Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00
parent d70bb1f388
commit d984816844
259 changed files with 34899 additions and 353 deletions
@@ -0,0 +1,220 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The core's own credentials travel sealed by the vault to their machine (novox/hq ADR 0349 §16, issue 755; the lead's
+// decision, issue 755 notes 4 and 5): to an engine that opens the vault's box, the send carries the box the vault
+// answered the controller and never the controller's own seal; when the vault does not answer, a kept box is carried
+// again and a module with none is not placed, with a condition naming the vault and the machine. An engine below the
+// contract composes exactly as before, and the vault is not asked.
+
+// coreStandIn answers `get` with a box per name and generation, or its silence.
+type coreStandIn struct {
+	asked      []string
+	keys       []string
+	generation int
+	silent     error
+}
+
+func (v *coreStandIn) ask(name, key string) (coreAnswer, error) {
+	v.asked, v.keys = append(v.asked, name), append(v.keys, key)
+	if v.silent != nil {
+		return coreAnswer{}, v.silent
+	}
+	box := `{"v":1,"eph":"ZQ==","iv":"aQ==","tag":"dA==","ct":"` + strings.Repeat("c", len(v.asked)) + `"}`
+	return coreAnswer{Name: name, Generation: v.generation, Sealed: json.RawMessage(box)}, nil
+}
+
+func withVault(t *testing.T, v *coreStandIn) {
+	t.Helper()
+	before := coreVault
+	coreVault = func(context.Context) coreAsk { return v.ask }
+	t.Cleanup(func() { coreVault = before })
+}
+
+func aCoreMesh(t *testing.T, contract int) (*stores, *coreStandIn) {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	client := aClientModule()
+	register(t, open, client)
+	if _, err := assign(ctx, open, "laptop", client.Module); err != nil {
+		t.Fatal(err)
+	}
+	if err := issueProvisionerClient(ctx, open.inventory, client, "laptop", broker.Broker{Fingerprint: "ab"},
+		"10.0.0.1:4222"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := open.inventory.RecordHealth(ctx, inventory.NodeHealth{Node: "laptop", Contract: contract,
+		SaidAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	v := &coreStandIn{generation: 1}
+	withVault(t, v)
+	return open, v
+}
+
+func clientsBroker(resources []map[string]any) map[string]any {
+	for _, r := range resources {
+		if r["id"] == "mesh-provisioner-client.needs-"+broker.ProvisionerSecret {
+			return r
+		}
+	}
+	return nil
+}
+
+func vaultSilence(t *testing.T, node string) (conditions.Condition, bool) {
+	t.Helper()
+	c, found, err := conditionsFrom.Get(t.Context(), vaultSilentObservation(node, coreBoxes{}).Key())
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c, found
+}
+
+func TestTheSendCarriesTheVaultsBoxForACoreCredentialAndKeepsIt(t *testing.T) {
+	open, vault := aCoreMesh(t, link.VaultBoxContract)
+	key, err := open.inventory.SealingKeyOf(t.Context(), "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f := clientsBroker(sentTo(t, open, "laptop"))
+	if f == nil || f["sealed"] != nil || f[catalogue.VaultSealedField] == nil {
+		t.Fatalf("the core credential is sent as %v: the vault's box, never the controller's seal", f)
+	}
+	if want := []string{"own/laptop/mesh-provisioner-client/" + broker.ProvisionerSecret}; !reflect.DeepEqual(vault.asked, want) {
+		t.Fatalf("the vault was asked %v", vault.asked)
+	}
+	if want, _ := sealingKeyPEM(key); vault.keys[0] != want {
+		t.Fatalf("the vault was asked to seal to %q, not the machine's key", vault.keys[0])
+	}
+	first, _ := json.Marshal(f[catalogue.VaultSealedField])
+
+	// The vault answers afresh with the same generation: the kept box is carried again, so the declaration is stable.
+	again, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
+	if string(again) != string(first) {
+		t.Fatalf("a fresh box of the same generation changed the declaration: %s, then %s", first, again)
+	}
+	// A rotation in the vault (a newer generation) is carried.
+	vault.generation = 2
+	rotated, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
+	if string(rotated) == string(first) {
+		t.Fatal("a newer generation was not carried")
+	}
+	if _, found := vaultSilence(t, "laptop"); found {
+		t.Fatal("a send the vault answered raised its silence")
+	}
+}
+
+func TestASilentVaultHoldsTheKeptBoxAndSaysSo(t *testing.T) {
+	open, vault := aCoreMesh(t, link.VaultBoxContract)
+	first, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
+	vault.silent = errors.New("no responders")
+	held := clientsBroker(sentTo(t, open, "laptop"))
+	got, _ := json.Marshal(held[catalogue.VaultSealedField])
+	if held == nil || held["sealed"] != nil || string(got) != string(first) {
+		t.Fatalf("a silent vault's credential is sent as %v: the box kept, never the controller's seal", held)
+	}
+	c, found := vaultSilence(t, "laptop")
+	if !found || !strings.Contains(c.Summary, "vault") || !strings.Contains(c.Summary, "laptop") {
+		t.Fatalf("no condition names the vault and the machine: %+v", c)
+	}
+	// The vault answers again: the condition clears.
