mesh-tools
97a2d841c7
The controller plans config, templates and moved providers' provisions, hands bus accounts to the vault and judges the new manifest words, on the feature's SDK and node-engine validator (feature 57, config and provisioning).
328 lines
13 KiB
Go
328 lines
13 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"sort"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/nats-io/nats.go"
|
|
|
|
"github.com/novox/mesh-controller/internal/broker"
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
"github.com/novox/mesh-controller/internal/inventory"
|
|
"github.com/novox/mesh-controller/internal/link"
|
|
"github.com/novox/mesh-controller/internal/secrets"
|
|
)
|
|
|
|
// `secret issued <provision>`: the credential a provider's software issued, taken from the provider and kept as
|
|
// the provision's one credential for every consumer (novox/hq ADR 0305, issue 526).
|
|
//
|
|
// **The value comes from the provider, never from whoever asks.** A module served by its machine's runtime calls
|
|
// under the runtime's one bus account, which carries that machine's agents' calls too, so a value handed to a
|
|
// verb could be anybody's. This line carries none: it asks the provider's own tool, on the provider's machine, in
|
|
// the controller's own name — the subject that names its caller, which the bus lets the controller alone publish
|
|
// (issue 365) — with a sealing key made for this one call. The tool answers only the controller, the value sealed
|
|
// to that key; the controller opens it, seals it to every holder and forgets it, as the desk's value is (ADR 0277
|
|
// §23). Asking again fetches the same value again, and a value every holder already holds is not sealed anew.
|
|
//
|
|
// **What this trusts: the provider's machine.** The answer is taken from whoever answers the provider's tool
|
|
// subject on the provider's machine first. On that machine its runtime serves the subject for every module it
|
|
// carries, so anything that runtime runs, or anything else granted that subject there, could answer before the
|
|
// provider does and hand the controller a value of its own. ADR 0305 accepts that by trusting the provider's
|
|
// machine, as the provider itself is trusted; the bus keeps every other machine from answering it.
|
|
|
|
// handActIssued is the verb a change of an issued value is recorded under: the mesh working as decided.
|
|
const handActIssued = "secret issued"
|
|
|
|
// issuedAsk is how long the provider's tool is given to answer.
|
|
const issuedAsk = 20 * time.Second
|
|
|
|
// issuedProvider is one assignment of a module whose offer says its software issues the provision's credential.
|
|
type issuedProvider struct {
|
|
Node, Module, Tool string
|
|
// Holders are the provision's holders from this assignment's machine, named to the vault, whose tool may answer
|
|
// a value for each (issue 749).
|
|
Holders []issuedHolder
|
|
}
|
|
|
|
// issuedHolder is one holder of a provision from a provider: a consuming module on one machine (issue 749).
|
|
type issuedHolder struct {
|
|
Node string `json:"node"`
|
|
Module string `json:"module"`
|
|
}
|
|
|
|
func (h issuedHolder) String() string { return h.Module + " on " + h.Node }
|
|
|
|
// issuedHoldersFrom are the provision's holders from provider, each consuming module on each machine once.
|
|
func issuedHoldersFrom(holders []inventory.Holder, provider string) []issuedHolder {
|
|
seen := map[issuedHolder]bool{}
|
|
var out []issuedHolder
|
|
for _, h := range holders {
|
|
one := issuedHolder{Node: h.Consumer, Module: h.ConsumerModule}
|
|
if h.Provider != provider || seen[one] {
|
|
continue
|
|
}
|
|
seen[one] = true
|
|
out = append(out, one)
|
|
}
|
|
return out
|
|
}
|
|
|
|
// issuedTaker is the line's work, with what it reaches handed in: the store, the bus and the sends.
|
|
type issuedTaker struct {
|
|
// providers are the assignments to ask, and whether any module offers the provision so at all.
|
|
providers func(provision string) ([]issuedProvider, bool, error)
|
|
ask func(p issuedProvider, args map[string]any) (link.Answer, error)
|
|
keep func(provision, provider, value string) (inventory.IssuedKept, error)
|
|
record func(act link.HandAct) error
|
|
send func(machines []string) error
|
|
// ofTheVault says whether a provider module's secrets are filled the new way; for one that is, the value goes
|
|
// into the vault (vault, vault_secrets.go) and nothing is kept, sealed or sent here. Nil is none.
|
|
ofTheVault vaultSwitch
|
|
vault vaultAsker
|
|
}
|
|
|
|
// take asks every provider of the provision for its software's value and keeps each; it answers what it did, in
|
|
// words that never carry the value or its fingerprint.
