jschoubben
e8aa7ed9e7
`rollout mint` gives every principal the new bus will have a credential it does not yet have and puts each where its owner reads it: a machine's as a membership — bus address, fingerprint, password, transport — sealed into its declaration (migration 0041, the `bus-membership` resource the host reads after applying); a module's as its broker secret, through the same delivery `module issue` uses; the control plane's own as its `bus` secret. Idempotent, and worked out from where the bus's module is assigned rather than from this process's environment, because this process is still on the old bus when it runs and must be. This is the half of design 28 task 5.2 the first live attempt found missing: a credential was minted only at enrolment, at `module issue` and for a person, so no machine already enrolled could ever be moved. `rollout check` was right to refuse; now there is something to run first.
673 lines
23 KiB
Go
673 lines
23 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"errors"
|
|
"flag"
|
|
"fmt"
|
|
"net"
|
|
"os"
|
|
"sort"
|
|
"strings"
|
|
|
|
"github.com/novox/mesh-controller/internal/broker"
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
"github.com/novox/mesh-controller/internal/inventory"
|
|
"github.com/novox/mesh-controller/internal/overlay"
|
|
)
|
|
|
|
// the catalogue: what exists, what is assigned, and how it is configured.
|
|
//
|
|
// Split out of main.go, which had reached 2,769 lines because appending was always the
|
|
// cheapest next step. That is how novox/hq ADR 0001 records `hal/sdk` reaching 34,636:
|
|
// nothing in it was wrong, and no one edit was the one that should have been a new file.
|
|
|
|
// provided is what comes with the control plane rather than from a repository.
|
|
//
|
|
// WireGuard, the names, and the domain module over both. The first two are here because the code
|
|
// that works out their files is here:
|
|
// a peer list is derived from every machine at once, so it cannot be written in a manifest, and
|
|
// whatever computes it has to live wherever the whole picture is.
|
|
//
|
|
// **It is a module in every other respect** — assigned, unassigned, resolved, settled, and absent
|
|
// from a machine nobody gave it to.
|
|
func providedModules() []catalogue.Manifest {
|
|
var out []catalogue.Manifest
|
|
for _, raw := range []map[string]any{
|
|
// **Two used to be here and are gone**: one wrote the mesh's names into a hosts file, the
|
|
// other wrote the same machines as wildcards for a resolver to read. Neither ran software
|
|
// and neither could be swapped for anything, which is the test of whether a thing is a
|
|
// module at all (novox/hq ADR 0040). They existed because computed output needed somewhere
|
|
// to live, and now a module says where it wants it — `facts` in its own manifest.
|
|
overlay.Manifest(), overlay.DomainManifest(),
|
|
} {
|
|
var m catalogue.Manifest
|
|
b, _ := json.Marshal(raw)
|
|
_ = json.Unmarshal(b, &m)
|
|
out = append(out, m)
|
|
}
|
|
return out
|
|
}
|
|
|
|
var provided = providedModules()
|
|
|
|
func moduleCommand(ctx context.Context, args []string) error {
|
|
if len(args) == 0 {
|
|
return errors.New("module add <file>, module list, or module forget <name>")
|
|
}
|
|
open, err := openStores(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer open.Close()
|
|
inv := open.inventory
|
|
|
|
switch args[0] {
|
|
case "add":
|
|
set := flag.NewFlagSet("module add", flag.ContinueOnError)
|
|
repo := set.String("source", "", "where this module comes from")
|
|
ref := set.String("ref", "", "the branch followed there")
|
|
commit := set.String("commit", "", "the commit this manifest was read at")
|
|
positionals, err := parseAround(set, args[1:])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if len(positionals) != 1 {
|
|
return errors.New("module add <manifest.json> [--source <repo> --ref <branch> --commit <sha>]")
|
|
}
|
|
raw, err := os.ReadFile(positionals[0])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
m, err := catalogue.ParseManifest(raw)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// Provenance together or not at all. A source with no commit cannot be compared against
|
|
// anything, so it would record where the module came from and still never be able to say
|
|
// the mesh is behind it — which is the one thing recording it is for.
