novox/mesh-controller
18
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Seal the stand-in vault box by the resource's id, and set the setting before the machines are assigned in the served-fact tests (issues 1385, 1382)

Browse Source 
The live try (build-1792488565282382172) left a stand-in vault box in f35 and yvbpsm: the file was matched by the manifest's path, which the composition fills in for the machine. The seal now matches by the resource's id alone and names any stand-in that is left. The two served-fact tests set the setting before assigning (an assignment resolves the mesh), and the second clears it after.
This commit is contained in:
mesh-tools
2026-10-20 09:53:36 +00:00
parent fb01d514a9
commit e4d1750015
3 changed files with 49 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/mesh-controller/compose_sdk.go
+14 -2
View File
@@ -426,10 +426,11 @@ func sealedByTheController(in *meshInput, node string, d compose.Declared, modul
if sealed == "" {
return d, nil, fmt.Errorf("%s/%s on %s has no seal of the controller's to carry until the vault holds it", w.Module, w.Name, node)
}
path := in.Catalogue[w.Module].OwnSecrets[w.Name].Path
for _, r := range d.Resources {
box, isBox := r[catalogue.VaultSealedField]
if !isBox || r["id"] != w.Module+"."+catalogue.NeedID(w.Name) || r["path"] != path {
// By the resource's id alone: its path is the manifest's with the machine's words filled in, and so is not the
// manifest's own.
if !isBox || r["id"] != w.Module+"."+catalogue.NeedID(w.Name) {
continue
}
if had, err := compactBox(box); err != nil || had != stood {
@@ -439,6 +440,17 @@ func sealedByTheController(in *meshInput, node string, d compose.Declared, modul
r["sealed"] = sealed
}
}
// A stand-in box that is left is said by its resource, never sent and never guessed at.
for _, r := range d.Resources {
if box, has := r[catalogue.VaultSealedField]; has {
if had, err := compactBox(box); err == nil && had == stood {
if id, _ := r["id"].(string); slices.ContainsFunc(modules, func(m string) bool { return strings.HasPrefix(id, m+".") }) {
return d, nil, fmt.Errorf("%s on %s still carries a stand-in for the vault's box, and the controller has "+
"no seal of its own for it", id, node)
}
}
}
}
d.CoreBoxesWanted = wanted
for _, f := range d.Foreseen {
module, _, _ := strings.Cut(f, "/")