|
|
func (t issuedTaker) take(provision string) (string, error) {
|
|
providers, offered, err := t.providers(provision)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if !offered {
|
|
return "", fmt.Errorf("no module offers %q with a credential its software issues (\"credential\": "+
|
|
"{\"issued-by\": \"software\", \"tool\": …}, ADR 0305), so there is nothing to take from a provider; "+
|
|
"nothing was asked", provision)
|
|
}
|
|
if len(providers) == 0 {
|
|
return fmt.Sprintf("no consumer holds %s from a provider whose software issues it yet, so there is nothing "+
|
|
"to seal; a consumer that binds holds a value the mesh made until the provider next asks", provision), nil
|
|
}
|
|
var said []string
|
|
var failed []string
|
|
for _, p := range providers {
|
|
words, err := t.takeFrom(provision, p)
|
|
if err != nil {
|
|
failed = append(failed, fmt.Sprintf("%s on %s: %v", p.Module, p.Node, err))
|
|
continue
|
|
}
|
|
said = append(said, words)
|
|
}
|
|
out := strings.Join(said, "\n")
|
|
if len(failed) > 0 {
|
|
return out, fmt.Errorf("%s was not taken from every provider:\n %s", provision, strings.Join(failed, "\n "))
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
// takeFrom is one provider: asked, opened, kept, recorded and sent when it changed.
|
|
func (t issuedTaker) takeFrom(provision string, p issuedProvider) (string, error) {
|
|
if t.ofTheVault != nil {
|
|
ours, err := t.ofTheVault(p.Module)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if ours {
|
|
return t.takeIntoVault(provision, p)
|
|
}
|
|
}
|
|
public, private, err := secrets.Keypair()
|
|
if err != nil {
|
|
return "", fmt.Errorf("no key could be made to take the value: %w", err)
|
|
}
|
|
answer, err := t.ask(p, map[string]any{"provision": provision, "seal_to": public})
|
|
if err != nil {
|
|
return "", fmt.Errorf("its tool %s could not be asked: %w", p.Tool, err)
|
|
}
|
|
if answer.Error != "" {
|
|
return "", fmt.Errorf("its tool %s refused: %s", p.Tool, answer.Error)
|
|
}
|
|
var given struct {
|
|
Sealed string `json:"sealed"`
|
|
}
|
|
if err := unmarshalAnswer(answer, &given); err != nil || given.Sealed == "" {
|
|
return "", fmt.Errorf("its tool %s answered no sealed value", p.Tool)
|
|
}
|
|
opened, err := secrets.Open(private, given.Sealed)
|
|
if err != nil {
|
|
// Never the value, never what failed to open: only that it was not sealed to this call.
|
|
return "", fmt.Errorf("its tool %s answered a value not sealed to this call; nothing was taken", p.Tool)
|
|
}
|
|
value := strings.TrimSpace(string(opened))
|
|
for i := range opened {
|
|
opened[i] = 0
|
|
}
|
|
if value == "" {
|
|
return "", fmt.Errorf("its tool %s answered an empty value; nothing was taken", p.Tool)
|
|
}
|
|
kept, err := t.keep(provision, p.Node, value)
|
|
value = ""
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
holders := make([]string, 0, len(kept.Holders))
|
|
for _, h := range kept.Holders {
|
|
holders = append(holders, fmt.Sprintf("%s on %s%s", h.ConsumerModule, h.Consumer, asLocal(h.Local)))
|
|
}
|
|
words := ""
|
|
if len(kept.Unsealable) > 0 {
|
|
var names []string
|
|
for _, h := range kept.Unsealable {
|
|
names = append(names, fmt.Sprintf("%s on %s", h.ConsumerModule, h.Consumer))
|
|
}
|
|
words = fmt.Sprintf("\n not sealed to %s: no sealing key on that machine", strings.Join(names, ", "))
|
|
}
|
|
if !kept.Changed {
|
|
return fmt.Sprintf("%s from %s on %s: every holder already holds the value its software issued (%s); "+
|
|
"nothing was sent%s", provision, p.Module, p.Node, strings.Join(holders, ", "), words), nil
|
|
}
|
|
sealedTo := make([]string, 0, len(kept.Sealed))
|
|
for _, h := range kept.Sealed {
|
|
sealedTo = append(sealedTo, fmt.Sprintf("%s on %s%s", h.ConsumerModule, h.Consumer, asLocal(h.Local)))
|
|
}
|
|
recorded := ""
|
|
if err := t.record(link.HandAct{Verb: handActIssued, Args: []string{provision},
|
|
Why: fmt.Sprintf("%s on %s gave the credential its software issued for %s; sealed to %s", p.Module, p.Node,
|
|
provision, strings.Join(sealedTo, ", ")),
|
|
Cause: "issued-by-software"}); err != nil {
|
|
recorded = fmt.Sprintf("\n this was NOT recorded in the hand-act log, and is done anyway: %v", err)
|
|
}
|
|
if err := t.send(kept.Machines); err != nil {
|
|
return "", fmt.Errorf("%s from %s on %s is sealed to %s and could not be sent: %w; `push --behind` sends it",
|
|
provision, p.Module, p.Node, strings.Join(sealedTo, ", "), err)
|
|
}
|
|
return fmt.Sprintf("%s from %s on %s: the value its software issued is sealed to %s; sent %s, and each of "+
|
|
"them starts again on it%s%s", provision, p.Module, p.Node, strings.Join(sealedTo, ", "),
|
|
strings.Join(kept.Machines, ", "), words, recorded), nil
|
|
}
|
|
|
|
// issuedProvidersOf are the assignments to ask for a provision: every machine providing it to a pair the mesh
|
|
// holds, and on it the assigned module whose offer says its software issues the credential (ADR 0305 §1).