|
|
if (*repo == "") != (*commit == "") {
|
|
return errors.New("--source and --commit go together: a source with no commit " +
|
|
"cannot be compared against anything, and a commit with no source has nothing " +
|
|
"to be compared with")
|
|
}
|
|
if err := inv.RegisterModule(ctx, m, inventory.Source{
|
|
Repository: *repo, Ref: *ref, BuiltFrom: *commit,
|
|
}); err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("%s registered", m.Module)
|
|
if *commit != "" {
|
|
fmt.Printf(" from %s", short(*commit))
|
|
}
|
|
if len(m.Provides) > 0 {
|
|
fmt.Printf(", providing %s", describeOffers(m.Provides))
|
|
}
|
|
fmt.Println()
|
|
for _, c := range m.Claims {
|
|
fmt.Printf(" claims %s, one per %s\n", c.Name, c.At())
|
|
}
|
|
return nil
|
|
|
|
case "list":
|
|
// The catalogue: what exists, where it came from, whether it is current, and who runs it.
|
|
// The provenance was recorded from the first build and nothing showed it, which made
|
|
// "is this current?" a question you could only answer by reading the database.
|
|
entries, err := inv.Catalogued(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if len(entries) == 0 {
|
|
fmt.Println("this mesh knows about no modules yet")
|
|
return nil
|
|
}
|
|
var stale int
|
|
for _, e := range entries {
|
|
m := e.Manifest
|
|
fmt.Printf("%-18s %-8s", m.Module, m.Version)
|
|
|
|
switch {
|
|
case e.Provided:
|
|
fmt.Printf(" %-22s", "with the control plane")
|
|
case e.Source.Repository == "":
|
|
// Handed over by hand. Legitimate — it is how a module is fixed in a hurry — and
|
|
// worth saying, because nothing can rebuild it.
|
|
fmt.Printf(" %-22s", "handed over")
|
|
case !e.Source.Current():
|
|
stale++
|
|
fmt.Printf(" %-22s", "behind "+short(e.Source.BuiltFrom)+" < "+short(e.Source.Head))
|
|
default:
|
|
fmt.Printf(" %-22s", "built "+short(e.Source.BuiltFrom))
|
|
}
|
|
|
|
if len(e.On) > 0 {
|
|
fmt.Printf(" on %s", strings.Join(e.On, ", "))
|
|
} else {
|
|
fmt.Printf(" on nothing")
|
|
}
|
|
fmt.Println()
|
|
|
|
var says []string
|
|
if len(m.Provides) > 0 {
|
|
says = append(says, "provides "+describeOffers(m.Provides))
|
|
}
|
|
if len(m.Requires) > 0 {
|
|
says = append(says, "requires "+strings.Join(m.Requires, ", "))
|
|
}
|
|
for _, c := range m.Claims {
|
|
says = append(says, "claims "+c.At()+"/"+c.Name)
|
|
}
|
|
if len(m.Capabilities) > 0 {
|
|
says = append(says, "needs "+strings.Join(m.Capabilities, ", "))
|
|
}
|
|
if len(says) > 0 {
|
|
fmt.Printf(" %s\n", strings.Join(says, " · "))
|
|
}
|
|
}
|
|
if stale > 0 {
|
|
fmt.Printf("\n%d module(s) behind their source — `build --behind` to catch up\n", stale)
|
|
}
|
|
return nil
|
|
|
|
case "moved":
|
|
if len(args) != 3 {
|
|
return errors.New("module moved <name> <commit> — the source has a newer commit")
|
|
}
|
|
if err := inv.SourceMoved(ctx, args[1], args[2]); err != nil {
|
|
return err
|
|
}
|
|
from, err := inv.SourceOf(ctx, args[1])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if from.Current() {
|
|
fmt.Printf("%s is current at %s\n", args[1], short(from.Head))
|
|
return nil
|
|
}
|
|
fmt.Printf("%s is behind: the mesh holds %s and the source has %s\n",
|
|
args[1], short(from.BuiltFrom), short(from.Head))
|
|
fmt.Printf(" run `build %s` to catch up\n", from.Repository)
|
|
return nil
|
|
|
|
case "forget":
|
|
// **What goes with it is said before it goes** (novox/hq 04-ISSUES/017). The settings, the
|
|
// module's own secrets and the ports the mesh chose all cascade off the module row, so
|
|
// `forget` used to destroy them and report "forgotten" — an action succeeding into a state
|
|
// its own verify would reject, and a sealed secret is not recoverable afterwards.
