monky-deployd

mdella/monky-deployd

Fork 0

mirror of https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git synced 2026-09-18 06:16:16 +00:00

Commit Graph

Author	SHA1	Message	Date
mdella	b25c6b3b8b	feat: pull private images without a hand docker login; surface the pull error Design merged first: monky-design-docs !225 (doc 24 §4a). Pairs with monky-tenancy!40, which copies the estate-wide read-only Harbor robot into each environment's own prefix and marks the manifest entry `use: registry-auth`. - That entry is not an env var (it would otherwise land in .env and therefore in every container's environment). The agent parses it — JSON, or `username:password` with the new `registry_host` — and writes `<state_dir>/docker/config.json` 0600 in a directory it owns, with an explicit DOCKER_CONFIG pointing the docker CLI at it. The unit runs as monky-deployd, so a `docker login` by a human or by root is invisible to the agent: that is what made env-dev-01 look like it had no credential at all after the operator had just logged in. - `compose pull` failures now carry the registry's own message ("no basic auth credentials", "manifest unknown", DNS) into the journal and the report instead of `rc=1`. - Tests: both credential shapes, the refusals, 0600/0700 modes, idempotent rewrite, and that the runner never silently falls back to a human's $HOME. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1	2026-09-08 15:45:22 +00:00
mdella	a30014a096	fix(agent): reuse a valid lease token across applies; a rate-limited lease no longer blocks a deploy; 0.1.6 Every apply requested a new lease, so a failing deploy retried by the 60 s timer burned tenancy's 5-leases-per-hour budget and then failed on LEASE_RATE_LIMITED forever (env-qa-02 pilot). Now: reuse a lease-derived token while lookup-self says it is valid; swap the bootstrap token for a lease once; if tenancy rate-limits the lease while a working token exists, apply with it and defer the swap. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1	2026-09-07 20:25:38 +00:00
mdella	1c42e913a8	feat: monky-deployd v0.1.0 — pull agent over the mesh (ADR-0028) Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin (bearer = the agent's OpenBao token, bootstrapped from the install kit's jwt-tenancy deploy grant) → action apply\|none\|down → bundle (sha256 verified) → refusal checks (unresolved ${VAR} names only, manifest paths pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads → .env 0600 → promote → compose pull/up → wait healthy → report; finally renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) / system. Laptop mode. Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with /opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and package (nfpm) allow_failure until runner egress is proven; GitLab release + release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG, CLAUDE/AGENTS. Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1	2026-09-05 08:01:36 +00:00

Author

SHA1

Message

Date

mdella

b25c6b3b8b

feat: pull private images without a hand docker login; surface the pull error

Design merged first: monky-design-docs !225 (doc 24 §4a). Pairs with monky-tenancy!40, which
copies the estate-wide read-only Harbor robot into each environment's own prefix and marks the
manifest entry `use: registry-auth`.

- That entry is not an env var (it would otherwise land in .env and therefore in every container's
  environment). The agent parses it — JSON, or `username:password` with the new `registry_host` —
  and writes `<state_dir>/docker/config.json` 0600 in a directory it owns, with an explicit
  DOCKER_CONFIG pointing the docker CLI at it. The unit runs as monky-deployd, so a `docker login`
  by a human or by root is invisible to the agent: that is what made env-dev-01 look like it had no
  credential at all after the operator had just logged in.
- `compose pull` failures now carry the registry's own message ("no basic auth credentials",
  "manifest unknown", DNS) into the journal and the report instead of `rc=1`.
- Tests: both credential shapes, the refusals, 0600/0700 modes, idempotent rewrite, and that the
  runner never silently falls back to a human's $HOME.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

2026-09-08 15:45:22 +00:00

mdella

a30014a096

fix(agent): reuse a valid lease token across applies; a rate-limited lease no longer blocks a deploy; 0.1.6

Every apply requested a new lease, so a failing deploy retried by the 60 s
timer burned tenancy's 5-leases-per-hour budget and then failed on
LEASE_RATE_LIMITED forever (env-qa-02 pilot). Now: reuse a lease-derived
token while lookup-self says it is valid; swap the bootstrap token for a
lease once; if tenancy rate-limits the lease while a working token exists,
apply with it and defer the swap.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

2026-09-07 20:25:38 +00:00

mdella

1c42e913a8

feat: monky-deployd v0.1.0 — pull agent over the mesh (ADR-0028)

Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.

Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.

Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

2026-09-05 08:01:36 +00:00

3 Commits