Take the catalogue's composition rules into the node-engine
ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk carries no composition rule. The catalogue functions only the node-engine's composition reaches (Resolve, Resolution's Compose, Declaration, DataItems, LeftOut, Rules and the rest, the settings, placeholder and template refusals, the rendering helpers) are copied with their tests into internal/compose/resolution; a method of a mesh-sdk shape becomes a function taking it first. The composition calls its own copies, and the captured catalogue its tests read lives here now, shared by mesh-compose's tests. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
This commit is contained in:
@@ -0,0 +1,421 @@
|
||||
package resolution
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
|
||||
)
|
||||
|
||||
var bundleDigest = "sha256:" + strings.Repeat("b", 64)
|
||||
|
||||
// aToolsModule is a module whose tools come as a compiled bundle and nothing else — the shape every
|
||||
// module takes once its tool container goes (to-be 38 WP4).
|
||||
func aToolsModule(t *testing.T, name string, entrypoints ...string) mcat.Manifest {
|
||||
t.Helper()
|
||||
m := mcat.Manifest{Module: name, Version: "1", Tools: []string{"status"},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{
|
||||
{Name: "tools", Kind: mcat.ArtifactBundle, Language: "typescript", Entrypoints: entrypoints},
|
||||
}}}
|
||||
resolved, err := m.Resolve([]mcat.Built{{Name: "tools", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + name + "/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return resolved
|
||||
}
|
||||
|
||||
// theRuntime is the runtime module as the catalogue holds it: its own bundle, run rather than
|
||||
// loaded, and its broker secret to receive the node's credential in.
|
||||
func theRuntime(t *testing.T) mcat.Manifest {
|
||||
t.Helper()
|
||||
m := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
|
||||
OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "typescript",
|
||||
Entrypoints: []string{"src/main.js"}}}}}
|
||||
resolved, err := m.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return resolved
|
||||
}
|
||||
|
||||
func TestEveryToolsBundleIsDeliveredWhereTheRuntimeRuns(t *testing.T) {
|
||||
store := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
|
||||
Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
|
||||
nftables := aToolsModule(t, "nftables", "tools/index.js")
|
||||
zsh := aToolsModule(t, "zsh", "tools/index.js", "tools/more.js")
|
||||
|
||||
t.Run("with the runtime, one archive per tools bundle", func(t *testing.T) {
|
||||
r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{nftables, zsh, theRuntime(t)}}
|
||||
out, err := Declaration(r, store)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
archive := fileNamed(out, "nftables."+BundleID("tools"))
|
||||
if archive == nil {
|
||||
t.Fatalf("nftables' tools bundle was not delivered: %v", ids(out))
|
||||
}
|
||||
if archive["type"] != "archive" || archive["digest"] != bundleDigest ||
|
||||
archive["path"] != mcat.BundleRoot+"/nftables/tools" {
|
||||
t.Errorf("delivered as %v", archive)
|
||||
}
|
||||
if archive["source"] != "http://anchor.internal:5101/v2/nftables/tools/blobs/"+bundleDigest {
|
||||
t.Errorf("fetched from %v, not through the store as this network reaches it", archive["source"])
|
||||
}
|
||||
if fileNamed(out, "zsh."+BundleID("tools")) == nil {
|
||||
t.Errorf("zsh's tools bundle was not delivered: %v", ids(out))
|
||||
}
|
||||
// The runtime's own bundle is run, not loaded: its process delivers it, not an archive.
|
||||
if fileNamed(out, mcat.RuntimeModule+"."+BundleID("runtime")) != nil {
|
||||
t.Error("the runtime's own bundle was delivered as an archive beside its process")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("without the runtime, nothing changes", func(t *testing.T) {
|
||||
r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{nftables, zsh}}
|
||||
out, err := Declaration(r, store)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, id := range ids(out) {
|
||||
if strings.Contains(id, BundleID("")) {
|
||||
t.Errorf("%s was delivered to a machine running no runtime to load it", id)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func ids(out []map[string]any) []string {
|
||||
var names []string
|
||||
for _, r := range out {
|
||||
names = append(names, r["id"].(string))
|
||||
}
|
||||
return names
|
||||
}
|
||||
|
||||
// One process per machine runs the runtime from its own bundle, told what it serves and from where,
|
||||
// where its credential is, and who the operator is — restarted when any of that changes.