|
|
set := flag.NewFlagSet("module forget", flag.ContinueOnError)
|
|
andHeld := set.Bool("and-what-it-holds", false,
|
|
"discard its settings, its own secrets and its ports along with it")
|
|
positionals, err := parseAround(set, args[1:])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if len(positionals) != 1 {
|
|
return errors.New("module forget <name> [--and-what-it-holds]")
|
|
}
|
|
if !*andHeld {
|
|
if err := inv.ForgetModule(ctx, positionals[0]); err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("%s forgotten\n", positionals[0])
|
|
return nil
|
|
}
|
|
held, err := inv.DiscardModule(ctx, positionals[0])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("%s forgotten\n", positionals[0])
|
|
for _, line := range held.Lines() {
|
|
// Said after the fact as well as before it: this is the only record that these
|
|
// existed, and the next person to ask why the module came back empty reads it here.
|
|
fmt.Printf(" discarded%s\n", strings.TrimPrefix(line, " "))
|
|
}
|
|
return nil
|
|
|
|
case "issue":
|
|
// A module's broker account, scoped by its emits and consumes (novox/hq ADR 0043) and
|
|
// sealed to the machine that will run it — the generic case the builder was the first of.
|
|
set := flag.NewFlagSet("module issue", flag.ContinueOnError)
|
|
forNode := set.String("node", "",
|
|
"the machine that will run it, so the credential is delivered instead of printed")
|
|
positionals, err := parseAround(set, args[1:])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if len(positionals) != 1 {
|
|
return errors.New("module issue <module> --node <machine>")
|
|
}
|
|
module := positionals[0]
|
|
if *forNode == "" {
|
|
return errors.New("module issue needs --node: a module's account is sealed to the " +
|
|
"machine that runs it, and the mesh cannot read it back to print")
|
|
}
|
|
|
|
shelf, err := inv.Catalogue(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
m, ok := shelf[module]
|
|
if !ok {
|
|
return fmt.Errorf("this mesh knows no module %q; `module add` it first", module)
|
|
}
|
|
if err := mayIssue(m); err != nil {
|
|
return err
|
|
}
|
|
|
|
// Which bus this mesh is on. A module gets a credential for exactly one, and the two are
|
|
// made in entirely different ways: on the bus the mesh runs on today an account is a
|
|
// management call, and on the bus being built it is a row the next composition writes into
|
|
// the server's user list (novox/hq design 25 §4).
|
|
busAddress, onNATS, err := broker.OnNATS()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := broker.MustBeOneBus(os.Getenv(broker.AMQPVarName), busAddress); err != nil {
|
|
return err
|
|
}
|
|
if onNATS {
|
|
return issueOnTheNewBus(ctx, inv, m, *forNode, busAddress)
|
|
}
|
|
|
|
management, err := broker.ManagementFromEnvironment()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// The foundation owns the bus; make sure it exists before a module binds onto it.
