Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

cmd/mesh-controller/issued.go

@@ -43,6 +43,32 @@ const issuedAsk = 20 * time.Second
 // issuedProvider is one assignment of a module whose offer says its software issues the provision's credential.
 type issuedProvider struct {
 	Node, Module, Tool string
+	// Holders are the provision's holders from this assignment's machine, named to the vault, whose tool may answer
+	// a value for each (issue 749).
+	Holders []issuedHolder
+}
+
+// issuedHolder is one holder of a provision from a provider: a consuming module on one machine (issue 749).
+type issuedHolder struct {
+	Node   string `json:"node"`
+	Module string `json:"module"`
+}
+
+func (h issuedHolder) String() string { return h.Module + " on " + h.Node }
+
+// issuedHoldersFrom are the provision's holders from provider, each consuming module on each machine once.
+func issuedHoldersFrom(holders []inventory.Holder, provider string) []issuedHolder {
+	seen := map[issuedHolder]bool{}
+	var out []issuedHolder
+	for _, h := range holders {
+		one := issuedHolder{Node: h.Consumer, Module: h.ConsumerModule}
+		if h.Provider != provider || seen[one] {
+			continue
+		}
+		seen[one] = true
+		out = append(out, one)
+	}
+	return out
 }
 
 // issuedTaker is the line's work, with what it reaches handed in: the store, the bus and the sends.
@@ -53,6 +79,10 @@ type issuedTaker struct {
 	keep      func(provision, provider, value string) (inventory.IssuedKept, error)
 	record    func(act link.HandAct) error
 	send      func(machines []string) error
+	// ofTheVault says whether a provider module's secrets are filled the new way; for one that is, the value goes
+	// into the vault (vault, vault_secrets.go) and nothing is kept, sealed or sent here. Nil is none.
+	ofTheVault vaultSwitch
+	vault      vaultAsker
 }
 
 // take asks every provider of the provision for its software's value and keeps each; it answers what it did, in
@@ -90,6 +120,15 @@ func (t issuedTaker) take(provision string) (string, error) {
 
 // takeFrom is one provider: asked, opened, kept, recorded and sent when it changed.
 func (t issuedTaker) takeFrom(provision string, p issuedProvider) (string, error) {
+	if t.ofTheVault != nil {
+		ours, err := t.ofTheVault(p.Module)
+		if err != nil {
+			return "", err
+		}
+		if ours {
+			return t.takeIntoVault(provision, p)
+		}
+	}
 	public, private, err := secrets.Keypair()
 	if err != nil {
 		return "", fmt.Errorf("no key could be made to take the value: %w", err)
@@ -174,6 +213,16 @@ func issuedProvidersOf(ctx context.Context, inv *inventory.Inventory, provision
 	if err != nil {
 		return nil, true, err
 	}
+	out, err := issuedProvidersFrom(shelf, holders, func(node string) ([]string, error) {
+		return inv.Assigned(ctx, node)
+	}, provision)
+	return out, true, err
+}
+
+// issuedProvidersFrom are the assignments to ask, from the provision's holders: on every machine providing it, the
+// assigned modules whose offer says their software issues it, each with that machine's holders (issue 749).
+func issuedProvidersFrom(shelf map[string]catalogue.Manifest, holders []inventory.Holder,
+	assignedOn func(node string) ([]string, error), provision string) ([]issuedProvider, error) {
 	nodes := map[string]bool{}
 	for _, h := range holders {
 		nodes[h.Provider] = true
@@ -185,13 +234,17 @@ func issuedProvidersOf(ctx context.Context, inv *inventory.Inventory, provision
 	sort.Strings(names)
 	var out []issuedProvider
 	for _, node := range names {
-		assigned, err := inv.Assigned(ctx, node)
+		assigned, err := assignedOn(node)
 		if err != nil {
-			return nil, true, err
+			return nil, err
 		}
-		out = append(out, issuedOn(shelf, node, assigned, provision)...)
+		on := issuedOn(shelf, node, assigned, provision)
+		for i := range on {
+			on[i].Holders = issuedHoldersFrom(holders, node)
+		}
+		out = append(out, on...)
 	}
-	return out, true, nil
+	return out, nil
 }
 
 // offersIssued is whether any module offers the provision with a credential its software issues.
@@ -262,7 +315,9 @@ func secretIssued(ctx context.Context, args []string) error {
 				return err
 			})
 		},
-		send: func(machines []string) error { return sendTo(ctx, open, machines) },
+		send:       func(machines []string) error { return sendTo(ctx, open, machines) },
+		ofTheVault: filledTheNewWay,
+		vault:      theVault(ctx),
 	}
 	words, err := t.take(provision)
 	if words != "" {