mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 05:36:15 +00:00
Claude-Docs-Manager
d34189c625
DD-0523 — !7 (31586c30, 0.1.5) moved install.sh and config.example.yaml to the
443 intercept after env-qa-02 hit "service not available". The ansible role
default (monky_deployd_tenancy_port) and TenancyCfg.port still said 8081, so
an ansible-installed box or a config that omits `port` still dialled the wrong
port; both now default to 443, the proxy-mapping and config tests follow, and
PROTOCOL.md §Where and how states the intercept port separately from the
in-pod 8081 and names openziti state/overlay/configs.json as the authority.
DD-0525 — PROTOCOL.md and README said "the broker adds the attr when the
identity is created at kit reveal". monky-ziti at b44c50a4 has no such code
(app/fabric.py host_identity_attrs carries the env template only) and openziti
docs/services.md says "Nothing carries the attr yet". Both now state the
dependency: an operator adds #monky-deploy-agent/#openbao-client on the
controller until the ADR-0028 addendum lands in monky-ziti.
DD-0527 — "the old kit's grant fails at login (unknown/used jti)". The
jwt-tenancy mount keeps no replay state (openbao terraform/jwt-tenancy.tf
see_env role: signature, aud, bound_claims, exp); a superseded grant logs in
until exp and the refusal is tenancy's 401 on the first bearer call. The
second-reveal paragraph, the grant-flow diagram and README §Security model say
so; FakeBao no longer pops a grant at login (the suite's superseded-token test
already goes through FakeTenancy.superseded_jtis, which is the real model).
DD-0528 — "Both locations keep being published": release:gitea has been a
never-run manual job on every tag pipeline (6999, 7044, 7066); README and
OPERATIONS.md now say when the Gitea mirror is published and that it has not
been yet.
Gates (local, py3.12): ruff format, ruff check, pytest 50 passed,
bash -n packaging/install.sh. `git grep 8081` afterwards hits only the in-pod
listener statements.
Doc-Drift: DD-0523 fixed
Doc-Drift: DD-0525 fixed
Doc-Drift: DD-0527 fixed
Doc-Drift: DD-0528 fixed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AW3QqEpwLV69KHn24Re45Q
80 lines
3.0 KiB
Python
80 lines
3.0 KiB
Python
import pytest
|
|
|
|
from monky_deployd import config as c
|
|
|
|
KIT = """\
|
|
# written by the install kit
|
|
env_id: env-qa-02
|
|
site: cbs
|
|
transport: sdk
|
|
identity: /opt/openziti/etc/identities/monky-host.env-qa-02.json
|
|
tenancy:
|
|
service: monky.tenancy.deploy
|
|
base_url: http://monky.tenancy.deploy:443
|
|
bao:
|
|
service: openbao
|
|
addr: https://bao.cbs.tikali.net:8200 # intercept, not public DNS
|
|
ca_bundle: /etc/monky-deployd/openbao-ca.pem
|
|
mount: jwt-tenancy
|
|
role: see-env
|
|
kv_mount: monky
|
|
interval_s: 60
|
|
laptop_mode: false
|
|
volumes_on_absent: keep
|
|
"""
|
|
|
|
|
|
def test_yaml_subset_parses_nested_maps_and_types():
|
|
d = c.parse_yaml_subset(KIT)
|
|
assert d["env_id"] == "env-qa-02"
|
|
assert d["tenancy"]["base_url"] == "http://monky.tenancy.deploy:443"
|
|
assert d["bao"]["addr"] == "https://bao.cbs.tikali.net:8200"
|
|
assert d["interval_s"] == 60 and d["laptop_mode"] is False
|
|
|
|
|
|
def test_yaml_subset_lists_quotes_and_comments():
|
|
d = c.parse_yaml_subset("a: \"x # not a comment\"\nb: 'q'\nlist:\n - one\n - 2\nn: ~\n")
|
|
assert d == {"a": "x # not a comment", "b": "q", "list": ["one", 2], "n": None}
|
|
|
|
|
|
def test_yaml_subset_refuses_flow_style_and_tabs():
|
|
with pytest.raises(c.ConfigError):
|
|
c.parse_yaml_subset("a: [1, 2]\n")
|
|
with pytest.raises(c.ConfigError):
|
|
c.parse_yaml_subset("a:\n\tb: 1\n")
|
|
|
|
|
|
def test_config_defaults_and_derivations():
|
|
cfg = c.from_dict(c.parse_yaml_subset(KIT))
|
|
assert cfg.tenancy.host == "monky.tenancy.deploy" and cfg.tenancy.port == 443 and cfg.tenancy.scheme == "http"
|
|
assert cfg.bao_url == ("https", "bao.cbs.tikali.net", 8200)
|
|
assert cfg.deploy_dir == "/var/lib/monky-deployd/env-qa-02"
|
|
assert cfg.compose_project == "monky-env-qa-02"
|
|
assert str(cfg.token_path) == "/var/lib/monky-deployd/bao.token"
|
|
assert cfg.is_prod is False
|
|
assert cfg.bao.mount == "jwt-tenancy" and cfg.bao.role == "see-env"
|
|
|
|
|
|
def test_config_prod_detection_and_legacy_ids():
|
|
assert c.from_dict({"env_id": "env-prod-01", "site": "pdx"}).is_prod is True
|
|
assert c.from_dict({"env_id": "prod-cedar", "site": "cbs"}).is_prod is True
|
|
assert c.from_dict({"env_id": "dev-env-2", "site": "cbs"}).is_prod is False
|
|
with pytest.raises(c.ConfigError):
|
|
c.from_dict({"env_id": "dev-env-1", "site": "cbs"}) # retired 2026-09-04
|
|
|
|
|
|
def test_config_rejects_approle_and_unknown_keys():
|
|
with pytest.raises(c.ConfigError, match="approle"):
|
|
c.from_dict({"env_id": "env-dev-06", "site": "cbs", "bao": {"approle": {"path": "approle"}}})
|
|
with pytest.raises(c.ConfigError, match="unknown key"):
|
|
c.from_dict({"env_id": "env-dev-06", "site": "cbs", "tenancy": {"nope": 1}})
|
|
with pytest.raises(c.ConfigError, match="transport"):
|
|
c.from_dict({"env_id": "env-dev-06", "site": "cbs", "transport": "carrier-pigeon"})
|
|
with pytest.raises(c.ConfigError, match="site"):
|
|
c.from_dict({"env_id": "env-dev-06", "site": "sfo"})
|
|
|
|
|
|
def test_sdk_identity_defaults_to_host_identity():
|
|
cfg = c.from_dict({"env_id": "env-dev-07", "site": "cbs"})
|
|
assert cfg.identity == "/opt/openziti/etc/identities/monky-host.env-dev-07.json"
|