jschoubben
1469f5ff82
`secret rotate <node> <module> <name>` makes the secret anew the way the first mint did, seals it
to the machine and the operator, and sends the machine, so the module starts again on the new value
— said in the log with who asked and when, never the value. Only for a secret whose definition says
`"taken": "at-start"`: an own secret is now a path, or {path, taken}, and a definition that says
nothing of how a secret is taken is refused with the word to write, because a credential rotated
under software that never reads it again is worse than one left alone (issue 179). `applied` is
refused by name until the staged form ADR 0114 decided is built; a value given to the mesh is
refused as ADR 0113 says. `rotate` is a verb on the controller's seat with two shapes — a pair
credential by provision, an own secret by machine, module and name — so the console can ask.
Registered manifests keep their bytes: a path alone is written back as a path.
326 lines
13 KiB
Go
326 lines
13 KiB
Go
package catalogue
|
|
|
|
// A directory the mesh places (novox/hq ADR 0112). These tests pin the contract: a pathless
|
|
// directory resolves under the node's root, ${dir:…} names it from every field a host path can
|
|
// live in, a stated path is the adopted-data placement and wins, an unknown reference refuses at
|
|
// the manifest, and filling for one node never leaks into the next composition.
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func placedModule() Manifest {
|
|
return Manifest{
|
|
Module: "photos",
|
|
Resources: []map[string]any{
|
|
{"id": "data", "type": "directory", "mode": "0700"},
|
|
{"id": "server-env", "type": "file", "path": "${dir:data}/server.env",
|
|
"content": "STORE=${dir:data}/objects\n"},
|
|
{"id": "server", "type": "container", "name": "photos-server",
|
|
"volumes": []any{"${dir:data}:/data"},
|
|
"env": map[string]any{"DATA": "${dir:data}/objects"},
|
|
"env-file": []any{"${dir:data}/server.env"}},
|
|
},
|
|
}
|
|
}
|
|
|
|
func TestAPathlessDirectoryResolvesUnderTheNodesRoot(t *testing.T) {
|
|
m := placedModule()
|
|
dirs := dirsFor(m, Rendering{})
|
|
if dirs["data"] != "/var/lib/photos/data" {
|
|
t.Fatalf("the default root is /var/lib and the shape is <root>/<module>/<id>; got %q", dirs["data"])
|
|
}
|
|
dirs = dirsFor(m, Rendering{DataRoot: "/tank/nox/"})
|
|
if dirs["data"] != "/tank/nox/photos/data" {
|
|
t.Fatalf("a node's own root is honoured, trailing slash and all; got %q", dirs["data"])
|
|
}
|
|
}
|
|
|
|
func TestDirReferencesBecomeThePlaceInEveryField(t *testing.T) {
|
|
m := placedModule()
|
|
dirs := dirsFor(m, Rendering{})
|
|
|
|
directory := shallowCopy(m.Resources[0])
|
|
if err := dirInto(directory, dirs, m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if directory["path"] != "/var/lib/photos/data" {
|
|
t.Fatalf("a pathless directory receives its resolved path; got %v", directory["path"])
|
|
}
|
|
|
|
file := shallowCopy(m.Resources[1])
|
|
if err := dirInto(file, dirs, m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if file["path"] != "/var/lib/photos/data/server.env" {
|
|
t.Fatalf("a file's path names the place; got %v", file["path"])
|
|
}
|
|
if file["content"] != "STORE=/var/lib/photos/data/objects\n" {
|
|
t.Fatalf("a file's content names the place; got %v", file["content"])
|
|
}
|
|
|
|
container := shallowCopy(m.Resources[2])
|
|
if err := dirInto(container, dirs, m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if container["volumes"].([]any)[0] != "/var/lib/photos/data:/data" {
|
|
t.Fatalf("a mount names the place; got %v", container["volumes"])
|
|
}
|
|
if container["env"].(map[string]any)["DATA"] != "/var/lib/photos/data/objects" {
|
|
t.Fatalf("an environment value names the place; got %v", container["env"])
|
|
}
|
|
if container["env-file"].([]any)[0] != "/var/lib/photos/data/server.env" {
|
|
t.Fatalf("an env-file names the place; got %v", container["env-file"])
|
|
}
|
|
}
|
|
|
|
func TestAStatedPathIsThePlacementAndStillAnswersByName(t *testing.T) {
|
|
m := placedModule()
|
|
// The adopted-machine case: data that must sit where the predecessor already put it.