|
||||
func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
|
||||
with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
|
||||
Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
|
||||
nftables := aToolsModule(t, "nftables", "tools/index.js")
|
||||
// A bundle carrying a daemon beside its tools says which files the runtime loads.
|
||||
showcase := mcat.Manifest{Module: "showcase", Version: "1", Tools: []string{"greet"},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "code", Kind: mcat.ArtifactBundle, Language: "typescript",
|
||||
Entrypoints: []string{"daemon/index.js", "tools/index.js"}, Loads: []string{"tools/index.js"}}}}}
|
||||
showcase, err := showcase.Resolve([]mcat.Built{{Name: "code", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + "showcase/code/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
r := mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{nftables, showcase, theRuntime(t)}}
|
||||
out, err := Declaration(r, with)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
|
||||
if process == nil {
|
||||
t.Fatalf("no runtime process was composed: %v", ids(out))
|
||||
}
|
||||
if process["type"] != "process" || process["name"] != mcat.RuntimeModule || process["digest"] != bundleDigest ||
|
||||
process["source"] != "http://anchor.internal:5101/v2/"+mcat.RuntimeModule+"/runtime/blobs/"+bundleDigest {
|
||||
t.Errorf("the runtime's process is %v", process)
|
||||
}
|
||||
if fmt.Sprint(process["run"]) != "[node src/main.js]" {
|
||||
t.Errorf("the runtime is run as %v; its bundle's one entrypoint, by its language's interpreter", process["run"])
|
||||
}
|
||||
env := process["env"].(map[string]string)
|
||||
if env[mcat.RuntimeToolModules] != "nftables="+mcat.BundleRoot+"/nftables/tools/tools/index.js,"+
|
||||
"showcase="+mcat.BundleRoot+"/showcase/code/tools/index.js" {
|
||||
t.Errorf("the runtime is told to serve %q: every loaded file, by module, and nothing a bundle runs", env[mcat.RuntimeToolModules])
|
||||
}
|
||||
if env[mcat.RuntimeBrokerFile] != "/var/lib/mesh/"+mcat.RuntimeModule+"/broker" {
|
||||
t.Errorf("the runtime reads its credential at %q, not where the module's own secret is placed", env[mcat.RuntimeBrokerFile])
|
||||
}
|
||||
if env[mcat.RuntimeOperatorAccount] != "ops" || env[mcat.RuntimeOperatorHome] != "/home/ops" || process["user"] != "ops" {
|
||||
t.Errorf("the operator is not handed to the runtime: %v as %v", env, process["user"])
|
||||
}
|
||||
// The credential the process reads belongs to the account it runs as, or it could not read it
|
||||
// (to-be 38 WP3); other modules' secrets are left as their manifests say.
|
||||
if credential := fileNamed(out, mcat.RuntimeModule+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != "ops" {
|
||||
t.Errorf("the runtime's credential is not the account's to read: %v", credential)
|
||||
}
|
||||
restarts := fmt.Sprint(process["restart-on"])
|
||||
for _, want := range []string{"nftables." + BundleID("tools"), "showcase." + BundleID("code"), mcat.RuntimeModule + "." + mcat.NeedID("broker")} {
|
||||
if !strings.Contains(restarts, want) {
|
||||
t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
|
||||
}
|
||||
}
|
||||
// After every bundle and the credential, so both exist before it starts.
