89 lines
3.8 KiB
Go
89 lines
3.8 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// The packet-filter manifest as it was the day the runtime was decided (novox/hq ADR 0175): tools,
|
|
// served from a container built on the tool runtime's image, with NET_ADMIN so the container could
|
|
// reach the filter. The exact pattern to-be 38 WP4 moves it off, and the one the gate refuses.
|
|
const thePacketFilterAsItWas = `{
|
|
"module": "nftables",
|
|
"version": "1",
|
|
"capabilities": ["firewall", "container-runtime"],
|
|
"claims": [{"name": "node-packet-filter", "scope": "node", "serves": ["rules", "reload", "remove"]}],
|
|
"filtering": {"into": "/etc/nftables.conf"},
|
|
"resources": [
|
|
{"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
|
|
{"id": "package", "type": "package", "package": "nftables"},
|
|
{"id": "unit", "type": "file", "path": "/etc/systemd/system/mesh-filter.service",
|
|
"content": "[Unit]\nDescription=The mesh's packet filter\n[Service]\nType=oneshot\nExecStart=nft -f /etc/nftables.conf\n", "mode": "0644"},
|
|
{"id": "load", "type": "service", "unit": "mesh-filter.service", "state": "running", "boot": "enabled",
|
|
"restart-on": ["unit"], "reload-on": ["filtering"]},
|
|
{"id": "runtime", "type": "container", "name": "mesh-nftables", "network": "host",
|
|
"capabilities": ["NET_ADMIN"],
|
|
"volumes": ["${dir:mesh-state}/broker:/run/secrets/broker:ro", "/etc/nftables.conf:/etc/nftables.conf:ro"],
|
|
"env": {"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_FILTER_FILE": "/etc/nftables.conf"},
|
|
"artifact": "runtime"}
|
|
],
|
|
"tools": ["firewall_rules"],
|
|
"own-secrets": {"broker": "${dir:mesh-state}/broker"},
|
|
"build": {
|
|
"on": [
|
|
{"arg": "BUILD_BASE", "module": "mesh-tools", "artifact": "build"},
|
|
{"arg": "RUNTIME_BASE", "module": "mesh-tools", "artifact": "runtime"}
|
|
],
|
|
"artifacts": [{"name": "runtime", "kind": "image", "from": "Dockerfile"}]
|
|
}
|
|
}`
|
|
|
|
func TestAToolContainerOnTheRuntimeImageIsNamedForWhatItIs(t *testing.T) {
|
|
m, err := ParseManifest([]byte(thePacketFilterAsItWas))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// From the repository: the manifest says what it builds on.
|
|
why := ToolContainerOnTheRuntime(m, nil)
|
|
if why == "" {
|
|
t.Fatal("the packet filter's tool container was not recognised from its build")
|
|
}
|
|
for _, word := range []string{"nftables", "mesh-tools", "runtime", "ADR 0175", "bundle"} {
|
|
if !strings.Contains(why, word) {
|
|
t.Errorf("the refusal does not say %q: %s", word, why)
|
|
}
|
|
}
|
|
|
|
// Built: the manifest carries no build, and what it stood on says the same.
|
|
built, err := m.Resolve([]Built{{Name: "runtime", Kind: ArtifactImage,
|
|
Reference: ArtifactStoreScheme + "nftables/runtime@" + digest}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
stoodOn := []string{"anchor.internal:5100/mesh-tools/build@" + digest, "anchor.internal:5100/mesh-tools/runtime@" + digest}
|
|
if ToolContainerOnTheRuntime(built, stoodOn) == "" {
|
|
t.Error("the packet filter's tool container was not recognised from what its build stood on")
|
|
}
|
|
if ToolContainerOnTheRuntime(built, nil) != "" {
|
|
t.Error("a built manifest with no record of its base was judged to be on the runtime")
|
|
}
|
|
|
|
// Each of the three alone is an ordinary module.
|
|
bundle := m
|
|
bundle.Resources = m.Resources[:len(m.Resources)-1]
|
|
if ToolContainerOnTheRuntime(bundle, nil) != "" {
|
|
t.Error("a module with tools and no container is the pattern the runtime serves, and was refused")
|
|
}
|
|
service := m
|
|
service.Tools = nil
|
|
if ToolContainerOnTheRuntime(service, nil) != "" {
|
|
t.Error("a service built against the SDK, declaring no tools, was refused")
|
|
}
|
|
elsewhere := m
|
|
elsewhere.Build = &Build{On: []BuildsOn{{Arg: "NODE_BASE", Image: "node@" + digest}},
|
|
Artifacts: m.Build.Artifacts}
|
|
if ToolContainerOnTheRuntime(elsewhere, nil) != "" {
|
|
t.Error("a tool container on a public base was refused as though it were on the runtime's")
|
|
}
|
|
}
|