|
|
m.Resources[0]["path"] = "/services/mssql/data/"
|
|
dirs := dirsFor(m, Rendering{})
|
|
if dirs["data"] != "/services/mssql/data" {
|
|
t.Fatalf("a stated path wins over the root, trimmed; got %q", dirs["data"])
|
|
}
|
|
container := shallowCopy(m.Resources[2])
|
|
if err := dirInto(container, dirs, m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if container["volumes"].([]any)[0] != "/services/mssql/data:/data" {
|
|
t.Fatalf("references follow the placement; got %v", container["volumes"])
|
|
}
|
|
}
|
|
|
|
func TestFillingForOneNodeLeaksIntoNoOther(t *testing.T) {
|
|
m := placedModule()
|
|
first := shallowCopy(m.Resources[2])
|
|
if err := dirInto(first, dirsFor(m, Rendering{DataRoot: "/first"}), m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second := shallowCopy(m.Resources[2])
|
|
if err := dirInto(second, dirsFor(m, Rendering{DataRoot: "/second"}), m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got := second["volumes"].([]any)[0]; got != "/second/photos/data:/data" {
|
|
t.Fatalf("the second composition must see the manifest, not the first fill; got %v", got)
|
|
}
|
|
if m.Resources[2]["volumes"].([]any)[0] != "${dir:data}:/data" {
|
|
t.Fatalf("the manifest itself stays a template; got %v", m.Resources[2]["volumes"])
|
|
}
|
|
}
|
|
|
|
func TestAReferenceToNoDirectoryRefusesAtTheManifest(t *testing.T) {
|
|
m := placedModule()
|
|
m.Resources[2]["volumes"] = []any{"${dir:date}:/data"} // a typo, the likely shape
|
|
problems := m.unknownDirRefs()
|
|
if len(problems) != 1 || !strings.Contains(problems[0], `${dir:date}`) {
|
|
t.Fatalf("a reference naming no directory is a manifest problem; got %v", problems)
|
|
}
|
|
if got := placedModule().unknownDirRefs(); len(got) != 0 {
|
|
t.Fatalf("a correct definition has none; got %v", got)
|
|
}
|
|
}
|
|
|
|
func TestAReferenceToNoDirectoryRefusesAtCompositionToo(t *testing.T) {
|
|
m := placedModule()
|
|
container := shallowCopy(m.Resources[2])
|
|
container["env"] = map[string]any{"DATA": "${dir:date}"}
|
|
err := dirInto(container, dirsFor(m, Rendering{}), m.Module)
|
|
if err == nil || !strings.Contains(err.Error(), `"date"`) || !strings.Contains(err.Error(), `"data"`) {
|
|
t.Fatalf("the refusal names the mistake and what exists; got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestTheAssignmentsOwnRootIsAPlace(t *testing.T) {
|
|
m := Manifest{Module: "mailu", Resources: []map[string]any{
|
|
{"id": "state", "type": "directory", "place": ".", "mode": "0700"},
|
|
{"id": "data-mail", "type": "directory"},
|
|
}}
|
|
dirs := dirsFor(m, Rendering{})
|
|
if dirs["state"] != "/var/lib/mailu" {
|
|
t.Fatalf("place %q is the assignment's root; got %q", ".", dirs["state"])
|
|
}
|
|
if dirs["data-mail"] != "/var/lib/mailu/data-mail" {
|
|
t.Fatalf("everything else sits beneath it; got %q", dirs["data-mail"])
|
|
}
|
|
root := shallowCopy(m.Resources[0])
|
|
if err := dirInto(root, dirs, m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if root["path"] != "/var/lib/mailu" {
|
|
t.Fatalf("the root receives its path; got %v", root["path"])
|
|
}
|
|
if _, still := root["place"]; still {