|
||||
names := ids(out)
|
||||
if names[len(names)-1] != mcat.RuntimeModule+"."+RuntimeProcessID() {
|
||||
t.Errorf("the runtime's process is not last: %v", names)
|
||||
}
|
||||
|
||||
t.Run("a machine with no account runs it as root without the operator words", func(t *testing.T) {
|
||||
out, err := Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{nftables, theRuntime(t)}}, with)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
|
||||
env := process["env"].(map[string]string)
|
||||
if _, set := env[mcat.RuntimeOperatorAccount]; set {
|
||||
t.Error("an operator account was named on a machine that has none")
|
||||
}
|
||||
if _, set := process["user"]; set {
|
||||
t.Error("a user was set on a machine with no account")
|
||||
}
|
||||
if credential := fileNamed(out, mcat.RuntimeModule+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != nil {
|
||||
t.Errorf("the runtime's credential was given an owner on a machine with no account: %v", credential)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("a runtime module built wrong is refused by name", func(t *testing.T) {
|
||||
two := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1", OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/b"}},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "typescript",
|
||||
Entrypoints: []string{"a.js", "b.js"}}}}}
|
||||
resolved, err := two.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + "x/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err = Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{resolved}}, with)
|
||||
if err == nil || !strings.Contains(err.Error(), "entrypoint") {
|
||||
t.Errorf("a runtime bundle with two entrypoints was composed: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// novox/hq ADR 0193: the runtime is told the launcher a build wrote, and the entrypoint itself for a
|
||||
// build from before launchers — so the move needs no flag day.
|
||||
func TestTheRuntimeStartsTheLauncherWhereTheBuildWroteOne(t *testing.T) {
|
||||
with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
|
||||
Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
|
||||
launched := mcat.Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "tools", Kind: mcat.ArtifactBundle, Language: "typescript",
|
||||
Entrypoints: []string{"tools/index.js"}}}}}
|
||||
launched, err := launched.Resolve([]mcat.Built{{Name: "tools", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + "dash/tools/blobs/" + bundleDigest, Digest: bundleDigest,
|
||||
Launchers: map[string]string{"tools/index.js": "tools/index.serve.mjs"}}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
older := aToolsModule(t, "nftables", "tools/index.js")
|
||||
out, err := Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{launched, older, theRuntime(t)}}, with)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
env := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())["env"].(map[string]string)
|
||||
want := "dash=" + mcat.BundleRoot + "/dash/tools/tools/index.serve.mjs,nftables=" + mcat.BundleRoot + "/nftables/tools/tools/index.js"
|
||||
if env[mcat.RuntimeToolModules] != want {
|
||||
t.Errorf("the runtime is told %q, want %q", env[mcat.RuntimeToolModules], want)
|
||||
}
|
||||
}
|
||||
|
||||
// novox/hq ADR 0193: a runtime compiled to a binary runs itself from its own unpacked bundle.
|
||||
func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
|
||||
with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
|
||||
Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
|
||||
goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
|
||||
OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
|
||||
System: "arch", From: "cmd/node-tools"}}}}
|
||||
goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
out, err := Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{aToolsModule(t, "nftables", "tools/index.js"), goRuntime}}, with)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
|
||||
if fmt.Sprint(process["run"]) != "[./node-tools]" {
|
||||
t.Errorf("a Go runtime is run as %v, want its own binary", process["run"])
|
||||
}
|
||||
env := process["env"].(map[string]string)
|
||||
if env[mcat.RuntimeToolModules] == "" || process["user"] != "ops" {
|
||||
t.Errorf("the Go runtime is not told what to serve or whose it is: %v %v", env, process["user"])
|
||||
}
|
||||
}
|
||||
|
||||
// novox/hq ADR 0259 §8: a module of its own account is served by a runtime of its own — the machine's
|
||||
// runtime program, as that account, on that module's own credential — and never by the machine's runtime,
|
||||
// which runs as the operator's account and is given none of its words.
