mdella/monky-deployd
1
0
Fork 0
mirror of https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git synced 2026-09-18 05:36:15 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity
Files
d0153dd71c4dffe182611b7df02f1d74ca7aa31a
monky-deployd/CHANGELOG.md
T
Claude-Docs-Manager d34189c625 docs+defaults: 443 everywhere the agent dials; the attr the broker does not add yet; no jti state on the mount; release:gitea has not run 
DD-0523 — !7 (31586c30, 0.1.5) moved install.sh and config.example.yaml to the
443 intercept after env-qa-02 hit "service not available". The ansible role
default (monky_deployd_tenancy_port) and TenancyCfg.port still said 8081, so
an ansible-installed box or a config that omits `port` still dialled the wrong
port; both now default to 443, the proxy-mapping and config tests follow, and
PROTOCOL.md §Where and how states the intercept port separately from the
in-pod 8081 and names openziti state/overlay/configs.json as the authority.

DD-0525 — PROTOCOL.md and README said "the broker adds the attr when the
identity is created at kit reveal". monky-ziti at b44c50a4 has no such code
(app/fabric.py host_identity_attrs carries the env template only) and openziti
docs/services.md says "Nothing carries the attr yet". Both now state the
dependency: an operator adds #monky-deploy-agent/#openbao-client on the
controller until the ADR-0028 addendum lands in monky-ziti.

DD-0527 — "the old kit's grant fails at login (unknown/used jti)". The
jwt-tenancy mount keeps no replay state (openbao terraform/jwt-tenancy.tf
see_env role: signature, aud, bound_claims, exp); a superseded grant logs in
until exp and the refusal is tenancy's 401 on the first bearer call. The
second-reveal paragraph, the grant-flow diagram and README §Security model say
so; FakeBao no longer pops a grant at login (the suite's superseded-token test
already goes through FakeTenancy.superseded_jtis, which is the real model).

DD-0528 — "Both locations keep being published": release:gitea has been a
never-run manual job on every tag pipeline (6999, 7044, 7066); README and
OPERATIONS.md now say when the Gitea mirror is published and that it has not
been yet.

Gates (local, py3.12): ruff format, ruff check, pytest 50 passed,
bash -n packaging/install.sh. `git grep 8081` afterwards hits only the in-pod
listener statements.

Doc-Drift: DD-0523 fixed
Doc-Drift: DD-0525 fixed
Doc-Drift: DD-0527 fixed
Doc-Drift: DD-0528 fixed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AW3QqEpwLV69KHn24Re45Q
2026-09-07 08:22:02 -07:00

5.7 KiB
Raw Blame History

Changelog

0.1.5 — 2026-09-07

  • tenancy.port defaults to 443 everywhere — the ansible role default and the TenancyCfg default now match install.sh/config.example.yaml (0.1.5 only changed those two); PROTOCOL.md states the intercept port separately from the in-pod 8081, that the broker does not add #monky-deploy-agent yet, that the jwt mount keeps no jti state, and that release:gitea has not run (doc-drift DD-0523/0525/0527/0528).

  • ${VAR} inside comment lines is not a reference. The renderer's .env.template header literally says "substitutes every ${VAR}", which the refusal check counted as an unresolved variable (ENV_INCOMPLETE: unresolved: VAR) — the first bundle on env-qa-02 was refused for it.

  • config: tenancy.port is the service's intercept port (443), not the in-pod 8081. With 8081 the SDK found no intercept and the dial failed (service not available, then a bare TypeError from the SDK's fallback). install.sh now writes 443; config.example.yaml updated.

  • transport sdk: clear error instead of a TypeError when an address has no intercept or the identity has no dial policy for the service (TransportError names the host:port and what to check).

0.1.4 — 2026-09-07

  • install.sh: ziti-edge-tunnel.service failed to start after enrolment (203/EXEC: the package's ExecStartPre script is not executable by user ziti on ziti-edge-tunnel 1.18.x) and, because the unit was enabled with --now under set -e, the script aborted BEFORE writing config/ACLs/grant/timer — a second kit was needed. The run-host drop-in now clears ExecStartPre=; a tunneler start failure is a WARNING until everything else is in place, then a hard error at the end.

