mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 05:16:16 +00:00
mdella
1c42e913a8
Stdlib-only Python 3.12 agent for docker VMs and laptops: flock → checkin
(bearer = the agent's OpenBao token, bootstrapped from the install kit's
jwt-tenancy deploy grant) → action apply|none|down → bundle (sha256
verified) → refusal checks (unresolved ${VAR} names only, manifest paths
pinned to monky/data/<env>/see/, privileged/host-network, rollback, disk
need×1.5+headroom) → lease → POST /v1/auth/jwt-tenancy/login → KV reads →
.env 0600 → promote → compose pull/up → wait healthy → report; finally
renew-self / re-lease before max TTL, scrub. Exit 0/75/78/1. Redactor log
filter. Transports sdk (openziti) / proxy (ziti tunnel proxy 18443/18200) /
system. Laptop mode.
Packaging: hardened oneshot + 60 s timer + proxy unit, nfpm .deb with
/opt/monky-deployd/venv, install.sh for Ubuntu 26.04 (Gitea release
download, enrol, ACLs, bootstrap from stdin), ansible role skeleton for
osg1-07. CI: lint/test on every change; wheel (openziti on ubuntu:26.04) and
package (nfpm) allow_failure until runner egress is proven; GitLab release +
release:gitea on v* tags. Docs: README, PROTOCOL, OPERATIONS, CHANGELOG,
CLAUDE/AGENTS.
Divergence noted: monky-tenancy main (MR !15) still ships the AppRole lease
and kit; this agent implements the plan's Gate 1 RESULT (login_jwt, no
unwrap) and refuses an AppRole lease loudly (LEASE_SHAPE).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
114 lines
3.0 KiB
Python
114 lines
3.0 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import os
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
sys.path.insert(0, str(ROOT))
|
|
|
|
from monky_deployd import config as configmod # noqa: E402
|
|
from monky_deployd.redact import REDACTOR # noqa: E402
|
|
from tests.fakes import ENV, FakeBao, FakeTenancy, serve # noqa: E402
|
|
|
|
FAKEBIN = ROOT / "tests" / "fakebin"
|
|
|
|
|
|
@pytest.fixture
|
|
def bao():
|
|
b = FakeBao()
|
|
srv, port = serve(b)
|
|
b.port = port
|
|
yield b
|
|
srv.shutdown()
|
|
|
|
|
|
@pytest.fixture
|
|
def tenancy(bao):
|
|
t = FakeTenancy(bao)
|
|
srv, port = serve(t)
|
|
t.port = port
|
|
t.server = srv
|
|
yield t
|
|
try:
|
|
srv.shutdown()
|
|
except Exception:
|
|
pass
|
|
|
|
|
|
@pytest.fixture
|
|
def fake_docker(tmp_path, monkeypatch):
|
|
log = tmp_path / "docker.log"
|
|
state = tmp_path / "docker-state.json"
|
|
state.write_text(
|
|
json.dumps(
|
|
{
|
|
"ps": [{"Name": "see", "State": "running", "Health": "healthy"}],
|
|
"free_root": str(tmp_path),
|
|
"env_file_check": True,
|
|
}
|
|
)
|
|
)
|
|
monkeypatch.setenv("PATH", f"{FAKEBIN}:{os.environ['PATH']}")
|
|
monkeypatch.setenv("FAKE_DOCKER_LOG", str(log))
|
|
monkeypatch.setenv("FAKE_DOCKER_STATE", str(state))
|
|
|
|
class FD:
|
|
def calls(self):
|
|
if not log.exists():
|
|
return []
|
|
return [json.loads(line)["argv"] for line in log.read_text().splitlines()]
|
|
|
|
def subcommands(self):
|
|
out = []
|
|
for argv in self.calls():
|
|
if argv[:1] == ["compose"]:
|
|
rest = argv[1:]
|
|
while rest and rest[0].startswith("--"):
|
|
rest = rest[2:]
|
|
out.append("compose " + (rest[0] if rest else ""))
|
|
else:
|
|
out.append(" ".join(argv[:2]))
|
|
return out
|
|
|
|
def set(self, **kw):
|
|
cur = json.loads(state.read_text())
|
|
cur.update(kw)
|
|
state.write_text(json.dumps(cur))
|
|
|
|
return FD()
|
|
|
|
|
|
@pytest.fixture
|
|
def cfg(tmp_path, tenancy, bao, fake_docker):
|
|
REDACTOR.forget_all()
|
|
state_dir = tmp_path / "state"
|
|
etc = tmp_path / "etc"
|
|
etc.mkdir()
|
|
c = configmod.from_dict(
|
|
{
|
|
"env_id": ENV,
|
|
"site": "cbs",
|
|
"transport": "system",
|
|
"tenancy": {"host": "127.0.0.1", "port": tenancy.port, "scheme": "http"},
|
|
"bao": {"addr": f"http://127.0.0.1:{bao.port}", "ca_bundle": None},
|
|
"state_dir": str(state_dir),
|
|
"bootstrap_path": str(etc / "bootstrap.jwt"),
|
|
"interval_s": 60,
|
|
"healthy_timeout_s": 3,
|
|
"disk": {"factor": 1.5, "headroom_bytes": 1024},
|
|
},
|
|
path=str(etc / "config.yaml"),
|
|
)
|
|
return c
|
|
|
|
|
|
@pytest.fixture
|
|
def bootstrapped(cfg, bao):
|
|
"""A box with the kit's bootstrap grant on disk (first tick)."""
|
|
Path(cfg.bootstrap_path).write_text(bao.grant() + "\n")
|
|
return cfg
|