Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main
This commit is contained in:
Vendored
+2
-2
@@ -8,8 +8,8 @@ private addresses. That is acceptable while mesh-controller is private; if it ev
|
||||
a second place to clean besides the catalogue itself.
|
||||
|
||||
mesh-catalog e0bc919d4945bb5f13f971f74643a0b714cf45da modules/*/module.json, modules/nats/Dockerfile
|
||||
mesh-host c3b2fce0a29f0969dedf517c1f3e1570d64a8e74 examples/foundation-first-node.lock
|
||||
mesh-sdk 5933eb757d443293631be2bed27a96288c2348d8 conformance/events/module-event.json
|
||||
mesh-host bff1ac14a198a1e2181053582728024c758bb800 examples/foundation-first-node.lock
|
||||
mesh-sdk d3e182503c19a73c91ddc7b845651e020dbae22d conformance/events/module-event.json
|
||||
|
||||
To move them, from this repository's root, with the two repositories checked out beside it:
|
||||
|
||||
|
||||
@@ -221,7 +221,7 @@
|
||||
"path": "/var/lib/nats-module/conf/accounts.conf",
|
||||
"mode": "0600",
|
||||
"create-once": true,
|
||||
"content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n MESH {\n jetstream: enabled\n users = [\n { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n publish: { allow: [\"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"$JS.ACK.DEAD_LETTER_NOTICES.controller.>\", \"$JS.API.>\", \"$KV.mesh-controller_asked.>\", \"$KV.mesh-controller_calls.>\", \"$KV.mesh-controller_hand-acts.>\", \"$KV.mesh-controller_conditions.>\", \"$KV.mesh-controller_condition-history.>\", \"$KV.mesh-controller_lease.>\", \"$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>\", \"$KV.SEAT_NODE_BUILD_AGENT_cancelled.>\", \"_INBOX.enrol.>\", \"mesh.assignment.>\", \"mesh.mod.*.tool.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\", \"mesh.seat.node-build-agent.accept.>\", \"mesh.seat.mesh-build-machine.tool.>\", \"mesh.seat.node-build-agent.tool.>\", \"mesh.seat.mesh-controller.event.applied\", \"mesh.seat.mesh-controller.event.built-before\", \"mesh.seat.mesh-controller.event.refused\", \"mesh.seat.mesh-controller.event.rolled-back\", \"mesh.seat.mesh-controller.event.checked\", \"mesh.seat.mesh-controller.event.plan-moved\", \"mesh.seat.mesh-controller.event.condition-raised\", \"mesh.seat.mesh-controller.event.condition-changed\", \"mesh.seat.mesh-controller.event.condition-cleared\", \"mesh.seat.mesh-controller.event.doctor-heartbeat\", \"mesh.seat.mesh-controller.event.secret-replaced\", \"mesh.seat.mesh-controller.event.healer-acted\", \"$SRV.INFO\", \"mesh.seat.node-intrusion-prevention.tool.banned.*\", \"mesh.seat.node-backup.tool.backed-up.*\", \"mesh.seat.node-backup.tool.now.*\", \"mesh.seat.mesh-delivery.tool.stalled\", \"mesh.seat.mesh-delivery.tool.close\", \"mesh.seat.node-launcher.tool.secret.*\", \"mesh.seat.mesh-delivery.tool.release\", \"mesh.seat.mesh-delivery.tool.stop\", \"mesh.seat.mesh-delivery.tool.times\", \"mesh.seat.mesh-delivery.tool.groups\", \"mesh.seat.node-service-manager.tool.restart.*\", \"mesh.seat.operator-channel.tool.tell\", \"mesh.seat.mesh-controller.tool.plans\", \"mesh.events.dead.>\", \"mesh.again.>\"] }\n subscribe: { allow: [\"$JS.API.>\", \"$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>\", \"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>\", \"_DELIVER.controller\", \"_DELIVER.controller.