jochen
8eb6c3e94a
A module declaring tools, a container, and a build on mesh-tools' runtime image is a container whose purpose is serving tools — the pattern the node's tool runtime retires. Once node-tools is in the catalogue, registering one is refused by name, with the record that says why; before, it is accepted as it always was, so a mesh converts in the design's order and nothing is refused before there is anything to move to. This is the mechanism that keeps the old pattern from returning by habit. Judged from a repository manifest's own build.on, and for a built manifest — which carries no build — from what its build stood on, now recorded beside the commit as part of a module's provenance.
89 lines
3.8 KiB
Go
89 lines
3.8 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// The packet-filter manifest as it was the day the runtime was decided (novox/hq ADR 0175): tools,
|
|
// served from a container built on the tool runtime's image, with NET_ADMIN so the container could
|
|
// reach the filter. The exact pattern to-be 38 WP4 moves it off, and the one the gate refuses.
|
|
const thePacketFilterAsItWas = `{
|
|
"module": "nftables",
|
|
"version": "1",
|
|
"capabilities": ["firewall", "container-runtime"],
|
|
"claims": [{"name": "node-packet-filter", "scope": "node", "serves": ["rules", "reload", "remove"]}],
|
|
"filtering": {"into": "/etc/nftables.conf"},
|
|
"resources": [
|
|
{"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
|
|
{"id": "package", "type": "package", "package": "nftables"},
|
|
{"id": "unit", "type": "file", "path": "/etc/systemd/system/mesh-filter.service",
|
|
"content": "[Unit]\nDescription=The mesh's packet filter\n[Service]\nType=oneshot\nExecStart=nft -f /etc/nftables.conf\n", "mode": "0644"},
|
|
{"id": "load", "type": "service", "unit": "mesh-filter.service", "state": "running", "boot": "enabled",
|
|
"restart-on": ["unit"], "reload-on": ["filtering"]},
|
|
{"id": "runtime", "type": "container", "name": "mesh-nftables", "network": "host",
|
|
"capabilities": ["NET_ADMIN"],
|
|
"volumes": ["${dir:mesh-state}/broker:/run/secrets/broker:ro", "/etc/nftables.conf:/etc/nftables.conf:ro"],
|
|
"env": {"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_FILTER_FILE": "/etc/nftables.conf"},
|
|
"artifact": "runtime"}
|
|
],
|
|
"tools": ["firewall_rules"],
|
|
"own-secrets": {"broker": "${dir:mesh-state}/broker"},
|
|
"build": {
|
|
"on": [
|
|
{"arg": "BUILD_BASE", "module": "mesh-tools", "artifact": "build"},
|
|
{"arg": "RUNTIME_BASE", "module": "mesh-tools", "artifact": "runtime"}
|
|
],
|
|
"artifacts": [{"name": "runtime", "kind": "image", "from": "Dockerfile"}]
|
|
}
|
|
}`
|
|
|
|
func TestAToolContainerOnTheRuntimeImageIsNamedForWhatItIs(t *testing.T) {
|
|
m, err := ParseManifest([]byte(thePacketFilterAsItWas))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// From the repository: the manifest says what it builds on.
|
|
why := ToolContainerOnTheRuntime(m, nil)
|
|
if why == "" {
|
|
t.Fatal("the packet filter's tool container was not recognised from its build")
|
|
}
|
|
for _, word := range []string{"nftables", "mesh-tools", "runtime", "ADR 0175", "bundle"} {
|
|
if !strings.Contains(why, word) {
|
|
t.Errorf("the refusal does not say %q: %s", word, why)
|
|
}
|
|
}
|
|
|
|
// Built: the manifest carries no build, and what it stood on says the same.
|
|
built, err := m.Resolve([]Built{{Name: "runtime", Kind: ArtifactImage,
|
|
Reference: ArtifactStoreScheme + "nftables/runtime@" + digest}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
stoodOn := []string{"anchor.internal:5100/mesh-tools/build@" + digest, "anchor.internal:5100/mesh-tools/runtime@" + digest}
|
|
if ToolContainerOnTheRuntime(built, stoodOn) == "" {
|
|
t.Error("the packet filter's tool container was not recognised from what its build stood on")
|
|
}
|
|
if ToolContainerOnTheRuntime(built, nil) != "" {
|
|
t.Error("a built manifest with no record of its base was judged to be on the runtime")
|
|
}
|
|
|
|
// Each of the three alone is an ordinary module.
|
|
bundle := m
|
|
bundle.Resources = m.Resources[:len(m.Resources)-1]
|
|
if ToolContainerOnTheRuntime(bundle, nil) != "" {
|
|
t.Error("a module with tools and no container is the pattern the runtime serves, and was refused")
|
|
}
|
|
service := m
|
|
service.Tools = nil
|
|
if ToolContainerOnTheRuntime(service, nil) != "" {
|
|
t.Error("a service built against the SDK, declaring no tools, was refused")
|
|
}
|
|
elsewhere := m
|
|
elsewhere.Build = &Build{On: []BuildsOn{{Arg: "NODE_BASE", Image: "node@" + digest}},
|
|
Artifacts: m.Build.Artifacts}
|
|
if ToolContainerOnTheRuntime(elsewhere, nil) != "" {
|
|
t.Error("a tool container on a public base was refused as though it were on the runtime's")
|
|
}
|
|
}
|