From 95f45b1a74564852fd6ed79d322023695ad6028d Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 9 Nov 2026 10:36:55 +0100 Subject: [PATCH] Keep a left-out module's openings in the filter: it still runs (issue 1966) A module left out of the declaration for a setting its new definition no longer composes (ADR 0163 rule 6) keeps running what it ran, but resolutionCompose dropped it from the modules the filter is derived from, so the filter closed the ports it still serves. On novox, 2026-11-09 07:46-09:24 UTC, the artifact store's want at build 6e1dfaa8 (listens on 5100, no container publishes 5000) met the node layer's ports {"5000": 5100}: GivenPorts refused it, distribution was left out, and 5100 closed while the old registry container served there; every build failed "dial tcp 10.10.0.1:5100: i/o timeout". The filter is now derived from the composed modules and the left-out ones; a left-out module's settings (exposure) are still not read. Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i --- internal/compose/resolution/declaration.go | 15 ++++++++--- internal/compose/resolution/filtering_test.go | 27 +++++++++++++++++++ 2 files changed, 38 insertions(+), 4 deletions(-) diff --git a/internal/compose/resolution/declaration.go b/internal/compose/resolution/declaration.go index 6f0f165..951883d 100644 --- a/internal/compose/resolution/declaration.go +++ b/internal/compose/resolution/declaration.go @@ -147,7 +147,7 @@ func resolutionCompose(r mcat.Resolution, with mcat.Rendering, owner map[string] // Before placing, because a placement is a setting too. left := LeftOut(r, with.Settings, with.Adopted) kept := make([]mcat.Manifest, 0, len(r.Modules)) - var stillBackedUp []mcat.Manifest + var stillBackedUp, stillRunning []mcat.Manifest for module, why := range with.NotPlaced { if _, already := left[module]; !already { left[module] = why @@ -162,6 +162,10 @@ func resolutionCompose(r mcat.Resolution, with mcat.Rendering, owner map[string] // the data it already holds on the machine is the reason to keep copying it. Only its data, // as the backup holder's lines are derived from it, and the directories they name. stillBackedUp = append(stillBackedUp, backupView(m)) + // **And what it runs is still let through** (issue 1966): its containers and services are left as they run, so + // the filter keeps opening what its listens say, at the machine ports this node holds for it, rather than + // closing a port that still serves (the artifact store's 5100 on the control-node, 98 minutes). + stillRunning = append(stillRunning, m) continue } kept = append(kept, m) @@ -255,7 +259,9 @@ func resolutionCompose(r mcat.Resolution, with mcat.Rendering, owner map[string] // Once, from every module's listens -- not per module. A module receiving only its own ports // would write a rule set that closed every other module on the machine. Each module's per-node // exposure settings override its listens' source first (novox/hq ADR 0046). - rules, err := Rules(r, with) + filtered := r + filtered.Modules = append(slices.Clone(r.Modules), stillRunning...) + rules, err := Rules(filtered, with) if err != nil { return nil, err } @@ -1242,8 +1248,9 @@ func resolutionFiltersHere(r mcat.Resolution) string { // is adopted or converged — the one loads it as a filter, the other declares it as openings. func Rules(r mcat.Resolution, with mcat.Rendering) ([]mcat.Rule, error) { // A module whose settings cannot compose is left out of the declaration (novox/hq ADR 0163, - // rule 6), and out of the filter with it: nothing of it is declared, so nothing of it is let - // through. + // rule 6), and its settings with it: its per-node exposure is not read, and its listens open + // as its manifest says them. It is not left out of the filter: what it runs is left running, + // so a port it serves stays open (issue 1966). left := LeftOut(r, with.Settings, with.Adopted) exposure := map[string]map[int]string{} for _, m := range r.Modules { diff --git a/internal/compose/resolution/filtering_test.go b/internal/compose/resolution/filtering_test.go index e8976c1..be43cc9 100644 --- a/internal/compose/resolution/filtering_test.go +++ b/internal/compose/resolution/filtering_test.go @@ -60,6 +60,33 @@ func TestTheModuleAskingForTheRuleSetGetsEveryModulesPorts(t *testing.T) { if !strings.Contains(content, "dport 443 accept") { t.Fatalf("the rule set holds only the asking module's ports:\n%s", content) } + + // Issue 1966, novox 2026-11-09 07:46-09:24 UTC: a module left out of the declaration for a setting its new definition + // no longer composes (ADR 0163 rule 6) keeps running what it ran, so the filter keeps letting it through. The + // artifact store's build 6e1dfaa8 listens on 5100 from a process and publishes no container port 5000, while its + // node layer still gave 5000 the machine port 5100: left out, and the filter closed 5100 for 98 minutes while the old + // registry container still served there; every build failed "dial tcp 10.10.0.1:5100: i/o timeout". + r.Modules = append(r.Modules, mcat.Manifest{Module: "distribution", + Listens: []mcat.Listening{{Name: "registry", Port: 5100, Protocol: "tcp", From: mcat.FromEverywhere}}, + Resources: []map[string]any{{"id": "store", "type": "container", "name": "mesh-registry", + "image": "registry@sha256:" + strings.Repeat("a", 64), "ports": []any{"127.0.0.1:5001:5001"}}}}) + with := mcat.Rendering{Mesh: []string{"198.51.100.2"}, OutwardLinks: []string{"eth0"}, TunnelInterface: "mesh0", + Settings: mcat.SettingsBy{"distribution": {{From: "novox", Placement: map[string]any{mcat.PortsSetting: map[string]any{"5000": 5100}}}}}} + if left := LeftOut(r, with.Settings, false); left["distribution"] == "" { + t.Fatalf("the stale port setting does not leave distribution out: %v", left) + } + if out, err = Declaration(r, with); err != nil { + t.Fatalf("declaration with a module left out: %v", err) + } + content = "" + for _, res := range out { + if res["path"] == "/etc/mesh/filter.nft" { + content, _ = res["content"].(string) + } + } + if !strings.Contains(content, "dport 5100 accept") || !strings.Contains(content, "dport 443 accept") { + t.Fatalf("the filter closes the port of a module left out of the declaration, which still runs:\n%s", content) + } } // The host does not sort, so the order the mesh writes is the order a machine applies.