jschoubben
53a79a17a1
The host's error text may carry a duration or a counter, and a resource looping on it would never have read as stuck. The previous row is read and compared here. Stuck needs a start to say. A container may mount the file a binding lands in; the runtime socket is declared under both of its spellings; the catalogue-wide test takes MESH_CATALOG.
101 lines
4.3 KiB
Go
101 lines
4.3 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// A bind mount the module never declared is refused where it is written (novox/hq 04-ISSUES/026,
|
|
// ADR 0091). The container runtime creates a missing bind source itself, as root, with a mode it
|
|
// picks, so the module's own owner and mode never reach the directory holding its data, and the
|
|
// rule that keeps data when a module goes away (ADR 0030) does not cover it.
|
|
|
|
const aContainerMounting = `{"id":"server","type":"container","name":"store","image":"x@sha256:` +
|
|
`0000000000000000000000000000000000000000000000000000000000000000","volumes":["%s:/inside"]}`
|
|
|
|
func manifestMounting(from string, beside string) []byte {
|
|
res := aContainerMounting
|
|
if beside != "" {
|
|
res = beside + "," + res
|
|
}
|
|
return []byte(`{"module":"store","resources":[` + strings.Replace(res, "%s", from, 1) + `]}`)
|
|
}
|
|
|
|
func TestAMountNothingDeclaresIsRefused(t *testing.T) {
|
|
_, err := ParseManifest(manifestMounting("/services/store/data", ""))
|
|
if err == nil {
|
|
t.Fatal("a container mounting a path no resource declares was accepted; the runtime " +
|
|
"would create it as root and the module's owner and mode would never apply")
|
|
}
|
|
if !strings.Contains(err.Error(), "/services/store/data") {
|
|
t.Fatalf("refused without naming the path, which leaves the author guessing: %v", err)
|
|
}
|
|
}
|
|
|
|
// Declaring it is enough — including declaring the directory above it.
|
|
func TestAMountUnderADeclaredDirectoryIsAccepted(t *testing.T) {
|
|
_, err := ParseManifest(manifestMounting("/services/store/data",
|
|
`{"id":"state","type":"directory","path":"/services/store","mode":"0700"}`))
|
|
if err != nil {
|
|
t.Fatalf("a module that said where its data lives was refused anyway: %v", err)
|
|
}
|
|
}
|
|
|
|
// The operator's path, granted for use (ADR 0051), is declared by `accesses`, not by a directory the
|
|
// module would then own.
|
|
func TestAMountOfAnAccessedPathIsAccepted(t *testing.T) {
|
|
_, err := ParseManifest([]byte(`{"module":"store","accesses":[{"path":"/services/media/movies","mode":"read"}],` +
|
|
`"resources":[` + strings.Replace(aContainerMounting, "%s", "/services/media/movies", 1) + `]}`))
|
|
if err != nil {
|
|
t.Fatalf("a mount of a path the module declares it accesses was refused: %v", err)
|
|
}
|
|
}
|
|
|
|
// The machine's facility — the container runtime's socket — is granted by the capability that names
|
|
// it, and declaring it as the module's own directory would be a lie the host would act on. This is
|
|
// the case the first version of this check refused, and was withdrawn for: the builder.
|
|
func TestTheRuntimeSocketIsGrantedByTheCapabilityAndNotOtherwise(t *testing.T) {
|
|
granted := `{"module":"builder","capabilities":["container-runtime"],"resources":[` +
|
|
strings.Replace(aContainerMounting, "%s", "/var/run/docker.sock", 1) + `]}`
|
|
if _, err := ParseManifest([]byte(granted)); err != nil {
|
|
t.Fatalf("a module with the container-runtime capability may mount its socket: %v", err)
|
|
}
|
|
if _, err := ParseManifest(manifestMounting("/var/run/docker.sock", "")); err == nil {
|
|
t.Fatal("a module mounted the container runtime's socket without declaring the capability, and was accepted")
|
|
}
|
|
}
|
|
|
|
// **Every manifest in the catalogue beside this checkout passes**, so the rule is not one the
|
|
// catalogue is already breaking. Skipped, aloud, where the catalogue is not there.
|
|
func TestEveryCatalogueManifestDeclaresWhatItMounts(t *testing.T) {
|
|
root := os.Getenv("MESH_CATALOG")
|
|
if root == "" {
|
|
root = "../../../mesh-catalog"
|
|
}
|
|
files, _ := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
|
|
if len(files) == 0 {
|
|
t.Skipf("no catalogue at %s (set MESH_CATALOG to a checkout)", root)
|
|
}
|
|
for _, file := range files {
|
|
raw, err := os.ReadFile(file)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := ParseManifest(raw); err != nil {
|
|
t.Errorf("%s: %v", filepath.Base(filepath.Dir(file)), err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Where a bound fact lands is the mesh's file too, and a container may mount it directly.
|
|
func TestAMountOfABoundFactIsAccepted(t *testing.T) {
|
|
_, err := ParseManifest([]byte(`{"module":"store","requires":["model-access"],` +
|
|
`"binds":{"model-access":"/var/lib/store/model.json"},"resources":[` +
|
|
strings.Replace(aContainerMounting, "%s", "/var/lib/store/model.json", 1) + `]}`))
|
|
if err != nil {
|
|
t.Fatalf("a mount of the file the mesh writes a binding to was refused: %v", err)
|
|
}
|
|
}
|