|
|
if err := management.EnsureEventExchanges(ctx); err != nil {
|
|
return err
|
|
}
|
|
|
|
secret := make([]byte, 32)
|
|
if _, err := rand.Read(secret); err != nil {
|
|
return err
|
|
}
|
|
password := base64.RawURLEncoding.EncodeToString(secret)
|
|
account, err := management.CreateModuleAccount(ctx, *forNode, module, password, m.Emits, m.Consumes)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// A consumer's queue, with its dead-letter, is the foundation's to declare — its own account
|
|
// may not (ADR 0043). Made now, so it exists before the module binds onto it.
|
|
if len(m.Consumes) > 0 {
|
|
if err := management.EnsureModuleQueue(ctx, *forNode, module); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
known, err := broker.FromEnvironment()
|
|
if err != nil {
|
|
return fmt.Errorf("cannot deliver a credential without knowing where the broker is: %w", err)
|
|
}
|
|
brokerAddr, err := brokerReachableAt(ctx, inv, known, *forNode)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// The URL and what verifies the broker, together — a mesh's broker presents its own
|
|
// certificate, in no public trust store, so a URL alone fails at TLS (as `builder issue`).
|
|
held, err := json.Marshal(struct {
|
|
URL string `json:"url"`
|
|
Fingerprint string `json:"fingerprint,omitempty"`
|
|
Node string `json:"node"`
|
|
Module string `json:"module"`
|
|
}{
|
|
URL: fmt.Sprintf("amqps://%s:%s@%s/", account, password, brokerAddr),
|
|
Fingerprint: known.Fingerprint,
|
|
// The node and module the account is for, so the runtime names its queue as the mesh
|
|
// scoped it (<node>.<module>.events) without a manifest having to interpolate a node.
|
|
Node: *forNode,
|
|
Module: module,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := inv.AcceptSecretForModule(ctx, *forNode, module, "broker", string(held)); err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("broker account %s created for %s, scoped to what it emits and consumes\n",
|
|
account, module)
|
|
fmt.Printf(" sealed to %s. It arrives with the next push — `push %s` to send it\n",
|
|
*forNode, *forNode)
|
|
return nil
|
|
|
|
default:
|
|
return fmt.Errorf("module has no %q; it has add, list, moved, forget and issue", args[0])
|
|
}
|
|
}
|
|
|
|
func assignCommand(ctx context.Context, verb string, args []string) error {
|
|
if len(args) != 2 {
|
|
return fmt.Errorf("%s <node> <module>", verb)
|
|
}
|
|
open, err := openStores(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer open.Close()
|
|
|
|
// The act itself is in acts.go, so the command API refuses exactly what this refuses
|
|
// (novox/hq ADR 0035). What differs between the surfaces is how the answer is printed.
|
|
act := assign
|
|
if verb == "unassign" {
|
|
act = unassign
|
|
}
|
|
said, err := act(ctx, open, args[0], args[1])
|
|
if said != "" {
|
|
fmt.Println(said)
|
|
}
|
|
if err != nil {
|
|
fmt.Println()
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func settingsCommand(ctx context.Context, args []string) error {
|
|
if len(args) == 0 {
|
|
return errors.New("settings set <module> <file> [--node <node>], or settings clear <module> [--node <node>]")
|
|
}
|
|
open, err := openStores(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer open.Close()
|
|
inv := open.inventory
|
|
|
|
set := flag.NewFlagSet("settings", flag.ContinueOnError)
|
|
node := set.String("node", "", "one machine, rather than the whole mesh")
|
|
positionals, err := parseAround(set, args[1:])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
where := "the whole mesh"
|
|
if *node != "" {
|
|
where = *node
|