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.*.event.provisioner.failing\", \"mesh.mod.*.event.provisioner.recovered\", \"mesh.mod.*.event.provisioner.retirement\", \"mesh.mod.gitea.event.pull.merged\", \"mesh.mod.gitea.event.pull.updated\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.seat.mesh-build-machine.event.built\", \"mesh.seat.node-build-agent.event.built\", \"mesh.seat.operator-channel.event.decided.mesh-controller\", \"mesh.seat.mesh-controller.tool.>\", \"$SRV.PING\", \"$SRV.INFO\", \"$SRV.PING.mesh-controller\", \"$SRV.PING.mesh-controller.>\", \"$SRV.INFO.mesh-controller\", \"$SRV.INFO.mesh-controller.>\", \"$SRV.STATS\", \"$SRV.STATS.mesh-controller\", \"$SRV.STATS.mesh-controller.>\"] }\n allow_responses: { max: 1, ttl: \"1m\" }\n } }\n ]\n }\n}\n"
|
||||
"content": "// The first user list, carried by the installer because at genesis there is no mesh to\n// compose one. A bootstrap credential, rotated with the store's and replaced by the\n// controller's own composition from its first start onward.\naccounts {\n MESH {\n jetstream: enabled\n users = [\n { user: \"controller\", password: \"$2a$10$AHqJgOifIVbU41KmATiMhuXFs8xa7Wl2HuN4UVBCXdN2jIQzjqApy\", permissions: {\n publish: { allow: [\"$JS.ACK.CONTROL.controller.>\", \"$JS.ACK.EVENTS.controller.>\", \"$JS.ACK.DEAD_LETTER_NOTICES.controller.>\", \"$JS.API.>\", \"$KV.mesh-controller_asked.>\", \"$KV.mesh-controller_assignments.>\", \"$KV.mesh-controller_calls.>\", \"$KV.mesh-controller_hand-acts.>\", \"$KV.mesh-controller_conditions.>\", \"$KV.mesh-controller_condition-history.>\", \"$KV.mesh-controller_declared-config.>\", \"$KV.mesh-controller_lease.>\", \"$KV.mesh-controller_predefined.>\", \"$KV.SEAT_MESH_BUILD_MACHINE_cancelled.>\", \"$KV.SEAT_NODE_BUILD_AGENT_cancelled.>\", \"_INBOX.enrol.>\", \"mesh.assignment.>\", \"mesh.mod.*.tool.>\", \"mesh.node.>\", \"mesh.seat.mesh-build-machine.accept.>\", \"mesh.seat.node-build-agent.accept.>\", \"mesh.seat.mesh-build-machine.tool.>\", \"mesh.seat.node-build-agent.tool.>\", \"mesh.seat.mesh-controller.event.applied\", \"mesh.seat.mesh-controller.event.built-before\", \"mesh.seat.mesh-controller.event.refused\", \"mesh.seat.mesh-controller.event.rolled-back\", \"mesh.seat.mesh-controller.event.checked\", \"mesh.seat.mesh-controller.event.plan-moved\", \"mesh.seat.mesh-controller.event.assignment-changed\", \"mesh.seat.mesh-controller.event.declared-config-changed\", \"mesh.seat.mesh-controller.event.predefined-changed\", \"mesh.seat.mesh-controller.event.condition-raised\", \"mesh.seat.mesh-controller.event.condition-changed\", \"mesh.seat.mesh-controller.event.condition-cleared\", \"mesh.seat.mesh-controller.event.doctor-heartbeat\", \"mesh.seat.mesh-controller.event.secret-replaced\", \"mesh.seat.mesh-controller.event.healer-acted\", \"$SRV.INFO\", \"mesh.seat.node-intrusion-prevention.tool.banned.*\", \"mesh.seat.node-backup.tool.backed-up.*\", \"mesh.seat.node-backup.tool.now.*\", \"mesh.seat.mesh-delivery.tool.stalled\", \"mesh.seat.mesh-delivery.tool.close\", \"mesh.seat.node-launcher.tool.secret.*\", \"mesh.seat.mesh-delivery.tool.release\", \"mesh.seat.mesh-delivery.tool.stop\", \"mesh.seat.mesh-delivery.tool.times\", \"mesh.seat.mesh-delivery.tool.groups\", \"mesh.seat.node-service-manager.tool.restart.