jochen
b7f70bc4c0
The controller reads its merge window's settings from a file its manifest declares from its settings (MESH_MERGE_WINDOW_FILE, ADR 0276). Step 11 took every MESH_..._FILE for a secret and refused this one as a file nobody writes, so no genesis got past step 11. A _FILE naming a file resource of the module is now the module's own; one naming neither an own-secret nor a file of the module is still refused.
265 lines
12 KiB
Go
265 lines
12 KiB
Go
package bootstrap
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// imageFormManifest is a controller from before issue 213: it builds an image and runs a container.
|
|
const imageFormManifest = `{"module":"mesh-controller","version":"1","resources":[
|
|
{"id":"server","type":"container","name":"mesh-controller","network":"host","artifact":"server"}],
|
|
"build":{"artifacts":[{"name":"server","kind":"image","from":"Dockerfile"}]}}`
|
|
|
|
// processFormManifest is the controller's manifest as novox/mesh-controller declares it after issue
|
|
// 213: a Go bundle the host runs as a process, replacing the container it ran as.
|
|
const processFormManifest = `{
|
|
"module": "mesh-controller", "version": "1", "slug": "control", "prepares": true,
|
|
"claims": [{"name": "mesh-controller", "scope": "mesh"}],
|
|
"accesses": [{"path": "/var/lib/mesh-broker-tls", "mode": "read"}],
|
|
"own-secrets": {"inventory": "${dir:mesh-state}/inventory", "bus": "${dir:mesh-state}/bus"},
|
|
"secrets-owner": "mesh-controller",
|
|
"tools": ["status"],
|
|
"resources": [
|
|
{"id": "account", "type": "user", "name": "mesh-controller", "shell": "/usr/bin/nologin", "home": "/var/lib/mesh-controller"},
|
|
{"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh", "owner": "mesh-controller"},
|
|
{"id": "controller", "type": "process", "name": "mesh-controller", "artifact": "controller",
|
|
"run": ["./mesh-controller", "serve"], "user": "mesh-controller",
|
|
"env": {"MESH_BROKER_CERTIFICATE": "/var/lib/mesh-broker-tls/tls.crt",
|
|
"MESH_STORE_INVENTORY_FILE": "${dir:mesh-state}/inventory",
|
|
"MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
|
|
"MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus"},
|
|
"replaces": ["server"]}
|
|
],
|
|
"build": {"artifacts": [{"name": "controller", "kind": "bundle", "language": "go", "system": "arch",
|
|
"from": "cmd/mesh-controller", "binary": "mesh-controller"}]}
|
|
}`
|
|
|
|
// aRepository answers the carried builder's git as a clone of a repository holding this manifest and
|
|
// a Dockerfile, and hands every other command to then.
|
|
func aRepository(t *testing.T, manifest string, then func(string, []string) (string, error)) func(string, []string) (string, error) {
|
|
t.Helper()
|
|
return func(name string, args []string) (string, error) {
|
|
if name == "docker" && len(args) > 5 && args[0] == "run" && args[4] == "--entrypoint" && args[5] == "git" {
|
|
host := strings.TrimSuffix(args[3], ":/ws")
|
|
joined := strings.Join(args, " ")
|
|
switch {
|
|
case strings.Contains(joined, " clone "):
|
|
src := filepath.Join(host, "src")
|
|
if err := os.MkdirAll(src, 0o755); err != nil {
|
|
return "", err
|
|
}
|
|
if err := os.WriteFile(filepath.Join(src, "module.json"), []byte(manifest), 0o644); err != nil {
|
|
return "", err
|
|
}
|
|
return "", os.WriteFile(filepath.Join(src, "Dockerfile"), []byte("FROM scratch\n"), 0o644)
|
|
case strings.Contains(joined, "rev-parse"):
|
|
return "a1b2c3d4e5f6\n", nil
|
|
}
|
|
return "", nil
|
|
}
|
|
return then(name, args)
|
|
}
|
|
}
|
|
|
|
// novox/hq issue 223: a controller declared as a process is raised at genesis as a container built
|
|
// from its own Dockerfile, not by the builder — which has no Go toolchain at genesis and would refuse.
