Genesis registers the control plane with the manifest its build produced
The control plane's manifest existed twice: at the root of its repository, read whenever the mesh rebuilds it from source, and as a copy in the catalogue, read by genesis. Nothing kept them equal, and the first rebuild replaced the mesh's record with the repository's shape while every later push was refused (novox/hq 04-ISSUES/072). The builder's one-shot result already carries the manifest it built, artifact resolved to the image; step 3 keeps it and step 9 registers it, re-pinning the built image's bare id to the reference the registry assigned. The catalogue is still read for the registry's and the builder's manifests and for phase two.
This commit is contained in:
@@ -11,13 +11,15 @@ import (
|
||||
// that could go wrong quietly: pinning it to the wrong image, and delivering it store connections
|
||||
// the mesh invented rather than the ones the foundation actually made.
|
||||
|
||||
// theControlPlaneModule is the catalogue's manifest, trimmed to what this installer reads.
|
||||
// theControlPlaneModule is the manifest the build produces at step 3: the control plane's own,
|
||||
// from the root of its repository, its artifact resolved to the image the machine built — named by
|
||||
// the digest of its own configuration, with no registry in front (novox/hq ADR 0069).
|
||||
//
|
||||
// A fixture rather than the file itself, unlike the foundation example the rewrite tests use: the
|
||||
// catalogue is a different repository on a different branch, and a test that read it would pass or
|
||||
// fail according to what somebody else had checked out. What it must stay faithful to is the
|
||||
// SHAPE — the placeholder digest, the own-secret per context, the mount from the machine's path to
|
||||
// the container's, and the environment file that fills what is not a path.
|
||||
// control plane is a different repository on a different branch, and a test that read it would
|
||||
// pass or fail according to what somebody else had checked out. What it must stay faithful to is
|
||||
// the SHAPE — the built image's bare id, the own-secret per context, the mount from the machine's
|
||||
// path to the container's, and the environment file that fills what is not a path.
|
||||
const theControlPlaneModule = `{
|
||||
"module": "mesh-controller",
|
||||
"version": "1",
|
||||
@@ -37,7 +39,7 @@ const theControlPlaneModule = `{
|
||||
"mode": "0600",
|
||||
"content": "MESH_BROKER_AMQP=${secret:broker}\nMESH_BROKER_MANAGEMENT=${secret:broker-management}\nMESH_BROKER_ADDRESS=${machine:at}:5671\n"},
|
||||
{"id": "server", "type": "container", "name": "mesh-controller",
|
||||
"image": "mesh-controller@` + placeholderDigest + `",
|
||||
"image": "` + builtImage + `",
|
||||
"network": "host", "args": ["serve"],
|
||||
"env-file": ["/var/lib/mesh/mesh-controller/broker.env"],
|
||||
"env": {
|
||||
@@ -58,57 +60,62 @@ const theControlPlaneModule = `{
|
||||
const pushedReference = "127.0.0.1:5000/mesh-controller@sha256:" +
|
||||
"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
|
||||
|
||||
// **The whole reference moves, not only the digest.** The manifest's placeholder names a
|
||||
// repository too, and replacing sixty-four zeros inside it would leave `mesh-controller@sha256:…`
|
||||
// with no registry in front — which a runtime would go to the internet for, and this mesh's
|
||||
// control plane exists in no public registry by design.
|
||||
// builtImage is what step 3 built, as the machine that built it names it.
|
||||
const builtImage = "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
|
||||
|
||||
// theBuild is what step 3 hands step 9.
|
||||
func theBuild(manifest string) Built {
|
||||
return Built{Module: "mesh-controller", Commit: "a1b2c3d4", Image: builtImage, Manifest: []byte(manifest)}
|
||||
}
|
||||
|
||||
// **The whole reference moves.** The build names its image by the bare digest of its configuration,
|
||||
// which only the machine that built it can resolve; the mesh's record must name what the registry
|
||||
// assigned, `<registry>/<repository>@sha256:…`, or every other machine the module is pushed to
|
||||
// would go looking for an image nothing serves.
|
||||
func TestTheControlPlaneIsPinnedToWhatThisMeshsRegistryAssigned(t *testing.T) {
|
||||
pinned, places, err := pinImage([]byte(theControlPlaneModule), pushedReference, "mesh-controller")
|
||||
pinned, places, err := pinImage([]byte(theControlPlaneModule), builtImage, pushedReference, "mesh-controller")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if places != 1 {
|
||||
t.Errorf("the placeholder was found in %d place(s)", places)
|
||||
t.Errorf("the built image was found in %d place(s)", places)
|
||||
}
|
||||
if !strings.Contains(string(pinned), `"image": "`+pushedReference+`"`) {
|
||||
t.Errorf("the manifest does not name the pushed image:\n%s", pinned)
|
||||
}
|
||||
if strings.Contains(string(pinned), `"mesh-controller@sha256:`) {
|
||||
t.Errorf("the digest was replaced and the manifest's own repository name was left in "+
|
||||
"front of it, so nothing says which registry serves it:\n%s", pinned)
|
||||
if strings.Contains(string(pinned), builtImage) {
|
||||
t.Errorf("the built image's bare id survived, which no other machine can resolve:\n%s", pinned)
|
||||
}
|
||||
}
|
||||
|
||||
// A manifest already naming a real digest was pinned by somebody else, to some other build.