|
|
t.Fatal("place must never reach the host, which parses strictly")
|
|
}
|
|
}
|
|
|
|
func TestTheManifestsMapsArePlaced(t *testing.T) {
|
|
m := Manifest{
|
|
Module: "photos",
|
|
Resources: []map[string]any{
|
|
{"id": "state", "type": "directory", "place": "."},
|
|
},
|
|
Binds: map[string]string{"route": "${dir:state}/route.json"},
|
|
Secrets: map[string]string{"mongodb-database": "${dir:state}/database.secret"},
|
|
OwnSecrets: OwnSecrets{"admin-key": {Path: "${dir:state}/admin-key.secret"}},
|
|
Receives: map[string]string{"route": "${dir:state}/grants/mesh.json"},
|
|
}
|
|
placed, err := placedManifest(m, Rendering{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if placed.Binds["route"] != "/var/lib/photos/route.json" {
|
|
t.Fatalf("binds are placed; got %v", placed.Binds)
|
|
}
|
|
if placed.Secrets["mongodb-database"] != "/var/lib/photos/database.secret" {
|
|
t.Fatalf("secrets are placed; got %v", placed.Secrets)
|
|
}
|
|
if placed.OwnSecrets["admin-key"].Path != "/var/lib/photos/admin-key.secret" {
|
|
t.Fatalf("own-secrets are placed; got %v", placed.OwnSecrets)
|
|
}
|
|
if placed.Receives["route"] != "/var/lib/photos/grants/mesh.json" {
|
|
t.Fatalf("receives are placed; got %v", placed.Receives)
|
|
}
|
|
if m.Binds["route"] != "${dir:state}/route.json" {
|
|
t.Fatalf("the manifest itself stays a template; got %v", m.Binds)
|
|
}
|
|
}
|
|
|
|
func TestAMapReferenceToNoDirectoryRefusesAtTheManifest(t *testing.T) {
|
|
m := Manifest{
|
|
Module: "photos",
|
|
Resources: []map[string]any{{"id": "state", "type": "directory", "place": "."}},
|
|
Binds: map[string]string{"route": "${dir:stat}/route.json"},
|
|
}
|
|
problems := m.unknownDirRefs()
|
|
if len(problems) != 1 || !strings.Contains(problems[0], `${dir:stat}`) {
|
|
t.Fatalf("a map naming no directory is a manifest problem; got %v", problems)
|
|
}
|
|
}
|
|
|
|
func TestPlaceIsValidatedAtTheManifest(t *testing.T) {
|
|
both := Manifest{Module: "x", Resources: []map[string]any{
|
|
{"id": "d", "type": "directory", "place": ".", "path": "/somewhere"},
|
|
}}
|
|
if got := both.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], "both path and place") {
|
|
t.Fatalf("path beside place refuses; got %v", got)
|
|
}
|
|
elsewhere := Manifest{Module: "x", Resources: []map[string]any{
|
|
{"id": "f", "type": "file", "place": ".", "path": "/somewhere", "content": ""},
|
|
}}
|
|
if got := elsewhere.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], "not a directory") {
|
|
t.Fatalf("place on a file refuses; got %v", got)
|
|
}
|
|
wrong := Manifest{Module: "x", Resources: []map[string]any{
|
|
{"id": "d", "type": "directory", "place": "sub/dir"},
|
|
}}
|
|
if got := wrong.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], `the places are "."`) {
|
|
t.Fatalf("a place that is neither root refuses; got %v", got)
|
|
}
|
|
}
|
|
|
|
func TestTheMeshsDirectoryForAModuleIsAPlace(t *testing.T) {
|
|
// novox/hq issue 174. What the mesh writes for a module — its bus credential, its bindings —
|
|
// is the mesh's plumbing under <root>/mesh/<module>, and the definition names it by id.