*\", \"mesh.seat.operator-channel.tool.tell\", \"mesh.seat.mesh-controller.tool.plans\", \"mesh.events.dead.>\", \"mesh.again.>\"] }\n subscribe: { allow: [\"$JS.API.>\", \"$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>\", \"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>\", \"_DELIVER.controller\", \"_DELIVER.controller.>\", \"_INBOX.controller.>\", \"mesh.control.>\", \"mesh.mod.*.event.provisioner.failing\", \"mesh.mod.*.event.provisioner.recovered\", \"mesh.mod.*.event.provisioner.retirement\", \"mesh.mod.gitea.event.pull.merged\", \"mesh.mod.gitea.event.pull.updated\", \"mesh.mod.mesh-catalog.event.catching-up\", \"mesh.mod.mesh-catalog.event.upgraded\", \"mesh.seat.mesh-build-machine.event.built\", \"mesh.seat.node-build-agent.event.built\", \"mesh.seat.operator-channel.event.decided.mesh-controller\", \"mesh.seat.mesh-controller.tool.>\", \"$SRV.PING\", \"$SRV.INFO\", \"$SRV.PING.mesh-controller\", \"$SRV.PING.mesh-controller.>\", \"$SRV.INFO.mesh-controller\", \"$SRV.INFO.mesh-controller.>\", \"$SRV.STATS\", \"$SRV.STATS.mesh-controller\", \"$SRV.STATS.mesh-controller.>\"] }\n allow_responses: { max: 1, ttl: \"1m\" }\n } }\n ]\n }\n}\n"
|
||||
},
|
||||
// The upstream server, until the broker step adopts it: the `nats` module's own image, built by the
|
||||
// mesh, takes its place there once, on these same directories (ADR 0333 §3), as the bus's planned
|
||||
|
||||
Vendored
+42
@@ -50,6 +50,9 @@
|
||||
./internal/inventory TestACredentialIssuedOutsideIsNeverMade
|
||||
./internal/inventory TestOneAcceptForAProviderIsSealedToEveryConsumer
|
||||
./internal/inventory TestASharedOwnSecretIssuedOutsideIsNeverMade
|
||||
./internal/recordmirror TestNatsAnAssignmentAndARegistrationEachChangeOneKeyAndRaiseOneEvent
|
||||
./internal/recordmirror TestNatsTheListOfPredefinedKeysKeptChangesTheMirrorsOneKey
|
||||
./internal/inventory TestAModuleInTheConfigFormIsMirroredWithItsWholeDeclaration
|
||||
./cmd/mesh-controller TestOneAcceptForAProviderIsPlacedForEveryConsumer
|
||||
./cmd/mesh-controller TestReplay164
|
||||
./cmd/mesh-controller TestAnApprovedLayerOpensTheWalkThatSendsIt
|
||||
@@ -62,6 +65,12 @@
|
||||
./cmd/mesh-controller TestAProviderElsewhereServesItsOwnComposedName
|
||||
./cmd/mesh-controller TestAReusedCheckBuildIsRegisteredByItsDigestAndGatedAsABuiltOne
|
||||
./internal/inventory TestAReportOfABusyContainerIsKeptAndReadBack
|
||||
./internal/inventory TestANewerBuildsListReplacesTheKeptOneAndAnOlderOneHeardLaterDoesNot
|
||||
./cmd/mesh-controller TestTheMergeGateJudgesEachManifestAgainstTheListOfTheTree
|
||||
./cmd/mesh-controller TestRegistrationPublishesTheNewestTrunkListAndJudgesEveryModuleAgainstIt
|
||||
./internal/inventory TestPlacementMovesOutOfTheSettingsLayers
|
||||
./internal/inventory TestASettingRoutesPlacementBesideTheLayer
|
||||
./cmd/mesh-controller TestADeclarationIsTheSameAfterPlacementMoves
|
||||
./cmd/mesh-controller TestAReleaseSendsTheRestAtOnceAfterTheFirstPasses
|
||||
./cmd/mesh-controller TestARestMachineThatFailsIsPutBackAloneAndTheOthersAreJudgedOn
|
||||
./cmd/mesh-controller TestAWalkTakesOverTheReadingsOfAGateJudgingTheSameBuildThere
|