|
}
|
|
|
|
switch args[0] {
|
|
case "set":
|
|
if len(positionals) != 2 {
|
|
return errors.New("settings set <module> <settings.json> [--node <node>]")
|
|
}
|
|
raw, err := os.ReadFile(positionals[1])
|
|
if err != nil {
|
|
return err
|
|
}
|
|
var values map[string]any
|
|
if err := json.Unmarshal(raw, &values); err != nil {
|
|
return fmt.Errorf("%s is not a settings file: %w", positionals[1], err)
|
|
}
|
|
if err := inv.SetSettings(ctx, *node, positionals[0], values); err != nil {
|
|
return err
|
|
}
|
|
|
|
var keys []string
|
|
for k := range values {
|
|
keys = append(keys, k)
|
|
}
|
|
sort.Strings(keys)
|
|
fmt.Printf("%s on %s: %s\n", positionals[0], where, strings.Join(keys, ", "))
|
|
fmt.Println(" run `push` to send it")
|
|
return nil
|
|
|
|
case "clear":
|
|
if len(positionals) != 1 {
|
|
return errors.New("settings clear <module> [--node <node>]")
|
|
}
|
|
if err := inv.ClearSettings(ctx, *node, positionals[0]); err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("%s on %s is back to what the module says\n", positionals[0], where)
|
|
return nil
|
|
|
|
default:
|
|
return fmt.Errorf("settings has no %q; it has set and clear", args[0])
|
|
}
|
|
}
|
|
|
|
// describeOffers says what a module provides, and marks the ones answered from anywhere in the
|
|
// mesh — because "provides a database" and "provides a shell" are read the same way and mean
|
|
// entirely different things about where the answer has to be.
|
|
func describeOffers(offers []catalogue.Offer) string {
|
|
var out []string
|
|
for _, o := range offers {
|
|
if o.At() == catalogue.ScopeMesh {
|
|
out = append(out, o.Name+" (from anywhere in the mesh)")
|
|
continue
|
|
}
|
|
out = append(out, o.Name)
|
|
}
|
|
return strings.Join(out, ", ")
|
|
}
|
|
|
|
// pinCommand says which node a machine gets a provision from.
|
|
//
|
|
// Needed only when more than one could answer, and recordable before that -- a mesh with one
|
|
// database should not change where an existing machine gets its data the day a second one
|
|
// arrives.
|
|
func pinCommand(ctx context.Context, args []string, setting bool) error {
|
|
if setting && len(args) != 3 {
|
|
return errors.New("pin <node> <provision> <from-node>")
|
|
}
|
|
if !setting && len(args) != 2 {
|
|
return errors.New("unpin <node> <provision>")
|
|
}
|
|
open, err := openStores(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer open.Close()
|
|
inv := open.inventory
|
|
|
|
if !setting {
|
|
if err := inv.UnpinProvision(ctx, args[0], args[1]); err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("%s is no longer told where to get %s from\n", args[0], args[1])
|
|
return nil
|
|
}
|
|
if args[0] == args[2] {
|
|
// Allowed by nothing here, and worth saying rather than resolving into a confusing
|
|
// refusal later: a node providing something to itself is a node-scoped provision, and
|
|
// this field is for the other kind.
|
|
return fmt.Errorf("%s cannot get %s from itself; that would be a provision this machine "+
|
|
"provides, which does not need saying", args[0], args[1])
|
|
}
|
|
if err := inv.PinProvision(ctx, args[0], args[1], args[2]); err != nil {
|
|
return err
|
|
}
|
|
fmt.Printf("%s gets %s from %s\n", args[0], args[1], args[2])
|
|
fmt.Printf(" run `push %s` to send it\n", args[0])
|
|
return nil
|
|
}
|
|
|
|
// theBrokerSeat is the mesh-scoped seat the broker module claims (novox/hq ADR 0079: a
|
|
// foundation seat is named after the server it guards).
|
|
const theBrokerSeat = "mesh-broker"
|
|
|
|
// brokerReachableAt is the broker's address as the given node can reach it.
