Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

cmd/mesh-controller/modules.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"path/filepath"
 	"sort"
 	"strings"
 	"time"
@@ -127,6 +128,10 @@ func moduleCommand(ctx context.Context, args []string) error {
 		if err != nil {
 			return err
 		}
+		// A manifest handed over by hand takes each template's text from the tree beside it (novox/hq ADR 0349 §2).
+		if m, err = catalogue.WithTemplatesFrom(m, filepath.Dir(positionals[0])); err != nil {
+			return err
+		}
 		from, err := whereItComesFrom(*repo, *ref, *commit, *path, *self)
 		if err != nil {
 			return err
@@ -441,6 +446,10 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if len(positionals) == 2 {
 			values = positionals[1]
 		}
+		// Once its config values are mesh-config's, they are proposed there (issue 664).
+		if forwarded, err := forwardPropose(ctx, inv, positionals[0], *node, values, *clear); forwarded || err != nil {
+			return err
+		}
 		return proposeCommand(ctx, positionals[0], *node, values, *clear, *replace)
 	case "proposals":
 		if len(positionals) > 1 || *node != "" || *clear || *replace || *history {
@@ -461,6 +470,15 @@ func settingsCommand(ctx context.Context, args []string) error {
 		where = *node
 	}
 
+	// Once the move of config has run, a module in the config form is read and set through mesh-config (issue 664).
+	if (args[0] == "set" && len(positionals) == 2) || ((args[0] == "show" && !*history) || args[0] == "clear") &&
+		len(positionals) == 1 {
+		if forwarded, err := forwardSettings(ctx, inv, args[0], positionals[0], *node, positionals, *replace); forwarded ||
+			err != nil {
+			return err
+		}
+	}
+
 	switch args[0] {
 	case "set":
 		if len(positionals) != 2 {
@@ -537,6 +555,10 @@ func settingsCommand(ctx context.Context, args []string) error {
 				if p.SetBy != "" {
 					by = "; " + p.SetBy
 				}
+				if p.Why != "" {
+					// A layer whose placement moved out of it (migration 0097): still the layer, as it stands.
+					by += "; " + p.Why
+				}
 				fmt.Printf("%s on %s, until %s (%s%s):\n  %s\n", positionals[0], where,
 					p.ReplacedAt.Local().Format("2006-01-02 15:04:05"), p.ReplacedBy, by, shown)
 			}
@@ -940,7 +962,55 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 	if err != nil {
 		return err
 	}
-	return issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password)
+	if err := issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password); err != nil {
+		return err
+	}
+	if !runsTheProvisionerClient(m) {
+		return nil
+	}
+	return issueProvisionerClient(ctx, inv, m, node, known, reachable)
+}
+
+// runsTheProvisionerClient says a module runs its machine's provisioner client, which reaches the bus on an
+// account of its own (novox/hq ADR 0349 clause 11, design 57 P3): it claims the seat and declares the own secret
+// that account is delivered in. The same test the bus's user list makes (inventory's declaredFor).
+func runsTheProvisionerClient(m catalogue.Manifest) bool {
+	_, reads := m.OwnSecrets[broker.ProvisionerSecret]
+	return reads && m.ClaimsSeat(broker.NodeProvisionerSeat)
+}
+
+// issueProvisionerClient gives a machine's provisioner client its account: minted under the client's own name,
+// never the module's or the tool runner's, and sealed to the machine as the module's own secret
+// broker.ProvisionerSecret, which the client's service reads (novox/hq ADR 0349 clause 11, design 57 P3). No
+// claims and no consumer: the client holds no seat on this account and is delivered nothing but its answers.
+func issueProvisionerClient(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string,
+	known broker.Broker, reachable string) error {
+	user := broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username()
+	password, err := inv.MintBusPassword(ctx, inventory.BusUser{
+		Username: user, Kind: inventory.BusProvisioner, Node: node, Module: m.Module,
+	})
+	if err != nil {
+		return err
+	}
+	held, err := json.Marshal(struct {
+		URL         string `json:"url"`
+		Fingerprint string `json:"fingerprint,omitempty"`
+		Node        string `json:"node"`
+		User        string `json:"user"`
+		Password    string `json:"password"`
+	}{URL: "nats://" + reachable, Fingerprint: known.Fingerprint, Node: node, User: user, Password: password})
+	if err != nil {
+		return err
+	}
+	if err := inv.AcceptSecretForModule(ctx, node, m.Module, broker.ProvisionerSecret, string(held)); err != nil {
+		return err
+	}
+	if err := handIssuedToVault(ctx, inv, m, node, broker.ProvisionerSecret, string(held)); err != nil {
+		return err
+	}
+	fmt.Printf("bus user %s minted for %s's provisioner client, scoped to %s's keys, its reports and the vault\n",
+		user, m.Module, node)
+	return nil
 }
 
 // busKindOf is what a module's bus user is recorded as: the node's tool runtime where the module is
@@ -985,6 +1055,9 @@ func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manife
 	if err := inv.AcceptSecretForModule(ctx, node, m.Module, "broker", string(held)); err != nil {
 		return err
 	}
+	if err := handIssuedToVault(ctx, inv, m, node, "broker", string(held)); err != nil {
+		return err
+	}
 
 	// And how it hears what it consumes. Derived from its declaration, and only when it declared
 	// something: a module that consumes nothing needs no consumer, and creating one would be a