|
|
m := Manifest{Module: "umami",
|
|
Resources: []map[string]any{
|
|
{"id": "mesh-state", "type": "directory", "place": "mesh"},
|
|
{"id": "state", "type": "directory", "place": "."},
|
|
{"id": "server", "type": "container", "image": "x@sha256:aa",
|
|
"volumes": []any{"${dir:mesh-state}/broker:/run/secrets/broker:ro"}},
|
|
},
|
|
OwnSecrets: OwnSecrets{"broker": {Path: "${dir:mesh-state}/broker"}},
|
|
Binds: map[string]string{"route": "${dir:state}/route.json"},
|
|
}
|
|
if got := m.unknownDirRefs(); len(got) != 0 {
|
|
t.Fatalf("place %q is a place; got %v", "mesh", got)
|
|
}
|
|
dirs := dirsFor(m, Rendering{})
|
|
if dirs["mesh-state"] != "/var/lib/mesh/umami" || dirs["state"] != "/var/lib/umami" {
|
|
t.Fatalf("the mesh's directory sits beside the module's, not in it; got %v", dirs)
|
|
}
|
|
dirs = dirsFor(m, Rendering{DataRoot: "/srv"})
|
|
if dirs["mesh-state"] != "/srv/mesh/umami" {
|
|
t.Fatalf("a node's root moves the mesh's files with the module's; got %v", dirs)
|
|
}
|
|
placed, err := placedManifest(m, Rendering{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if placed.OwnSecrets["broker"].Path != "/var/lib/mesh/umami/broker" {
|
|
t.Fatalf("own-secrets are placed under the mesh's directory; got %v", placed.OwnSecrets)
|
|
}
|
|
container := shallowCopy(m.Resources[2])
|
|
if err := dirInto(container, dirsFor(m, Rendering{}), m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if container["volumes"].([]any)[0] != "/var/lib/mesh/umami/broker:/run/secrets/broker:ro" {
|
|
t.Fatalf("the mount's host side is placed; got %v", container["volumes"])
|
|
}
|
|
}
|
|
|
|
func TestTwoModulesPlacedRootsAreNoCollision(t *testing.T) {
|
|
a := Manifest{Module: "gitea", Resources: []map[string]any{
|
|
{"id": "state", "type": "directory", "place": "."},
|
|
{"id": "env", "type": "file", "path": "${dir:state}/server.env", "content": ""},
|
|
}}
|
|
b := Manifest{Module: "nextcloud", Resources: []map[string]any{
|
|
{"id": "state", "type": "directory", "place": "."},
|
|
{"id": "env", "type": "file", "path": "${dir:state}/server.env", "content": ""},
|
|
}}
|
|
if got := checkResources([]Manifest{a, b}); len(got) != 0 {
|
|
t.Fatalf("alike templates are different places; got %v", got)
|
|
}
|
|
// And the real collision is still caught: a module stating another's placed root.
|
|
c := Manifest{Module: "squatter", Resources: []map[string]any{
|
|
{"id": "nest", "type": "directory", "path": "/var/lib/gitea"},
|
|
}}
|
|
got := checkResources([]Manifest{a, c})
|
|
if len(got) != 1 || !strings.Contains(got[0], `"/var/lib/gitea"`) {
|
|
t.Fatalf("a stated path on a placed root collides; got %v", got)
|
|
}
|
|
}
|
|
|
|
func shallowCopy(resource map[string]any) map[string]any {
|
|
copied := map[string]any{}
|
|
for k, v := range resource {
|
|
copied[k] = v
|
|
}
|
|
return copied
|
|
}
|
|
|
|
func TestADirectoryBeneathAPlacedOneIsPlacedWithIt(t *testing.T) {
|
|
// An adopted layout keeps a subdirectory the predecessor made under the mesh's directory
|
|
// (issue 174: a forge's runtime state, a manager's output). Stated as beneath the placed one,
|
|
// it moves with it — a node's root moves both, and the definition names no host path.
|
|
m := Manifest{Module: "gitea", Resources: []map[string]any{
|
|
{"id": "mesh-state", "type": "directory", "place": "mesh"},
|
|
{"id": "runtime-state", "type": "directory", "path": "${dir:mesh-state}/state"},
|
|
{"id": "server", "type": "container", "image": "x@sha256:aa",
|
|
"volumes": []any{"${dir:runtime-state}:/data"}},
|
|
}}
|
|
if got := m.unknownDirRefs(); len(got) != 0 {
|
|
t.Fatalf("a path beneath a placed directory is well formed; got %v", got)
|
|
}
|
|
dirs := dirsFor(m, Rendering{DataRoot: "/srv"})
|
|
if dirs["runtime-state"] != "/srv/mesh/gitea/state" {
|
|
t.Fatalf("the subdirectory follows the placed one; got %v", dirs)
|
|
}
|
|
sub := shallowCopy(m.Resources[1])
|
|
if err := dirInto(sub, dirs, m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if sub["path"] != "/srv/mesh/gitea/state" {
|
|
t.Fatalf("the directory resource itself is resolved; got %v", sub["path"])
|
|
}
|
|
container := shallowCopy(m.Resources[2])
|
|
if err := dirInto(container, dirs, m.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if container["volumes"].([]any)[0] != "/srv/mesh/gitea/state:/data" {
|
|
t.Fatalf("a reference to the subdirectory resolves whole; got %v", container["volumes"])
|
|
}
|
|
}
|