|
|
//
|
|
// The genesis address (MESH_BROKER_ADDRESS) is the broker's public endpoint — right for a machine
|
|
// that can dial it, wrong across the mesh, where the path is the overlay. A node that is ON the
|
|
// overlay is given the overlay name of the node HOLDING the broker — the one assigned a module
|
|
// claiming the mesh-broker seat — because that is where the broker is, whatever else the topology
|
|
// says. Only when nothing holds the seat yet (genesis raised the broker as plumbing and no module
|
|
// has adopted it) does the hub stand in, which is where the foundation is by convention.
|
|
//
|
|
// "On the overlay" is what `whereEveryoneIs` answers — a machine that RESOLVED the networking
|
|
// module — not "has an address", which is true of every placed machine and says nothing about
|
|
// whether anything can reach it (novox/hq issue 059). A node not on the overlay — at genesis,
|
|
// before any `overlay place`, which is when the builder's account is issued — keeps the genesis
|
|
// address, so nothing about bring-up changes. This is issue 055, corrected by 059.
|
|
func brokerReachableAt(ctx context.Context, inv *inventory.Inventory, known broker.Broker, node string) (string, error) {
|
|
shelf, err := inv.Catalogue(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
|
|
if err != nil {
|
|
// No catalogue yet is genesis, and at genesis the genesis address is the right one.
|
|
return known.Address, nil
|
|
}
|
|
if onNetwork[node] == "" {
|
|
return known.Address, nil
|
|
}
|
|
|
|
// Where the broker is: the node whose assigned set includes a module claiming the seat.
|
|
holders := map[string]bool{}
|
|
for name, m := range shelf {
|
|
for _, c := range m.Claims {
|
|
if c.Name == theBrokerSeat && c.At() == catalogue.ScopeMesh {
|
|
holders[name] = true
|
|
}
|
|
}
|
|
}
|
|
brokerAt := ""
|
|
if len(holders) > 0 {
|
|
overlays, err := inv.Overlays(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
for _, o := range overlays {
|
|
assigned, err := inv.Assigned(ctx, o.Name)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
for _, a := range assigned {
|
|
if holders[a] && onNetwork[o.Name] != "" {
|
|
brokerAt = onNetwork[o.Name]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if brokerAt == "" {
|
|
// Nothing holds the seat (or its node is not on the overlay): the hub, where the
|
|
// foundation is by convention — and only a hub that is itself on the overlay, or the
|
|
// name we hand out routes nowhere.
|
|
overlays, err := inv.Overlays(ctx)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
for _, o := range overlays {
|
|
if o.Hub && onNetwork[o.Name] != "" {
|
|
brokerAt = onNetwork[o.Name]
|
|
}
|
|
}
|
|
}
|
|
if brokerAt == "" {
|
|
return known.Address, nil
|
|
}
|
|
// A portless genesis address is a working configuration (amqps defaults to 5671), and
|
|
// silently keeping the public address would disable this whole path — so the port defaults
|
|
// rather than the fix dissolving (novox/hq issue 059).
|
|
_, port, err := net.SplitHostPort(known.Address)
|
|
if err != nil {
|
|
port = "5671"
|
|
}
|
|
return net.JoinHostPort(brokerAt, port), nil
|
|
}
|
|
|
|
// mayIssue says whether a module can be given a broker account. The account is delivered as the
|
|
// module's own secret named broker; a module that declares none has nothing to read it with, and
|
|
// an account nothing reads is an orphan on the bus (novox/hq 04-ISSUES/078). Said before the
|
|
// account is made, not after.
|
|
func mayIssue(m catalogue.Manifest) error {
|
|
if _, reads := m.OwnSecrets["broker"]; !reads {
|
|
return fmt.Errorf("%s declares no own secret named broker, so there is nowhere to deliver "+
|
|
"an account; a module that speaks on the bus declares \"own-secrets\": {\"broker\": <path>}", m.Module)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// issueOnTheNewBus gives an assigned module its credential on the bus being built.