+	vault.silent = nil
+	sentTo(t, open, "laptop")
+	if _, found := vaultSilence(t, "laptop"); found {
+		t.Fatal("the condition stayed after the vault answered")
+	}
+}
+
+func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsNotPlaced(t *testing.T) {
+	open, vault := aCoreMesh(t, link.VaultBoxContract)
+	vault.silent = errors.New("no responders")
+	plan, settings, err := planFor(t.Context(), open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	declared, err := declarationFor(t.Context(), open, "laptop", plan, settings)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range declared.Resources {
+		if strings.HasPrefix(r["id"].(string), "mesh-provisioner-client.") {
+			t.Fatalf("a core module was placed though the vault gave nothing for it: %v", r)
+		}
+	}
+	if why := declared.leftOutWhy["mesh-provisioner-client"]; !strings.Contains(why, "never seals it itself") {
+		t.Fatalf("left out %v", declared.leftOutWhy)
+	}
+	c, found := vaultSilence(t, "laptop")
+	if !found || c.Severity != conditions.Urgent || !strings.Contains(c.Summary, "not placed") {
+		t.Fatalf("the condition does not say why: %+v", c)
+	}
+}
+
+// An engine below VaultBoxContract is sent the controller's own seal, as before, and the vault is not asked.
+func TestAnEngineBelowTheContractIsSentTheControllersSealAsBefore(t *testing.T) {
+	open, vault := aCoreMesh(t, link.HandedContract)
+	f := clientsBroker(sentTo(t, open, "laptop"))
+	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
+		t.Fatalf("an older engine is sent %v", f)
+	}
+	if len(vault.asked) != 0 {
+		t.Fatalf("the vault was asked %v for an older engine", vault.asked)
+	}
+}
+
+// Every question but a send reads the kept box and asks nothing; with none kept, a stand-in the next send asks for.
+func TestOnlyASendAsksTheVault(t *testing.T) {
+	core := map[string][]string{"nats": {"broker"}}
+	key := aPublicKey(t)
+	kept := map[string]map[string]inventory.CoreBox{"nats": {"broker": {Module: "nats", Name: "broker",
+		Generation: 1, SealedTo: key, Box: json.RawMessage(`{"v":1}`)}}}
+	never := func(string, string) (coreAnswer, error) {
+		t.Fatal("the vault was asked by a question that is not a send")
+		return coreAnswer{}, nil
+	}
+	for _, choosing := range []Choosing{Reading, Foreseeing} {
+		if got := coreBoxesOf("anchor", key, core, kept, choosing, never); string(got.sealed["nats"]["broker"]) != `{"v":1}` {
+			t.Errorf("read %s", got.sealed["nats"]["broker"])
+		}
+		if got := coreBoxesOf("anchor", key, core, nil, choosing, never); string(got.sealed["nats"]["broker"]) !=
+			string(catalogue.ForeseenVaultBox) {
+			t.Errorf("with none kept, read %s", got.sealed["nats"]["broker"])
+		}
+	}
+	// A box kept for another key of the machine is never carried.
+	other := coreBoxesOf("anchor", aPublicKey(t), core, kept, Allocating,
+		func(string, string) (coreAnswer, error) { return coreAnswer{}, errors.New("silent") })
+	if _, left := other.notPlaced["nats"]; !left {
+		t.Fatalf("a box sealed to the machine's old key was carried: %+v", other)
+	}
+}
+
+// The core's modules on a machine: on the list, not handed, with their own secrets but one issued outside.
+func TestTheCoresModulesAreTheListsWithTheirOwnSecrets(t *testing.T) {
+	modules := []catalogue.Manifest{
+		{Module: "nats", OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/a"}, "given": {Path: "/b",
+			IssuedBy: catalogue.IssuedOutside}}},
+		{Module: "postgres", OwnSecrets: catalogue.OwnSecrets{"superuser": {Path: "/c"}}},
+		{Module: "mesh-provisioner", OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/d"}}},
+	}
+	got := coreModulesOf(modules, func(m catalogue.Manifest) bool { return m.Module == "mesh-provisioner" })
+	if want := map[string][]string{"nats": {"broker"}}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}