0.1.3 — 2026-09-06

  • install.sh: --version was clobbered by /etc/os-release (it defines VERSION), so the kit tried to download monky-deployd_26.04 LTS (Resolute Raccoon)_amd64.deb (env-qa-02 pilot, first real kit run). Script variables are now DEPLOYD_VERSION; os-release is read in a subshell.
  • install.sh installs Docker Engine when absent (Docker's apt suite for the codename → fallback docker.io), with --docker-data-root <dir> to place the data-root before first start. One script for the end user, per the operator's rule.

v0.1.2 — 2026-09-05

  • The GitLab project is private (its parent groups are private, so it cannot be made public; found when the v0.1.1 one-liner returned 401 anonymously). install.sh gains --token <deploy-token> / MONKY_DEPLOYD_TOKEN: every download from the generic package registry — the script itself included — sends DEPLOY-TOKEN: <token>, a read-only GitLab deploy token (scope read_package_registry only, revocable), seeded in OpenBao at monky/monky-tenancy/deployd-download (key token) and handed to the box by the monky-tenancy install kit. The token never reaches the command line, the log or an xtrace (curl -K config file, 0600, deleted after the download; set +x forced). The one-liner now fetches install.sh from the registry (…/monky-deployd/<ver>/install.sh) instead of -/raw/main, and takes the bootstrap grant via --bootstrap-file — with curl … | bash -s -- stdin IS the script, so it is no longer read for the grant in that mode. --source gitea (no token) stays the off-estate alternative.
  • Ansible role: monky_deployd_download_token (vaulted) → DEPLOY-TOKEN header on both fetches, no_log: true.
  • README / OPERATIONS: why (private project; split-horizon Gitea, cbs/iac#102), token scope, revocation. No agent behaviour change.

v0.1.1 — 2026-09-05

  • install.sh / ansible role / README: the primary download is the public GitLab project's generic package registry on scm.tikali.ai (/api/v4/projects/69/packages/generic/monky-deployd/<ver>/…); the one-liner fetches the script from scm.tikali.ai/…/-/raw/main/packaging/install.sh. Inside the estate gitea.cbs.tikali.net is split-horizon to jump1's RED EIP (no HTTP ingress), so backend boxes could not fetch the artefacts (cbs/iac#102). The Gitea release stays the off-estate alternative (--source gitea / MONKY_DEPLOYD_SOURCE=gitea). No agent behaviour change.

v0.1.0 — 2026-09-05

First release (MONKY-ADR-0028 §D, Reconciliation v2, Gate 1 v2).

  • Stdlib-only Python 3.12 agent: run --once|loop, status, bootstrap, --prune.
  • Protocol: POST /v1/agent/checkin (action apply|none|down), GET /v1/agent/bundle/{env}/{sha} (sha256 verified), POST /v1/agent/lease → deploy grant (login_jwt), POST /v1/agent/report (result applied|failed|down, redacted log_tail). An AppRole-shaped lease is refused (LEASE_SHAPE).
  • OpenBao: POST /v1/auth/jwt-tenancy/login {"role":"see-env","jwt":…}; KV-v2 reads pinned to the manifest's versions, paths pinned to monky/data/<env>/see/; renew-self / re-lease before max TTL.
  • Refusals: ENV_INCOMPLETE (names only), PRIVILEGED_REFUSED, ROLLBACK_REFUSED, DISK_INSUFFICIENT (need × 1.5 + 2 GiB vs docker data-root), BUNDLE_SHA_MISMATCH, BUNDLE_ENV_MISMATCH.
  • Transports sdk (openziti SDK), proxy (ziti tunnel proxy 18443/18200), system.
  • Exit codes 0 / 75 / 78 (AGENT_ENV_MISMATCH, no retry storm) / 1; laptop mode (offline exits 0).
  • Packaging: hardened monky-deployd.service oneshot + 60 s timer, monky-deployd-proxy.service, nfpm .deb with /opt/monky-deployd/venv, packaging/install.sh (Ubuntu 26.04), ansible role skeleton.
  • Known divergence: monky-tenancy main (MR !15) still ships the AppRole lease/kit; the JWT-grant follow-up is the tenancy side of this release (docs/PROTOCOL.md "Divergences").
Reference in New Issue View Git Blame Copy Permalink