|
|
//
|
|
// **Three things differ from a management call, and each is the point of the move.** The credential
|
|
// is minted into the mesh's records and becomes usable at the next composition, so there is no
|
|
// server to be reachable for this to work. The password travels beside the address rather than inside
|
|
// it, because the runtime's contract already separates them and a credential embedded in a URL is one
|
|
// that leaks into every log line that prints a connection. And the module's durable consumer is
|
|
// derived from what it declared rather than declared by name, so a module cannot ask for delivery of
|
|
// something it did not say it consumes.
|
|
func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest,
|
|
node, busAddress string) error {
|
|
|
|
user := broker.Principal{Kind: broker.KindModule, Node: node, Module: m.Module}.Username()
|
|
password, err := inv.MintBusPassword(ctx, inventory.BusUser{
|
|
Username: user, Kind: inventory.BusModule, Node: node, Module: m.Module,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Where the module is told to find the bus, and what certificate it must present. The same pair
|
|
// a node is told, for the same reason: a mesh's bus presents its own certificate, in no public
|
|
// trust store, so an address alone fails at TLS.
|
|
known, err := broker.FromEnvironment()
|
|
if err != nil {
|
|
return fmt.Errorf("cannot deliver a credential without knowing where the bus is: %w", err)
|
|
}
|
|
reachable, err := brokerReachableAt(ctx, inv, known, node)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password)
|
|
}
|
|
|
|
// issueWith is the delivery half: the minted password sealed to the machine as the module's broker
|
|
// secret, and the module's consumer created where the bus can be reached. Split from the minting
|
|
// so the move can issue every module against a bus whose address it worked out itself
|
|
// (`rollout mint`, design 28 task 5.2) rather than the one in this process's environment.
|
|
func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest,
|
|
node, busAddress string, known broker.Broker, reachable, user, password string) error {
|
|
held, err := json.Marshal(struct {
|
|
URL string `json:"url"`
|
|
Fingerprint string `json:"fingerprint,omitempty"`
|
|
Node string `json:"node"`
|
|
Module string `json:"module"`
|
|
User string `json:"user"`
|
|
Password string `json:"password"`
|
|
}{
|
|
URL: "nats://" + reachable, Fingerprint: known.Fingerprint,
|
|
Node: node, Module: m.Module, User: user, Password: password,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := inv.AcceptSecretForModule(ctx, node, m.Module, "broker", string(held)); err != nil {
|
|
return err
|
|
}
|
|
|
|
// And how it hears what it consumes. Derived from its declaration, and only when it declared
|
|
// something: a module that consumes nothing needs no consumer, and creating one would be a
|
|
// durable subscription nobody reads.
|
|
if consumer, needed := broker.ConsumerFor(broker.Principal{
|
|
Kind: broker.KindModule, Node: node, Module: m.Module,
|
|
Emits: m.Emits, Consumes: m.Consumes, Serves: m.Tools,
|
|
}); needed {
|
|
if busAddress == "" {
|
|
fmt.Printf(" %s consumes; its consumer is created when the bus is reachable (`push`, then "+
|
|
"`rollout mint` again is harmless)\n", m.Module)
|
|
} else {
|
|
js, err := broker.Dial(busAddress)
|
|
if err != nil {
|
|
return fmt.Errorf("the credential is minted and the mesh cannot reach the bus to create "+
|
|
"how %s hears what it consumes: %w", m.Module, err)
|
|
}
|
|
defer js.Close()
|
|
if err := js.EnsureConsumer(consumer); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
}
|
|
|
|
fmt.Printf("bus user %s minted for %s, scoped to what it emits and consumes\n", user, m.Module)
|
|
fmt.Printf(" sealed to %s. It arrives with the next push — `push %s` to send it\n", node, node)
|
|
fmt.Printf(" and it works once the bus has been told: the user list is composed into the " +
|
|
"machine holding mesh-broker\n")
|
|
return nil
|
|
}
|