jschoubben
0af3ea1acf
novox/hq 04-ISSUES/022. A credential was keyed by provision, consumer node and provider node, so "who is asking" was answered by naming a host. The node this mesh exists to take over runs eight modules against one database server. The symptom had two halves and only one was loud. The provider refused, naming the modules and explaining they would share one credential, which reads as a decision rather than a limit. The consumer did not refuse: it resolved cleanly, wrote one module's credential file and left the others absent — a service that starts and cannot authenticate, with nothing saying why. That is 021 again on a different axis. Three modules wanting one database produced one need, carrying whichever module mentioned it first, because the resolution walk is a work-list over names. The fan-out now happens in one place, after the walk. The record path already did this correctly and said why: a consumer here is a module on a machine. It is the same rule. Downstream: the secret's key gains the consuming module, the grant file is named after both halves, needs are matched by provision and module rather than provision alone, and the provisioners name the role and the access key after the module. The refusal in ContributionsTo is gone because there is nothing left to refuse. Worth stating plainly: without that refusal, gitea's login would have opened keycloak's database. From the provisioner's side it created exactly what it was asked to create. Existing secrets are discarded rather than backfilled. They cannot say which module they were for, and a secret is remade and delivered to both ends on the next push — so this costs one rotation and invents nothing. Also guards the role name against PostgreSQL's 63-byte truncation, which is a notice rather than an error and would reintroduce exactly this collision at a length nobody tests. Three faults injected — the fan-out removed, needs matched by name alone, the grant file named after the machine — each caught.
333 lines
13 KiB
Go
333 lines
13 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// Where the answer to a requirement is allowed to live.
|
|
//
|
|
// A shell, a display server and a private network have to be on the machine that needs them. A
|
|
// database does not — it runs somewhere and is reached over the network. Both were written
|
|
// `requires`, so both were answered the same way, and the second answer was to install PostgreSQL
|
|
// on every machine that runs a web application.
|
|
|
|
// onNetwork is a set of providers, all of them reachable. Written as a helper because a machine
|
|
// that cannot reach the one answering its requirement is its own case, tested separately.
|
|
// reachable is this machine, on the private network.
|
|
func reachable() Node {
|
|
n := workstation()
|
|
n.At = "workstation.internal"
|
|
return n
|
|
}
|
|
|
|
func onNetwork(nodes ...string) map[string][]Provider {
|
|
out := make([]Provider, 0, len(nodes))
|
|
for _, n := range nodes {
|
|
out = append(out, Provider{Node: n, At: n + ".internal"})
|
|
}
|
|
return map[string][]Provider{"postgres-database": out}
|
|
}
|
|
|
|
func brokeredShelf() map[string]Manifest {
|
|
return shelf(
|
|
Manifest{Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database")},
|
|
Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"}},
|
|
)
|
|
}
|
|
|
|
func TestADatabaseIsNotInstalledOnEveryMachineThatUsesOne(t *testing.T) {
|
|
// The fault this whole distinction exists for.
|
|
got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
|
|
World{Offered: onNetwork("anchor")})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if have := strings.Join(names(got), " "); strings.Contains(have, "postgres") {
|
|
t.Fatalf("using a database installed one here: %s", have)
|
|
}
|
|
}
|
|
|
|
func TestWhatAMachineTakesFromElsewhereIsRecorded(t *testing.T) {
|
|
// It is the only part of a node's set that stops working when a *different* machine goes
|
|
// away, and it is where a credential will have to be handed back.
|
|
got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
|
|
World{Offered: onNetwork("anchor")})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(got.Needs) != 1 {
|
|
t.Fatalf("got %v", got.Needs)
|
|
}
|
|
if got.Needs[0].Name != "postgres-database" || got.Needs[0].From != "anchor" {
|
|
t.Fatalf("got %v", got.Needs[0])
|
|
}
|
|
if got.Needs[0].For != "meshboard" {
|
|
t.Fatalf("it does not say what wanted it: %v", got.Needs[0])
|
|
}
|
|
}
|
|
|
|
func TestNothingInTheMeshProvidingItIsRefusedWithSomewhereToPutIt(t *testing.T) {
|
|
// Refused rather than installed here. Choosing a machine to put a database on is a decision
|
|
// with consequences, and nothing resolving a web application should make it silently.