|
|
func issuedProvidersOf(ctx context.Context, inv *inventory.Inventory, provision string) ([]issuedProvider, bool, error) {
|
|
shelf, err := inv.Catalogue(ctx)
|
|
if err != nil {
|
|
return nil, false, err
|
|
}
|
|
if !offersIssued(shelf, provision) {
|
|
return nil, false, nil
|
|
}
|
|
holders, err := inv.HoldersOf(ctx, provision, "")
|
|
if err != nil {
|
|
return nil, true, err
|
|
}
|
|
out, err := issuedProvidersFrom(shelf, holders, func(node string) ([]string, error) {
|
|
return inv.Assigned(ctx, node)
|
|
}, provision)
|
|
return out, true, err
|
|
}
|
|
|
|
// issuedProvidersFrom are the assignments to ask, from the provision's holders: on every machine providing it, the
|
|
// assigned modules whose offer says their software issues it, each with that machine's holders (issue 749).
|
|
func issuedProvidersFrom(shelf map[string]catalogue.Manifest, holders []inventory.Holder,
|
|
assignedOn func(node string) ([]string, error), provision string) ([]issuedProvider, error) {
|
|
nodes := map[string]bool{}
|
|
for _, h := range holders {
|
|
nodes[h.Provider] = true
|
|
}
|
|
names := make([]string, 0, len(nodes))
|
|
for n := range nodes {
|
|
names = append(names, n)
|
|
}
|
|
sort.Strings(names)
|
|
var out []issuedProvider
|
|
for _, node := range names {
|
|
assigned, err := assignedOn(node)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
on := issuedOn(shelf, node, assigned, provision)
|
|
for i := range on {
|
|
on[i].Holders = issuedHoldersFrom(holders, node)
|
|
}
|
|
out = append(out, on...)
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
// offersIssued is whether any module offers the provision with a credential its software issues.
|
|
func offersIssued(shelf map[string]catalogue.Manifest, provision string) bool {
|
|
for _, m := range shelf {
|
|
if _, issued := m.IssuedCredentialOf(provision); issued {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// issuedOn are the modules assigned to one machine whose offer says their software issues the provision's
|
|
// credential, each with the tool that answers it.
|
|
func issuedOn(shelf map[string]catalogue.Manifest, node string, assigned []string, provision string) []issuedProvider {
|
|
var out []issuedProvider
|
|
for _, module := range assigned {
|
|
if tool, issued := shelf[module].IssuedCredentialOf(provision); issued {
|
|
out = append(out, issuedProvider{Node: node, Module: module, Tool: tool})
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
// issuedRefusesRotation refuses `rotate` of a provision its provider's software issues (ADR 0305 §9): a value the
|
|
// mesh made would replace one the software holds, and every consumer would hold a dead credential until the
|
|
// provider next asks.
|
|
func issuedRefusesRotation(shelf map[string]catalogue.Manifest, provision string) error {
|
|
if !offersIssued(shelf, provision) {
|
|
return nil
|
|
}
|
|
return fmt.Errorf("%s's credential is issued by its provider's software, which the mesh cannot make or "+
|
|
"rotate (ADR 0305): change it in that software, and `secret issued %s` takes the value it holds now. "+
|
|
"Nothing was rotated", provision, provision)
|
|
}
|
|
|
|
// secretIssued is `secret issued <provision>`, on this controller's stores and bus.
|
|
func secretIssued(ctx context.Context, args []string) error {
|
|
if len(args) != 1 || args[0] == "" || strings.HasPrefix(args[0], "-") {
|
|
return errors.New("secret issued <provision>")
|
|
}
|
|
provision := args[0]
|
|
open, err := openStores(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer open.Close()
|
|
t := issuedTaker{
|
|
providers: func(provision string) ([]issuedProvider, bool, error) {
|
|
return issuedProvidersOf(ctx, open.inventory, provision)
|
|
},
|
|
ask: func(p issuedProvider, args map[string]any) (link.Answer, error) {
|
|
var answer link.Answer
|
|
err := onTheBus(func(conn *nats.Conn) error {
|
|
var err error
|
|
answer, err = link.AskModuleToolOnAs(ctx, conn, broker.ControllerName, p.Module, p.Tool, p.Node,
|
|
args, issuedAsk)
|
|
return err
|
|
})
|
|
return answer, err
|
|
},
|
|
keep: func(provision, provider, value string) (inventory.IssuedKept, error) {
|
|
return open.inventory.KeepIssuedSecret(ctx, provision, provider, value)
|
|
},
|
|
record: func(act link.HandAct) error {
|
|
return onTheBus(func(conn *nats.Conn) error {
|
|
_, err := link.RecordHandAct(ctx, conn, act)
|
|
return err
|
|
})
|
|
},
|
|
send: func(machines []string) error { return sendTo(ctx, open, machines) },
|
|
ofTheVault: filledTheNewWay,
|
|
vault: theVault(ctx),
|
|
}
|
|
words, err := t.take(provision)
|
|
if words != "" {
|
|
fmt.Println(words)
|
|
}
|
|
return err
|
|
}
|