mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 03:36:16 +00:00
mdella
43615a6fda
Three faults from one agent-managed onboarding (env-dev-08, 2026-09-09), each of which pointed the diagnosis away from the actual fault. 1. install.sh granted the agent's read on the ziti identity with a POSIX ACL. ziti-edge-tunnel rewrites that file on a controller config update and the rewrite drops the ACL: the agent applied cleanly at 01:21 and was failing every tick by 01:32. Group membership survives the rewrite (the file stays ziti:ziti 0640), so install.sh and the package postinstall now add monky-deployd to the `ziti` group, and a default ACL on the identity directory carries the grant onto a newly created file. The explicit ACLs stay for the boxes that need them. 2. openziti.load() accepts an unreadable or malformed identity: the C SDK logs "configuration is invalid" and returns a context that only fails at dial, as a bare TypeError, which the transport reported as a missing intercept or a policy gap. The SDK transport now reads and parses the identity itself and names the real fault first. 3. The disk pre-flight ran only when the bundle declared disk_need_bytes, so a bundle without one died mid-pull with containerd's "no space left on device" — which reads as a registry fault. A bundle that declares no size now has to clear the headroom floor, and the pre-flight measures containerd's root as well as the docker data-root: docker 29 keeps image layers in the containerd image store, and on env-dev-08 those sat on different filesystems (93 GiB free where the agent looked, 2.8 GiB where the pull wrote). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
117 lines
3.2 KiB
Python
117 lines
3.2 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT))
|
|
|
|
from monky_deployd import config as configmod # noqa: E402
|
|
from monky_deployd.redact import REDACTOR # noqa: E402
|
|
from tests.fakes import ENV, FakeBao, FakeTenancy, serve # noqa: E402
|
|
|
|
FAKEBIN = ROOT / "tests" / "fakebin"
|
|
|
|
|
|
@pytest.fixture
|
|
def bao():
|
|
b = FakeBao()
|
|
srv, port = serve(b)
|
|
b.port = port
|
|
yield b
|
|
srv.shutdown()
|
|
|
|
|
|
@pytest.fixture
|
|
def tenancy(bao):
|
|
t = FakeTenancy(bao)
|
|
srv, port = serve(t)
|
|
t.port = port
|
|
t.server = srv
|
|
yield t
|
|
try:
|
|
srv.shutdown()
|
|
except Exception:
|
|
pass
|
|
|
|
|
|
@pytest.fixture
|
|
def fake_docker(tmp_path, monkeypatch):
|
|
log = tmp_path / "docker.log"
|
|
state = tmp_path / "docker-state.json"
|
|
state.write_text(
|
|
json.dumps(
|
|
{
|
|
"ps": [{"Name": "see", "State": "running", "Health": "healthy"}],
|
|
"free_root": str(tmp_path),
|
|
"env_file_check": True,
|
|
}
|
|
)
|
|
)
|
|
# the real agent also measures containerd's root; on a CI runner that path belongs to the
|
|
# runner's own docker and would make every disk assertion depend on the runner's free space.
|
|
monkeypatch.setattr("monky_deployd.compose.CONTAINERD_ROOTS", ())
|
|
monkeypatch.setenv("PATH", f"{FAKEBIN}:{os.environ['PATH']}")
|
|
monkeypatch.setenv("FAKE_DOCKER_LOG", str(log))
|
|
monkeypatch.setenv("FAKE_DOCKER_STATE", str(state))
|
|
|
|
class FD:
|
|
def calls(self):
|
|
if not log.exists():
|
|
return []
|
|
return [json.loads(line)["argv"] for line in log.read_text().splitlines()]
|
|
|
|
def subcommands(self):
|
|
out = []
|
|
for argv in self.calls():
|
|
if argv[:1] == ["compose"]:
|
|
rest = argv[1:]
|
|
while rest and rest[0].startswith("--"):
|
|
rest = rest[2:]
|
|
out.append("compose " + (rest[0] if rest else ""))
|
|
else:
|
|
out.append(" ".join(argv[:2]))
|
|
return out
|
|
|
|
def set(self, **kw):
|
|
cur = json.loads(state.read_text())
|
|
cur.update(kw)
|
|
state.write_text(json.dumps(cur))
|
|
|
|
return FD()
|
|
|
|
|
|
@pytest.fixture
|
|
def cfg(tmp_path, tenancy, bao, fake_docker):
|
|
REDACTOR.forget_all()
|
|
state_dir = tmp_path / "state"
|
|
etc = tmp_path / "etc"
|
|
etc.mkdir()
|
|
c = configmod.from_dict(
|
|
{
|
|
"env_id": ENV,
|
|
"site": "cbs",
|
|
"transport": "system",
|
|
"tenancy": {"host": "127.0.0.1", "port": tenancy.port, "scheme": "http"},
|
|
"bao": {"addr": f"http://127.0.0.1:{bao.port}", "ca_bundle": None},
|
|
"state_dir": str(state_dir),
|
|
"bootstrap_path": str(etc / "bootstrap.jwt"),
|
|
"interval_s": 60,
|
|
"healthy_timeout_s": 3,
|
|
"disk": {"factor": 1.5, "headroom_bytes": 1024},
|
|
},
|
|
path=str(etc / "config.yaml"),
|
|
)
|
|
return c
|
|
|
|
|
|
@pytest.fixture
|
|
def bootstrapped(cfg, bao):
|
|
"""A box with the kit's bootstrap grant on disk (first tick)."""
|
|
Path(cfg.bootstrap_path).write_text(bao.grant() + "\n")
|
|
return cfg
|