jschoubben
c37d368f65
Two things, both found by trying to write a real postgres module and discovering it could not be said. A database has a superuser password, a broker an administrator, a registry an account. None of them is *for* anybody — they are not the credential a consumer is given, and the mechanism that hands those out has a consumer in the middle of it. So a module may declare what it needs and where to put it, and the mesh generates one per node, seals it, and reads it no more than it reads any other. Per node, deliberately: a module running on three machines has three passwords. One in the manifest instead would put the same secret on every machine that ever runs it, in a file anybody can read, for ever. Made once and kept, or a running database would be handed a password it was not started with; remade when the machine's sealing key changes, like everything else sealed here. A need declared and not made is refused rather than skipped, because a module whose own credential is silently absent starts, fails to authenticate, and the reason is three layers from the machine reporting it. And the provisioner can watch. That is what lets it be a module rather than a binary somebody places: run once, it needs invoking after every declaration by a timer or a unit wired to a file; watching, it is an ordinary long-running service the host already supervises. It polls rather than watching the filesystem, because the host writes atomically — the file is replaced, so a watch on the path stops seeing anything after the first replacement, and a watcher that silently stops working is worse than a poll. Credentials are compared by digest and never held: this runs for as long as the machine is up.
19 lines
858 B
Docker
19 lines
858 B
Docker
# The provisioner, as a module ships one.
|
|
#
|
|
# Built here so a machine can be given it by the mesh rather than by somebody putting a binary on
|
|
# it. Static and FROM scratch for the same reason the control plane's image is: it is fetched by
|
|
# digest and run on a machine, and everything in it is something a person would have to audit.
|
|
FROM golang:1.25-alpine AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags '-s -w' \
|
|
-o /mesh-provision-postgres ./examples/postgres-provisioner
|
|
|
|
FROM scratch
|
|
COPY --from=build /mesh-provision-postgres /mesh-provision-postgres
|
|
# Watching by default, because that is what makes it a module: an ordinary long-running service
|
|
# the host supervises, rather than something invoked after every declaration.
|
|
ENTRYPOINT ["/mesh-provision-postgres", "--watch"]
|