|
||||
// Registering it would install a control plane that is not the image this machine just published,
|
||||
// which is the one thing this step exists to guarantee.
|
||||
func TestAManifestAlreadyPinnedByHandIsRefused(t *testing.T) {
|
||||
already := strings.Replace(theControlPlaneModule, placeholderDigest,
|
||||
"sha256:"+strings.Repeat("9", 64), 1)
|
||||
if _, _, err := pinImage([]byte(already), pushedReference, "mesh-controller"); err == nil {
|
||||
t.Fatal("a manifest already pinned to some other image was accepted")
|
||||
// A manifest naming some other image describes some other build. Registering it would install a
|
||||
// control plane that is not the image this machine just published, which is the one thing this
|
||||
// step exists to guarantee.
|
||||
func TestAManifestNamingAnotherBuildIsRefused(t *testing.T) {
|
||||
other := strings.Replace(theControlPlaneModule, builtImage, "sha256:"+strings.Repeat("9", 64), 1)
|
||||
if _, _, err := pinImage([]byte(other), builtImage, pushedReference, "mesh-controller"); err == nil {
|
||||
t.Fatal("a manifest naming some other image was accepted")
|
||||
}
|
||||
}
|
||||
|
||||
// Every placeholder moves. A manifest naming its image in a second resource — a runtime container
|
||||
// beside the application's, which the catalogue's converted modules routinely carry — would
|
||||
// otherwise be left half pinned, and fail inside an apply rather than here.
|
||||
// Every place moves. A manifest naming its image in a second resource — a migrate step beside the
|
||||
// server — would otherwise be left half pinned, and fail inside an apply rather than here.
|
||||
func TestEveryPlaceTheManifestNamesTheImageIsPinned(t *testing.T) {
|
||||
twice := strings.Replace(theControlPlaneModule,
|
||||
`{"id": "mesh-state", "type": "directory", "path": "/var/lib/mesh/mesh-controller", "mode": "0700"},`,
|
||||
`{"id": "mesh-state", "type": "directory", "path": "/var/lib/mesh/mesh-controller", "mode": "0700"},
|
||||
{"id": "migrate", "type": "container", "name": "mesh-controller-migrate", "run-once": true,
|
||||
"image": "mesh-controller@`+placeholderDigest+`", "args": ["migrate"]},`, 1)
|
||||
"image": "`+builtImage+`", "args": ["migrate"]},`, 1)
|
||||
|
||||
pinned, places, err := pinImage([]byte(twice), pushedReference, "mesh-controller")
|
||||
pinned, places, err := pinImage([]byte(twice), builtImage, pushedReference, "mesh-controller")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if places != 2 {
|
||||
t.Errorf("the placeholder was found in %d place(s), and the manifest names it twice", places)
|
||||
t.Errorf("the built image was found in %d place(s), and the manifest names it twice", places)
|
||||
}
|
||||
if strings.Contains(string(pinned), placeholderDigest) {
|
||||
t.Error("a placeholder survived the pinning")
|
||||
if strings.Contains(string(pinned), builtImage) {
|
||||
t.Error("the built image's id survived the pinning")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -230,7 +237,7 @@ func TestAManifestWantingNoStoresIsRefusedWithTheShapeItShouldHave(t *testing.T)
|
||||
|
||||
bare := `{"module":"mesh-controller","version":"1","resources":[
|
||||
{"id":"container","type":"container","name":"mesh-controller",
|
||||
"image":"mesh-controller@` + placeholderDigest + `"}]}`
|
||||
"image":"` + builtImage + `"}]}`
|
||||
|
||||
_, err = deliverStores(context.Background(), Options{Node: "anchor"}, control,
|
||||
[]byte(bare), rewritten.Declaration, func(string) {})
|
||||
@@ -256,9 +263,11 @@ func TestThePermanentControlPlaneIsAskedTheSameQuestion(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
out, err := InstallControlPlane(context.Background(),
|
||||
installing(t, catalogueWith(t, ControlPlaneModule, theControlPlaneModule)),
|
||||
Deps{Run: runtime.run}, control, rewritten.Declaration, pushedReference, func(string) {})
|
||||
// No catalogue: the control plane's manifest is the one the build produced (novox/hq
|
||||
// 04-ISSUES/072), and step 9 reads nothing from the catalogue any more.
|
||||
out, err := InstallControlPlane(context.Background(), installing(t, t.TempDir()),
|
||||
Deps{Run: runtime.run}, control, rewritten.Declaration, theBuild(theControlPlaneModule),
|
||||
pushedReference, func(string) {})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user