|
||||
func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
|
||||
with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
|
||||
Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
|
||||
goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
|
||||
OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
|
||||
System: "arch", From: "cmd/node-tools"}}}}
|
||||
goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
telegram := aToolsModule(t, "telegram", "tools/index.js")
|
||||
telegram.RunsAs, telegram.SecretsOwner = "telegram", "telegram"
|
||||
telegram.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
|
||||
out, err := Declaration(mcat.Resolution{Node: "anchor", Account: "ops",
|
||||
Modules: []mcat.Manifest{aToolsModule(t, "nftables", "tools/index.js"), telegram, goRuntime}}, with)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
machine := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
|
||||
if served := machine["env"].(map[string]string)[mcat.RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
|
||||
t.Errorf("the machine's runtime serves %q", served)
|
||||
}
|
||||
own := fileNamed(out, "telegram."+mcat.OwnRuntimeID())
|
||||
if own == nil {
|
||||
t.Fatalf("telegram has no runtime of its own: %v", ids(out))
|
||||
}
|
||||
env := own["env"].(map[string]string)
|
||||
if own["user"] != "telegram" || fmt.Sprint(own["run"]) != "[./node-tools]" ||
|
||||
env[mcat.RuntimeBrokerFile] != "/var/lib/telegram/broker" ||
|
||||
env[mcat.RuntimeToolModules] != "telegram="+mcat.BundleRoot+"/telegram/tools/tools/index.js" {
|
||||
t.Errorf("its own runtime: user %v run %v env %v", own["user"], own["run"], env)
|
||||
}
|
||||
if _, told := env[mcat.RuntimeOperatorAccount]; told {
|
||||
t.Error("a runtime of a module's own account is told the operator's account")
|
||||
}
|
||||
if _, yields := own["yields"]; yields {
|
||||
t.Errorf("telegram holds no build seat and yields: %v", own["yields"])
|
||||
}
|
||||
// The build seats' holders yield (ADR 0553): idle, under the node's one share from the node-engine's build-cpu-share,
|
||||
// and their steps are told it.
|
||||
builder := func(name, seat string) mcat.Manifest {
|
||||
b := aToolsModule(t, name, "tools/index.js")
|
||||
b.RunsAs, b.SecretsOwner = name, name
|
||||
b.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/" + name + "/broker"}}
|
||||
b.Claims = []mcat.Claim{{Name: seat}}
|
||||
return b
|
||||
}
|
||||
gob, img := builder("gob", "node-build-go"), builder("img", "node-build-image")
|
||||
with.Needed["gob"], with.Needed["img"] = map[string]string{"broker": "own"}, map[string]string{"broker": "own"}
|
||||
for _, c := range []struct {
|
||||
settings mcat.SettingsBy
|
||||
share string
|
||||
}{
|
||||
{nil, "50"},
|
||||
{mcat.SettingsBy{"mesh-host": {{From: "anchor", Values: map[string]any{"build-cpu-share": float64(75)}}}}, "75"},
|
||||
{mcat.SettingsBy{"mesh-host": {{From: "anchor", Values: map[string]any{"build-cpu-share": float64(0)}}}}, "50"},
|
||||
} {
|
||||
with.Settings = c.settings
|
||||
runtimes, err := resolutionOwnRuntimes(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{gob, img, telegram, goRuntime}}, with)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(runtimes) != 3 {
|
||||
t.Fatalf("%d runtimes of their own, want gob's, img's and telegram's", len(runtimes))
|
||||
}
|
||||
for _, p := range runtimes {
|
||||
name := fmt.Sprint(p["name"])
|
||||
words := map[string]map[string]string{}
|
||||
_ = json.Unmarshal([]byte(p["env"].(map[string]string)[mcat.RuntimeToolEnv]), &words)
|
||||
mod := strings.TrimSuffix(name, "-runtime")
|
||||
if mod == "telegram" {
|
||||
if p["yields"] != nil || words[mod]["MESH_BUILD_CPU_SHARE"] != "" {
|
||||
t.Errorf("telegram yields under %v: %v %v", c.settings, p["yields"], words)
|
||||
}
|
||||
continue
|
||||
}
|
||||
if got := fmt.Sprint(p["yields"]); got != "map[cpu-share:"+c.share+" priority:idle]" ||
|
||||
words[mod]["MESH_BUILD_CPU_SHARE"] != c.share {
|
||||
t.Errorf("%s under %v yields %s with words %v; want share %s", name, c.settings, got, words[mod], c.share)
|
||||
}
|
||||
}
|
||||
}
|
||||
with.Settings = nil
|
||||
// Without the machine's runtime to run it from, it is refused in words.
