/mesh/postgres/superuser"},
|
||||
Resources: []map[string]any{
|
||||
{"id": "store", "type": "container", "name": "mesh-postgres", "image": "postgres@sha256:x"},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestAModulesOwnSecretLandsSealed(t *testing.T) {
|
||||
got, err := Resolve(shelf(needy()), []string{"postgres"}, reachable(), World{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
out, err := got.Declaration(Rendering{
|
||||
Needed: map[string]map[string]string{"postgres": {"superuser": "c2VhbGVk"}},
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, r := range out {
|
||||
if r["path"] != "/var/lib/mesh/postgres/superuser" {
|
||||
continue
|
||||
}
|
||||
if r["sealed"] != "c2VhbGVk" {
|
||||
t.Fatalf("got %v", r)
|
||||
}
|
||||
if r["content"] != nil {
|
||||
t.Fatal("a module's own secret was written in the clear")
|
||||
}
|
||||
return
|
||||
}
|
||||
t.Fatalf("no secret was written: %v", out)
|
||||
}
|
||||
|
||||
func TestADeclaredNeedThatWasNotMadeIsRefused(t *testing.T) {
|
||||
// Skipping it would start a database with no password it knows, which fails to authenticate
|
||||
// three layers from the machine reporting it.
|
||||
got, _ := Resolve(shelf(needy()), []string{"postgres"}, reachable(), World{})
|
||||
_, err := got.Declaration(Rendering{})
|
||||
if err == nil {
|
||||
t.Fatal("a module needing a secret was declared without one")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "superuser") {
|
||||
t.Fatalf("the refusal does not name what is missing: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestANeedIsAnAbsolutePath(t *testing.T) {
|
||||
_, err := ParseManifest([]byte(`{"module":"postgres","version":"1",
|
||||
"needs":{"superuser":"superuser.txt"}}`))
|
||||
if err == nil {
|
||||
t.Fatal("a relative path was accepted")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "absolute path") {
|
||||
t.Fatalf("unhelpful refusal: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAModuleMayNeedSeveralThings(t *testing.T) {
|
||||
// A password and a token, say. Telling them apart is the module's business, not the mesh's.
|
||||
m := needy()
|
||||
m.Needs["replication"] = "/var/lib/mesh/postgres/replication"
|
||||
got, _ := Resolve(shelf(m), []string{"postgres"}, reachable(), World{})
|
||||
out, err := got.Declaration(Rendering{Needed: map[string]map[string]string{
|
||||
"postgres": {"superuser": "b25l", "replication": "dHdv"},
|
||||
}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
seen := map[string]string{}
|
||||
for _, r := range out {
|
||||
if path, ok := r["path"].(string); ok && strings.Contains(path, "/var/lib/mesh/postgres/") {
|
||||
seen[path], _ = r["sealed"].(string)
|
||||
}
|
||||
}
|
||||
if len(seen) != 2 || seen["/var/lib/mesh/postgres/superuser"] == seen["/var/lib/mesh/postgres/replication"] {
|
||||
t.Fatalf("two needs did not land as two secrets: %v", seen)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user