|
|
_, err := Resolve(brokeredShelf(), []string{"meshboard"}, workstation(), World{})
|
|
if err == nil {
|
|
t.Fatal("a database was found in a mesh that has none")
|
|
}
|
|
if !strings.Contains(err.Error(), "assign") || !strings.Contains(err.Error(), "postgres") {
|
|
t.Fatalf("the refusal does not say what to do: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestTwoNodesProvidingItIsRefusedRatherThanPicked(t *testing.T) {
|
|
// Same rule as everywhere else. Picking one would be a guess about which database a person
|
|
// meant, and the wrong guess is somebody's data in the wrong place.
|
|
_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
|
|
World{Offered: onNetwork("anchor", "archive")})
|
|
if err == nil {
|
|
t.Fatal("one of two databases was picked silently")
|
|
}
|
|
for _, want := range []string{"anchor", "archive", "pin"} {
|
|
if !strings.Contains(err.Error(), want) {
|
|
t.Fatalf("the refusal does not name %s: %v", want, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSayingWhichOneSettlesIt(t *testing.T) {
|
|
got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
|
|
World{
|
|
Offered: onNetwork("anchor", "archive"),
|
|
Pinned: map[string]string{"postgres-database": "archive"},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(got.Needs) != 1 || got.Needs[0].From != "archive" {
|
|
t.Fatalf("the choice was not taken: %v", got.Needs)
|
|
}
|
|
}
|
|
|
|
func TestBeingPointedAtAMachineThatDoesNotProvideItIsRefused(t *testing.T) {
|
|
// Rather than falling back to one that does. A fallback would quietly move somebody's data to
|
|
// a machine they did not choose, which is the whole reason the question is asked.
|
|
_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
|
|
World{
|
|
Offered: onNetwork("anchor", "archive"),
|
|
Pinned: map[string]string{"postgres-database": "somewhere-else"},
|
|
})
|
|
if err == nil {
|
|
t.Fatal("a machine was silently given a different database from the one chosen")
|
|
}
|
|
if !strings.Contains(err.Error(), "somewhere-else") {
|
|
t.Fatalf("the refusal does not say what was chosen: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestOneProviderDoesNotOverruleAChoice(t *testing.T) {
|
|
// A single answer is normally taken silently. Not when somebody said they wanted a different
|
|
// one -- that is the mesh overruling a person, which it does nowhere else.
|
|
_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
|
|
World{
|
|
Offered: onNetwork("anchor"),
|
|
Pinned: map[string]string{"postgres-database": "archive"},
|
|
})
|
|
if err == nil {
|
|
t.Fatal("the only database was used although another was chosen")
|
|
}
|
|
if !strings.Contains(err.Error(), "only anchor provides it") {
|
|
t.Fatalf("the refusal does not say what is available: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestACatalogueThatDisagreesAboutScopeIsRefused(t *testing.T) {
|
|
// If one module says a database is local and another says it is anywhere, the same
|
|
// requirement means two things depending on which one happens to answer it.
|
|
_, err := Resolve(shelf(
|
|
Manifest{Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database")},
|
|
Manifest{Module: "sqlite", Version: "1", Provides: Offers("postgres-database")},
|
|
Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"}},
|
|
), []string{"meshboard"}, workstation(), World{})
|
|
if err == nil {
|
|
t.Fatal("a catalogue that disagrees about where a database lives was accepted")
|
|
}
|
|
if !strings.Contains(err.Error(), "two things") {
|
|
t.Fatalf("unhelpful refusal: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestALocalRequirementIsStillAnsweredLocally(t *testing.T) {
|
|
// The change must not have made everything brokered. A shell is still installed here.