|
|
func TestAProcessFormControllerIsBuiltFromItsDockerfileAndRaisedAsAContainer(t *testing.T) {
|
|
runtime := &asked{answer: aRepository(t, processFormManifest, func(name string, args []string) (string, error) {
|
|
if name == "docker" && args[0] == "build" {
|
|
return builtImage + "\n", nil
|
|
}
|
|
t.Fatalf("genesis ran %s %v; a process-form controller is built from its Dockerfile alone", name, args)
|
|
return "", nil
|
|
})}
|
|
built, err := BuildControlPlane(context.Background(), runtime.run, "mesh-builder:test",
|
|
Source{Repository: "https://example.invalid/mesh-controller.git", Ref: "a1b2c3d4"}, false, func(string) {})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if built.Image != builtImage || built.Commit != "a1b2c3d4e5f6" {
|
|
t.Errorf("built %q from %q", built.Image, built.Commit)
|
|
}
|
|
if runtime.ran("mesh-builder:test build") {
|
|
t.Error("the builder was asked to build a controller it cannot build at genesis")
|
|
}
|
|
|
|
var m map[string]any
|
|
if err := json.Unmarshal(built.Manifest, &m); err != nil {
|
|
t.Fatalf("the genesis manifest is not JSON: %v", err)
|
|
}
|
|
if _, has := m["prepares"]; has {
|
|
t.Error("the genesis manifest prepares its state; the temporary controller already did, and a pinned image is nothing the controller can derive a step from")
|
|
}
|
|
if _, has := m["build"]; has {
|
|
t.Error("the genesis manifest still says how it is built; it is handed over resolved")
|
|
}
|
|
var container map[string]any
|
|
for _, raw := range m["resources"].([]any) {
|
|
r := raw.(map[string]any)
|
|
if r["type"] == "process" {
|
|
t.Errorf("the genesis manifest still runs the process: %v", r)
|
|
}
|
|
if r["type"] == "container" {
|
|
container = r
|
|
}
|
|
}
|
|
if container == nil {
|
|
t.Fatal("the genesis manifest runs no container")
|
|
}
|
|
for key, want := range map[string]any{"id": "server", "name": "mesh-controller", "image": builtImage,
|
|
"network": "host"} {
|
|
if container[key] != want {
|
|
t.Errorf("the genesis container's %s is %v, not %v", key, container[key], want)
|
|
}
|
|
}
|
|
if _, has := container["user"]; has {
|
|
t.Error("the genesis container says a user; the host's container has no such field, the image's USER is who it runs as")
|
|
}
|
|
if m["secrets-owner"] != "65534:65534" {
|
|
t.Errorf("the secrets belong to %v, which the container cannot read as", m["secrets-owner"])
|
|
}
|
|
volumes, _ := json.Marshal(container["volumes"])
|
|
for _, want := range []string{"${dir:mesh-state}/inventory:${dir:mesh-state}/inventory:ro",
|
|
"/var/lib/mesh-broker-tls/tls.crt:/var/lib/mesh-broker-tls/tls.crt:ro"} {
|
|
if !strings.Contains(string(volumes), want) {
|
|
t.Errorf("the container does not mount %s: %s", want, volumes)
|
|
}
|
|
}
|
|
if strings.Contains(string(volumes), "seat:") {
|
|
t.Errorf("a word that is not a path was mounted: %s", volumes)
|
|
}
|
|
|
|
// And it is what step 9 installs: pinned, its container found, its stores delivered from its
|
|
// environment — the same path an image-form controller takes.
|
|
pinned, _, err := pinImage(built.Manifest, built.Image, "registry.internal:5000/mesh-controller@sha256:"+strings.Repeat("e", 64), ControlPlaneModule)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if id := controlPlaneResourceIn(pinned); id != "server" {
|
|
t.Errorf("step 9 finds the controller's container as %q", id)
|
|
}
|
|
wanted, err := secretsByVariableIn(pinned)
|
|
if err != nil {
|
|
t.Fatalf("step 9 cannot deliver the stores into the genesis container: %v", err)
|
|
}
|
|
if wanted["MESH_STORE_INVENTORY"] != "inventory" {
|
|
t.Errorf("step 9 delivers %v", wanted)
|
|
}
|
|
}
|
|
|
|
// An older controller — an image and a container — is still built by the builder, as before.
|
|
func TestAnImageFormControllerIsStillBuiltByTheBuilder(t *testing.T) {
|
|
manifest := `{"module":"mesh-controller","version":"1","resources":[` +
|
|
`{"id":"server","type":"container","name":"mesh-controller","image":"` + builtImage + `"}]}`
|
|
runtime := &asked{answer: aRepository(t, imageFormManifest, func(name string, args []string) (string, error) {
|
|
if name == "docker" && args[0] == "build" {
|
|
t.Fatal("an image-form controller was built from its Dockerfile rather than by the builder")
|
|
}
|
|
return `{"module":"mesh-controller","commit":"a1b2c3d4","manifest":` + manifest +
|
|
`,"made":[{"name":"server","kind":"image","reference":"` + builtImage + `"}]}`, nil
|
|
})}
|
|
built, err := BuildControlPlane(context.Background(), runtime.run, "mesh-builder:test",
|
|
Source{Repository: "https://example.invalid/mesh-controller.git", Ref: "a1b2c3d4"}, false, func(string) {})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if string(built.Manifest) != manifest || !runtime.ran("mesh-builder:test build") {
|
|
t.Errorf("the image form did not go through the builder: %s", built.Manifest)
|
|
}
|
|
}
|
|
|
|
func TestAProcessFormNamingNoOneReplacementIsRefused(t *testing.T) {
|
|
for _, bad := range []string{`"replaces": []`, `"replaces": ["a", "b"]`} {
|
|
raw := strings.Replace(processFormManifest, `"replaces": ["server"]`, bad, 1)
|
|
if _, err := processFormOf([]byte(raw)); err == nil {
|
|
t.Errorf("a process saying %s was accepted; genesis would not know what to name its container", bad)
|
|
}
|
|
}
|
|
}
|
|
|
|
// theStepNineSecretsOf is what step 9 delivers for a process-form controller manifest: its genesis
|
|
// container made, pinned, and its secrets read from that container's environment.
