mirror of
https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git
synced 2026-09-18 04:36:15 +00:00
Claude-Docs-Manager
d34189c625
DD-0523 — !7 (31586c30, 0.1.5) moved install.sh and config.example.yaml to the
443 intercept after env-qa-02 hit "service not available". The ansible role
default (monky_deployd_tenancy_port) and TenancyCfg.port still said 8081, so
an ansible-installed box or a config that omits `port` still dialled the wrong
port; both now default to 443, the proxy-mapping and config tests follow, and
PROTOCOL.md §Where and how states the intercept port separately from the
in-pod 8081 and names openziti state/overlay/configs.json as the authority.
DD-0525 — PROTOCOL.md and README said "the broker adds the attr when the
identity is created at kit reveal". monky-ziti at b44c50a4 has no such code
(app/fabric.py host_identity_attrs carries the env template only) and openziti
docs/services.md says "Nothing carries the attr yet". Both now state the
dependency: an operator adds #monky-deploy-agent/#openbao-client on the
controller until the ADR-0028 addendum lands in monky-ziti.
DD-0527 — "the old kit's grant fails at login (unknown/used jti)". The
jwt-tenancy mount keeps no replay state (openbao terraform/jwt-tenancy.tf
see_env role: signature, aud, bound_claims, exp); a superseded grant logs in
until exp and the refusal is tenancy's 401 on the first bearer call. The
second-reveal paragraph, the grant-flow diagram and README §Security model say
so; FakeBao no longer pops a grant at login (the suite's superseded-token test
already goes through FakeTenancy.superseded_jtis, which is the real model).
DD-0528 — "Both locations keep being published": release:gitea has been a
never-run manual job on every tag pipeline (6999, 7044, 7066); README and
OPERATIONS.md now say when the Gitea mirror is published and that it has not
been yet.
Gates (local, py3.12): ruff format, ruff check, pytest 50 passed,
bash -n packaging/install.sh. `git grep 8081` afterwards hits only the in-pod
listener statements.
Doc-Drift: DD-0523 fixed
Doc-Drift: DD-0525 fixed
Doc-Drift: DD-0527 fixed
Doc-Drift: DD-0528 fixed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AW3QqEpwLV69KHn24Re45Q
103 lines
3.4 KiB
Python
103 lines
3.4 KiB
Python
import json
|
|
from pathlib import Path
|
|
|
|
from monky_deployd import __version__, cli
|
|
from monky_deployd.agent import EX_OK
|
|
|
|
|
|
def write_cfg(cfg):
|
|
lines = [
|
|
f"env_id: {cfg.env_id}",
|
|
f"site: {cfg.site}",
|
|
"transport: system",
|
|
"tenancy:",
|
|
f" host: {cfg.tenancy.host}",
|
|
f" port: {cfg.tenancy.port}",
|
|
" scheme: http",
|
|
"bao:",
|
|
f" addr: {cfg.bao.addr}",
|
|
" ca_bundle: none",
|
|
f"state_dir: {cfg.state_dir}",
|
|
f"bootstrap_path: {cfg.bootstrap_path}",
|
|
f"deploy_dir: {cfg.deploy_dir}",
|
|
"healthy_timeout_s: 3",
|
|
]
|
|
Path(cfg.path).write_text("\n".join(lines) + "\n")
|
|
return cfg.path
|
|
|
|
|
|
def test_run_once_then_status(bootstrapped, tenancy, fake_docker, capsys):
|
|
path = write_cfg(bootstrapped)
|
|
assert cli.main(["-c", path, "run", "--once"]) == EX_OK
|
|
assert cli.main(["-c", path, "status", "--json"]) == EX_OK
|
|
out = json.loads(capsys.readouterr().out)
|
|
assert out["in_sync"] is True and out["applied_sha"] == tenancy.desired_sha and out["token_present"] is True
|
|
assert out["healthy"] is True and out["containers"][0]["name"] == "see"
|
|
assert cli.main(["-c", path, "status"]) == EX_OK
|
|
text = capsys.readouterr().out
|
|
assert "in sync" in text and "healthy" in text and "hvs." not in text
|
|
|
|
|
|
def test_bootstrap_command(bootstrapped, bao, capsys):
|
|
cfg = bootstrapped
|
|
path = write_cfg(cfg)
|
|
assert cli.main(["-c", path, "bootstrap"]) == EX_OK
|
|
assert cfg.token_path.exists() and not Path(cfg.bootstrap_path).exists()
|
|
assert cli.main(["-c", path, "bootstrap"]) == EX_OK
|
|
assert "already bootstrapped" in capsys.readouterr().out
|
|
|
|
|
|
def test_version_and_bad_config(capsys, tmp_path):
|
|
assert cli.main(["version"]) == 0
|
|
assert capsys.readouterr().out.strip() == __version__
|
|
bad = tmp_path / "c.yaml"
|
|
bad.write_text("env_id: nope\nsite: cbs\n")
|
|
assert cli.main(["-c", str(bad), "status"]) == 78
|
|
assert cli.main(["-c", str(tmp_path / "missing.yaml"), "status"]) == 1
|
|
|
|
|
|
def test_sdk_transport_uses_openziti_monkeypatch(monkeypatch, tmp_path):
|
|
"""The sdk transport loads the identity once and dials inside openziti.monkeypatch()."""
|
|
import contextlib
|
|
import socket
|
|
import sys
|
|
import types
|
|
|
|
calls = []
|
|
fake = types.ModuleType("openziti")
|
|
fake.load = lambda p: calls.append(("load", p)) or object()
|
|
|
|
@contextlib.contextmanager
|
|
def mp():
|
|
calls.append(("monkeypatch",))
|
|
yield
|
|
|
|
fake.monkeypatch = mp
|
|
monkeypatch.setitem(sys.modules, "openziti", fake)
|
|
from monky_deployd.transport import SdkTransport
|
|
|
|
srv = socket.socket()
|
|
srv.bind(("127.0.0.1", 0))
|
|
srv.listen(1)
|
|
t = SdkTransport(str(tmp_path / "id.json"))
|
|
s = t.connect("127.0.0.1", srv.getsockname()[1], 2)
|
|
s.close()
|
|
srv.close()
|
|
assert calls == [("load", str(tmp_path / "id.json")), ("monkeypatch",)]
|
|
assert "sdk(identity=" in t.describe()
|
|
|
|
|
|
def test_proxy_transport_refuses_unmapped_hosts():
|
|
from monky_deployd.config import from_dict
|
|
from monky_deployd.transport import TransportError, build
|
|
|
|
cfg = from_dict({"env_id": "env-dev-06", "site": "cbs", "transport": "proxy"})
|
|
t = build(cfg)
|
|
assert t.mapping[("monky.tenancy.deploy", 443)] == ("127.0.0.1", 18443)
|
|
assert t.mapping[("bao.cbs.tikali.net", 8200)] == ("127.0.0.1", 18200)
|
|
try:
|
|
t.connect("example.com", 443, 1)
|
|
raise AssertionError("unmapped host must be refused")
|
|
except TransportError:
|
|
pass
|