|
|
got, err := Resolve(shelf(
|
|
Manifest{Module: "zsh", Version: "1", Provides: Offers("shell")},
|
|
Manifest{Module: "tools", Version: "1", Requires: []string{"shell"}},
|
|
), []string{"tools"}, workstation(), World{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if have := strings.Join(names(got), " "); !strings.Contains(have, "zsh") {
|
|
t.Fatalf("a shell was not installed on the machine that needs one: %s", have)
|
|
}
|
|
}
|
|
|
|
func TestTheShortFormStillMeansHere(t *testing.T) {
|
|
// `"provides": ["shell"]` must keep meaning what it meant, or every existing manifest
|
|
// silently changes meaning.
|
|
m, err := ParseManifest([]byte(`{"module":"zsh","version":"1","provides":["shell"]}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(m.Provides) != 1 || m.Provides[0].At() != ScopeNode {
|
|
t.Fatalf("a plain name is no longer node-scoped: %v", m.Provides)
|
|
}
|
|
}
|
|
|
|
func TestASiteScopedProvisionIsRefused(t *testing.T) {
|
|
// Meaningful for a claim — one DHCP server per segment — and not yet meaningful for a
|
|
// provision, because nothing knows how to reach "the one at my site".
|
|
_, err := ParseManifest([]byte(
|
|
`{"module":"dns","version":"1","provides":[{"name":"resolver","scope":"site"}]}`))
|
|
if err == nil {
|
|
t.Fatal("a site-scoped provision was accepted")
|
|
}
|
|
if !strings.Contains(err.Error(), "site") {
|
|
t.Fatalf("unhelpful refusal: %v", err)
|
|
}
|
|
}
|
|
|
|
// Being told, which is the difference between knowing and being able to.
|
|
|
|
func boundShelf() map[string]Manifest {
|
|
return shelf(
|
|
Manifest{Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database"),
|
|
Serves: map[string]map[string]any{"postgres-database": {"port": 5432, "driver": "postgres"}}},
|
|
Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"},
|
|
Binds: map[string]string{"postgres-database": "/etc/meshboard/database.json"}},
|
|
)
|
|
}
|
|
|
|
func binding(t *testing.T, out []map[string]any) map[string]any {
|
|
t.Helper()
|
|
for _, r := range out {
|
|
if r["path"] != "/etc/meshboard/database.json" {
|
|
continue
|
|
}
|
|
var parsed map[string]any
|
|
if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
|
|
t.Fatalf("what the app is told is not readable: %v", err)
|
|
}
|
|
return parsed
|
|
}
|
|
t.Fatalf("the app was told nothing: %v", out)
|
|
return nil
|
|
}
|
|
|
|
func TestAnAppIsToldWhereItsDatabaseIs(t *testing.T) {
|
|
// Knowing it needs the anchor's database is useless to the program that needs it unless the
|
|
// program is told. This is the whole point of the field.
|
|
got, err := Resolve(boundShelf(), []string{"meshboard"}, reachable(),
|
|
World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal",
|
|
Serves: map[string]any{"port": 5432, "driver": "postgres"}}}}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
told := binding(t, mustDeclare(t, got))
|
|
if told["from"] != "anchor" || told["at"] != "anchor.internal" {
|
|
t.Fatalf("it was not told where: %v", told)
|
|
}
|
|
serves, _ := told["serves"].(map[string]any)
|
|
if serves["port"] != float64(5432) || serves["driver"] != "postgres" {
|
|
t.Fatalf("it was not told how: %v", serves)
|
|
}
|
|
}
|
|
|
|
func TestItSaysWhereTheCredentialIsInstead(t *testing.T) {
|
|
// A missing field looks like a bug; a stated absence looks like a boundary. Somebody wiring
|
|
// this up must not spend an afternoon looking for the password field.