||||
@@ -73,6 +82,39 @@
|
||||
./cmd/mesh-controller TestANoMoveTierWaitsForNoNewReport
|
||||
./cmd/mesh-controller TestOneProviderDownAndThreeConsumersFailingAreOneCondition
|
||||
./cmd/mesh-controller TestAConsumerFailingBesideAHealthyProviderIsItsOwn
|
||||
./internal/inventory TestTheProvisionerClientsMachineHasAnAccountOfItsOwn
|
||||
./cmd/mesh-controller TestTheProvisionerClientsAccountIsIssuedForItsServiceAndNeverInvented
|
||||
./cmd/mesh-controller TestAcceptOfAnOwnSecretTakesThePathOfItsModulesForm
|
||||
./cmd/mesh-controller TestAcceptForAProviderTakesThePathOfTheProvidersModule
|
||||
./cmd/mesh-controller TestAcceptForAMovedTrustedModuleAnnouncesBeforeTheVaultIsAsked
|
||||
./cmd/mesh-controller TestAcceptForAMovedModuleRecordsAHandActAndNeverTheValue
|
||||
./cmd/mesh-controller TestAcceptOfAnOutsideOfferTakesThePathOfTheProvidersModule
|
||||
./cmd/mesh-controller TestAnAskAtTheDeskTakesThePathOfItsModulesForm
|
||||
./cmd/mesh-controller TestAnIssuedValueTakesThePathOfItsProvidersModule
|
||||
./cmd/mesh-controller TestARotationTakesThePathOfItsModulesForm
|
||||
./internal/inventory TestTheFourWordsAreKeptBesideTheLayer
|
||||
./internal/inventory TestALayerStillHoldingTheWordsReadsThemAsPlacement
|
||||
./internal/inventory TestTheMoveOfPlacementMovesWhatTheLayersStillHold
|
||||
./cmd/mesh-controller TestADeclarationIsTheSameWhileTheWordsAreStillInTheLayers
|
||||
./cmd/mesh-controller TestADeclarationIsTheSameAfterTheMoveOfPlacement
|
||||
./internal/inventory TestTheMoveReadsEveryRowSealedToAMachineAsItIs
|
||||
./internal/inventory TestASendKeepsThePlansItHandedAndTheMirrorCarriesThem
|
||||
./cmd/mesh-controller TestTheSendSealsNoSecretOfAModuleHandedThere
|
||||
./cmd/mesh-controller TestAModulesSecretsAreTheVaultsOnceItIsMarkedMoved
|
||||
./internal/inventory TestTheLayersAreReadUntilTheMoveOfConfigHasRun
|
||||
./internal/inventory TestAModuleReadsMeshConfigOnlyWhereItsValuesAre
|
||||
./internal/inventory TestTheEndOfTheMoveRefusesALayerChangedSinceItWasRead
|
||||
./cmd/mesh-controller TestEveryMachineIsToldTheSameAfterTheMoveOfConfig
|
||||
./cmd/mesh-controller TestTheMoveOfConfigRefusesWhatWouldChangeAMachine
|
||||
./cmd/mesh-controller TestTheSettingsVerbForwardsToConfigOnceTheValuesMoved
|
||||
./internal/inventory TestACoreCredentialsVaultBoxIsKeptPerMachineAndReplaced
|
||||
./cmd/mesh-controller TestTheSendCarriesTheVaultsBoxForACoreCredentialAndKeepsIt
|
||||
./cmd/mesh-controller TestASilentVaultHoldsTheKeptBoxAndSaysSo
|
||||
./cmd/mesh-controller TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsNotPlaced
|
||||
./cmd/mesh-controller TestAnEngineBelowTheContractIsSentTheControllersSealAsBefore
|
||||
./cmd/mesh-controller TestModuleIssueHandsACoveredAccountToTheVaultAndOnlyThat
|
||||
./cmd/mesh-controller TestModuleIssueFailsWhenTheVaultDoesNotTakeACoveredAccount
|
||||
./cmd/mesh-controller TestModuleIssueBeforeTheVaultIsInstalledKeepsTheValueAndHandsNothing
|
||||
./internal/inventory TestWhatRunsIsTheRegisteredBuildNotANewerOnePutBack
|
||||
./cmd/mesh-controller TestARecordedModulesBundleOnlyMoveRollsOutInItsWalk
|
||||
./cmd/mesh-controller TestARecordedModulesMoveThatRecreatesAContainerWaits
|
||||
|
||||
Reference in New Issue
Block a user