fix: accept sites fmt|cbs|pdx|roam (tenancy 0.7.x) and keep the identity read grant alive across tunneller rewrites — 0.1.10

deployd#3 (DD-0620): every kit for a backend registered since 2026-09-08 died at `--site`.
env-dev-08 (2026-09-11..13): two days of "identity is not readable" ticks — ziti-edge-tunnel
re-creates the file with mode 0600, the ACL mask goes to ---, group membership stops helping.
identity-acl.sh + monky-deployd-identity-acl.path re-apply the grant on every directory change.

Doc-Drift: DD-0620 fixed
Closes #3

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASnneBmT7rfaJLE8NGNw7S
This commit is contained in:
2026-09-13 00:17:35 +00:00
parent fe7b0c6922
commit 037782e1ff
12 changed files with 89 additions and 9 deletions
+9
View File
@@ -74,6 +74,15 @@ def test_config_rejects_approle_and_unknown_keys():
c.from_dict({"env_id": "env-dev-06", "site": "sfo"})
def test_config_sites_match_tenancy():
"""tenancy 0.7.x registers `fmt | pdx | roam`; `cbs` stays as the deprecated alias every row
registered before 2026-09-08 carries (deployd#3: kits died with 'site must be cbs|pdx')."""
assert set(c.SITES) == {"fmt", "cbs", "pdx", "roam"}
for site in ("fmt", "roam", "pdx", "cbs"):
assert c.from_dict({"env_id": "env-dev-06", "site": site}).site == site
assert c.from_dict({"env_id": "env-dev-06", "site": "FMT"}).site == "fmt"
def test_sdk_identity_defaults_to_host_identity():
cfg = c.from_dict({"env_id": "env-dev-07", "site": "cbs"})
assert cfg.identity == "/opt/openziti/etc/identities/monky-host.env-dev-07.json"