|
||||
if _, err := resolutionOwnRuntimes((mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{telegram}}), with); err == nil {
|
||||
t.Error("a module of its own account composed without a runtime program")
|
||||
}
|
||||
}
|
||||
|
||||
// The review of 2026-10-09 (L4): a module of its own account never runs as the node's operator account, nor
|
||||
// as the account agents run as there — either would hand what it holds back to the accounts it is kept from.
|
||||
func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testing.T) {
|
||||
with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
|
||||
Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
|
||||
goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
|
||||
OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
|
||||
System: "arch", From: "cmd/node-tools"}}}}
|
||||
goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, account := range []string{"ops", "agent"} {
|
||||
telegram := aToolsModule(t, "telegram", "tools/index.js")
|
||||
telegram.RunsAs, telegram.SecretsOwner = account, account
|
||||
telegram.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
|
||||
_, err := resolutionOwnRuntimes(mcat.Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent",
|
||||
Modules: []mcat.Manifest{telegram, goRuntime}}, with)
|
||||
if err == nil || !strings.Contains(err.Error(), account) {
|
||||
t.Errorf("telegram running as %s was composed: %v", account, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Issue 723: the vault runs as its own account, so what the mesh writes for it — the export it keeps, the grant
|
||||
// files it holds for its consumers, and what its words name — belongs to that account, never the operator's.
|
||||
func TestWhatAModuleOfItsOwnAccountReadsIsItsAccounts(t *testing.T) {
|
||||
with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
|
||||
Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "vault": {"broker": "own"}},
|
||||
Kept: &mcat.KeptExport{Export: 1, OperatorKey: "k"},
|
||||
Grants: []mcat.Grant{{Provision: "secret", Consumer: "anchor", From: "telegram", Sealed: "sealed-to-anchor",
|
||||
Values: map[string]any{"name": "telegram"}}}}
|
||||
goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
|
||||
OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
|
||||
Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
|
||||
System: "arch", From: "cmd/node-tools"}}}}
|
||||
goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
|
||||
Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
vault := aToolsModule(t, "vault", "tools/index.js")
|
||||
vault.RunsAs, vault.SecretsOwner = "vault", "vault"
|
||||
vault.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/vault/broker"}}
|
||||
vault.Keeps = "/var/lib/vault/root"
|
||||
vault.Grants = map[string]string{"secret": "/var/lib/vault/grants"}
|
||||
vault.Receives = map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}
|
||||
vault.Bundles[0].Env = map[string]string{"MESH_RECEIVES": "/var/lib/vault/grants/mesh.json"}
|
||||
out, err2 := Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{vault, goRuntime}}, with)
|
||||
if err = err2; err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
seen := 0
|
||||
for _, r := range out {
|
||||
path := fmt.Sprint(r["path"])
|
||||
if !strings.HasPrefix(path, "/var/lib/vault/") || r["type"] != "file" {
|
||||
continue
|
||||
}
|
||||
seen++
|
||||
if r["owner"] != "vault" {
|
||||
t.Errorf("%s (%v) belongs to %v, not the vault's own account", path, r["id"], r["owner"])
|
||||
}
|
||||
}
|
||||
if seen < 4 {
|
||||
t.Errorf("only %d of the vault's files were composed: %v", seen, ids(out))
|
||||
}
|
||||
// Carried by the machine's runtime instead, nothing of it changes: the operator's account reads them.
|
||||
carried := vault
|
||||
carried.RunsAs, carried.SecretsOwner = "", ""
|
||||
out, err = Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{carried, goRuntime}}, with)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, r := range out {
|
||||
if path := fmt.Sprint(r["path"]); strings.HasPrefix(path, "/var/lib/vault/") && r["owner"] == "vault" {
|
||||
t.Errorf("%s belongs to the vault's account though it runs as none", path)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user