|
|
//
|
|
// It used to say only that the mesh had no way to issue one, which stopped being true when
|
|
// 021 was fixed. A stated absence is only useful while it is accurate — once it is not, it
|
|
// sends the reader somewhere there is nothing to find.
|
|
got, _ := Resolve(boundShelf(), []string{"meshboard"}, reachable(),
|
|
World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal"}}}})
|
|
told := binding(t, mustDeclare(t, got))
|
|
note, _ := told["generated"].(string)
|
|
if !strings.Contains(note, "not here") || !strings.Contains(note, "secrets") {
|
|
t.Fatalf("the file does not say where the credential is instead: %v", note)
|
|
}
|
|
for key := range told {
|
|
if strings.Contains(key, "password") || strings.Contains(key, "secret") {
|
|
t.Fatalf("something that looks like a credential appeared: %q", key)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestTwoMachinesThatCannotReachEachOtherAreRefused(t *testing.T) {
|
|
// An app on one machine and a database on another that share no private network is a mesh
|
|
// that reports itself configured and does not work. Said here rather than discovered as a
|
|
// connection timing out.
|
|
_, err := Resolve(boundShelf(), []string{"meshboard"}, workstation(), // not on the network
|
|
World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal"}}}})
|
|
if err == nil {
|
|
t.Fatal("an app was pointed at a database it has no path to")
|
|
}
|
|
if !strings.Contains(err.Error(), "private network") {
|
|
t.Fatalf("the refusal does not say what is wrong: %v", err)
|
|
}
|
|
if !strings.Contains(err.Error(), meshNetwork) {
|
|
t.Fatalf("the refusal does not say what to assign: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestTheProviderBeingOffTheNetworkIsAlsoRefused(t *testing.T) {
|
|
// Both directions, because the failure is identical from either end and the remedy differs.
|
|
_, err := Resolve(boundShelf(), []string{"meshboard"}, reachable(),
|
|
World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor"}}}})
|
|
if err == nil {
|
|
t.Fatal("an app was pointed at a database that is not on the private network")
|
|
}
|
|
if !strings.Contains(err.Error(), "anchor") {
|
|
t.Fatalf("the refusal does not name the unreachable end: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestBindingSomethingAnsweredHereWritesNothing(t *testing.T) {
|
|
// A file saying "it is on this node" is a fact nobody needs and one more thing to keep true.
|
|
got, err := Resolve(shelf(
|
|
Manifest{Module: "zsh", Version: "1", Provides: Offers("shell")},
|
|
Manifest{Module: "tools", Version: "1", Requires: []string{"shell"},
|
|
Binds: map[string]string{"shell": "/etc/tools/shell.json"}},
|
|
), []string{"tools"}, reachable(), World{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, r := range mustDeclare(t, got) {
|
|
if r["path"] == "/etc/tools/shell.json" {
|
|
t.Fatalf("a binding was written for something on this machine: %v", r)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestBindingWhatYouDoNotRequireIsRefused(t *testing.T) {
|
|
_, err := ParseManifest([]byte(`{"module":"app","version":"1",
|
|
"binds":{"postgres-database":"/etc/app/db.json"}}`))
|
|
if err == nil {
|
|
t.Fatal("a module was told about something it never asked for")
|
|
}
|
|
if !strings.Contains(err.Error(), "does not require") {
|
|
t.Fatalf("unhelpful refusal: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestServingWhatYouDoNotProvideIsRefused(t *testing.T) {
|
|
_, err := ParseManifest([]byte(`{"module":"app","version":"1",
|
|
"serves":{"postgres-database":{"port":5432}}}`))
|
|
if err == nil {
|
|
t.Fatal("a module served something it does not provide")
|
|
}
|
|
if !strings.Contains(err.Error(), "does not provide") {
|
|
t.Fatalf("unhelpful refusal: %v", err)
|
|
}
|
|
}
|