|
|
func theStepNineSecretsOf(t *testing.T, manifest []byte) (map[string]string, error) {
|
|
t.Helper()
|
|
form, err := processFormOf(manifest)
|
|
if err != nil || !form.Found {
|
|
t.Fatalf("the manifest has no process form: %v", err)
|
|
}
|
|
genesis, err := genesisForm(manifest, form, builtImage)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
pinned, _, err := pinImage(genesis, builtImage, "registry.internal:5000/mesh-controller@sha256:"+strings.Repeat("e", 64), ControlPlaneModule)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return secretsByVariableIn(pinned)
|
|
}
|
|
|
|
// **A file the controller's manifest writes itself is not a secret** (novox/hq issue 597). The merge
|
|
// window's settings reach the controller in a file its manifest declares from its settings
|
|
// (MESH_MERGE_WINDOW_FILE, ADR 0276); genesis refused it as a secret nobody writes, and stopped at
|
|
// step 11 of 24.
|
|
func TestAFileTheControllersManifestWritesIsNotASecret(t *testing.T) {
|
|
manifest := strings.Replace(processFormManifest,
|
|
`{"id": "controller", "type": "process",`,
|
|
`{"id": "merge-window", "type": "file", "path": "${dir:mesh-state}/merge-window.json", "mode": "0600",
|
|
"owner": "mesh-controller", "content": "{\"merge-window\": \"${setting:merge-window}\"}\n"},
|
|
{"id": "controller", "type": "process",`, 1)
|
|
manifest = strings.Replace(manifest, `"MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus"}`,
|
|
`"MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus",
|
|
"MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json"}`, 1)
|
|
if !strings.Contains(manifest, "MESH_MERGE_WINDOW_FILE") || !strings.Contains(manifest, `"id": "merge-window"`) {
|
|
t.Fatal("the fixture was not changed")
|
|
}
|
|
wanted, err := theStepNineSecretsOf(t, []byte(manifest))
|
|
if err != nil {
|
|
t.Fatalf("step 9 refuses a file the manifest writes itself: %v", err)
|
|
}
|
|
if _, asked := wanted["MESH_MERGE_WINDOW"]; asked {
|
|
t.Errorf("the merge window's settings are delivered as a secret: %v", wanted)
|
|
}
|
|
if wanted["MESH_STORE_INVENTORY"] != "inventory" || wanted["MESH_BUS_NATS"] != "bus" {
|
|
t.Errorf("step 9 delivers %v; the store's and the bus's secrets are still wanted", wanted)
|
|
}
|
|
}
|
|
|
|
// And a `…_FILE` that neither an own-secret nor a file of the module writes is still refused.
|
|
func TestAFileNothingOfTheControllerWritesIsStillRefused(t *testing.T) {
|
|
manifest := strings.Replace(processFormManifest, `"MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus"}`,
|
|
`"MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus",
|
|
"MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json"}`, 1)
|
|
if _, err := theStepNineSecretsOf(t, []byte(manifest)); err == nil || !strings.Contains(err.Error(), "MESH_MERGE_WINDOW_FILE") {
|
|
t.Fatalf("a file nothing writes was accepted, or refused without its name: %v", err)
|
|
}
|
|
}
|
|
|
|
// The controller's own manifest, as the mesh runs it, passes step 9 (issue 597): in a merge check the
|
|
// node-engine's check has the controller cloned beside it (MESH_CHECK_BESIDE), where it must be; else a
|
|
// checkout beside this one; else it skips aloud.
|
|
func TestTheControllersOwnManifestPassesStepNine(t *testing.T) {
|
|
var manifest []byte
|
|
if root := os.Getenv("MESH_CHECK_BESIDE"); root != "" {
|
|
raw, err := os.ReadFile(filepath.Join(root, "mesh-controller", "module.json"))
|
|
if err != nil {
|
|
t.Fatalf("the controller is not beside this check in MESH_CHECK_BESIDE=%s: %v", root, err)
|
|
}
|
|
manifest = raw
|
|
} else if raw, err := os.ReadFile(filepath.Join("..", "..", "..", "mesh-controller", "module.json")); err == nil {
|
|
manifest = raw
|
|
} else {
|
|
t.Skip("NOT JUDGED: no controller beside this checkout and no MESH_CHECK_BESIDE; the merge check judges it")
|
|
}
|
|
wanted, err := theStepNineSecretsOf(t, manifest)
|
|
if err != nil {
|
|
t.Fatalf("genesis's step 9 refuses the controller the mesh runs: %v", err)
|
|
}
|
|
if wanted["MESH_STORE_INVENTORY"] != "inventory" {
|
|
t.Errorf("step 9 delivers %v", wanted)
|
|
}
|
|
}
|