send agent traffic through squid once its hive announces it
This commit is contained in:
atlas
parent
86e9f49fe6
commit
b551eb02ff
1 changed files with 885 additions and 27 deletions
|
|
@ -1,5 +1,5 @@
|
|||
# Cases for ./agent-bao-fetch.nix. Each case gets a fresh runtime directory and
|
||||
# credentials directory, runs one unit's script under the unit's `UMask=0377`
|
||||
# credentials directory, runs one unit's script under the unit's own `UMask=`
|
||||
# with a clean environment, and asserts on the exit code, the output, the
|
||||
# files left behind and the `bao` calls made.
|
||||
set -uo pipefail
|
||||
|
|
@ -48,7 +48,13 @@ setup() {
|
|||
client_cert=$creds/hive-agent-bao-cert client_key=$creds/hive-agent-bao-key
|
||||
fi
|
||||
: >"$log"
|
||||
if ! sed "s|/run/$unit/|$rt/|g" "${!script_var}" >"$dir/script"; then
|
||||
# The proxy fetch reads the egress facts the hive writes into a
|
||||
# container, moved under the build directory like /run.
|
||||
mkdir "$dir/etc"
|
||||
printf 'HIVE_DASHBOARD_PORT=7000\nHIVE_SQUID_PROXY=10.42.0.1:3128\nHIVE_EGRESS_NO_PROXY=10.42.0.1,t.hive,bao.t.local\n' >"$dir/etc/hyperhive-hive-facts"
|
||||
umask_value=0377
|
||||
if [ "$prefix" = PROXY ]; then umask_value=0177; fi
|
||||
if ! sed -e "s|/run/$unit/|$rt/|g" -e "s|/etc/hyperhive-|$dir/etc/hyperhive-|g" "${!script_var}" >"$dir/script"; then
|
||||
echo "cannot read the rendered script for $unit" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -68,7 +74,7 @@ setup() {
|
|||
go() {
|
||||
count=$((count + 1))
|
||||
(
|
||||
umask 0377
|
||||
umask "$umask_value"
|
||||
cd "$dir" || exit 99
|
||||
exec env -i \
|
||||
PATH="$dir/bin:$FAKE_BAO_BIN:$unit_path" \
|
||||
|
|
@ -382,6 +388,177 @@ for n in 1 2 3; do
|
|||
expect_pair cert2 key2
|
||||
done
|
||||
|
||||
# The proxy fetch writes the agent's proxy variables, credential included, to
|
||||
# one file the units load as an `EnvironmentFile=`. Nothing here may print the
|
||||
# credential, so every case checks the output for it.
|
||||
proxy_url=http://a1:the-secret@10.42.0.1:3128
|
||||
proxy_no=localhost,127.0.0.1,::1,10.42.0.1,t.hive,bao.t.local
|
||||
proxy_path=secret/swarm/agents/a1/proxy-credential
|
||||
proxy_kv_call="kv get -field=value $proxy_path"
|
||||
proxy_env() {
|
||||
printf 'HTTPS_PROXY=%s\nHTTP_PROXY=%s\nhttps_proxy=%s\nhttp_proxy=%s\nNODE_USE_ENV_PROXY=1\nNO_PROXY=%s\nno_proxy=%s\n' \
|
||||
"$proxy_url" "$proxy_url" "$proxy_url" "$proxy_url" "$1" "$1"
|
||||
}
|
||||
|
||||
expect_secret_unprinted() {
|
||||
if grep -qF -e the-secret -e s.fake-token "$dir/out" "$dir/err"; then
|
||||
fail "a secret reached the unit's output: $(cat "$dir/out" "$dir/err")"
|
||||
fi
|
||||
}
|
||||
|
||||
setup PROXY "no store identity delivered"
|
||||
: >"$creds/hive-agent-bao-cert"
|
||||
go
|
||||
expect_rc 0
|
||||
expect_err "has no store identity"
|
||||
expect_calls
|
||||
expect_no_file "$rt/proxy.env"
|
||||
|
||||
setup PROXY "a first fetch writes the variables 0600, and prints no secret"
|
||||
go
|
||||
expect_rc 0
|
||||
expect_out "wrote this agent's proxy settings from $proxy_path"
|
||||
expect_calls "$login_call" "$proxy_kv_call"
|
||||
expect_file "$rt/proxy.env" "$(proxy_env "$proxy_no")"
|
||||
if [ "$(stat -c %a "$rt/proxy.env")" != 600 ]; then fail "proxy.env is mode $(stat -c %a "$rt/proxy.env"), expected 600"; fi
|
||||
expect_no_file "$rt/proxy.env.new"
|
||||
expect_no_file "$rt/secret.new"
|
||||
expect_no_file "$rt/bao.err"
|
||||
expect_secret_unprinted
|
||||
|
||||
setup PROXY "no credential minted yet writes nothing"
|
||||
kv_rc=2
|
||||
kv_err="No value found at secret/data/swarm/agents/a1"
|
||||
go
|
||||
expect_rc 0
|
||||
expect_err "no egress-proxy credential at $proxy_path yet"
|
||||
expect_calls "$login_call" "$proxy_kv_call"
|
||||
expect_no_file "$rt/proxy.env"
|
||||
expect_no_file "$rt/proxy.env.new"
|
||||
expect_no_file "$rt/secret.new"
|
||||
|
||||
setup PROXY "no credential minted yet leaves the file in place"
|
||||
proxy_env old.example >"$rt/proxy.env"
|
||||
chmod 0600 "$rt/proxy.env"
|
||||
kv_rc=2
|
||||
go
|
||||
expect_rc 0
|
||||
expect_file "$rt/proxy.env" "$(proxy_env old.example)"
|
||||
|
||||
setup PROXY "a store that refuses the login leaves the file in place"
|
||||
proxy_env old.example >"$rt/proxy.env"
|
||||
login_rc=2
|
||||
login_err=$'Error authenticating: Error making API request.\n\nCode: 503. Errors:\n\n* Vault is sealed\n'
|
||||
go
|
||||
expect_rc 1
|
||||
expect_err "could not log in to the swarm secret store"
|
||||
expect_err "Vault is sealed"
|
||||
expect_calls "$login_call"
|
||||
expect_file "$rt/proxy.env" "$(proxy_env old.example)"
|
||||
|
||||
setup PROXY "a store that does not answer leaves the file in place"
|
||||
proxy_env old.example >"$rt/proxy.env"
|
||||
login_rc=2
|
||||
login_err="Error authenticating: Put \"$bao_addr/v1/auth/cert/login\": dial tcp: lookup bao.t.local: no such host"
|
||||
go
|
||||
expect_rc 1
|
||||
expect_file "$rt/proxy.env" "$(proxy_env old.example)"
|
||||
|
||||
setup PROXY "0600 files already in place do not block the fetch"
|
||||
printf stale >"$rt/proxy.env.new"
|
||||
printf stale >"$rt/secret.new"
|
||||
printf stale >"$rt/bao.err"
|
||||
go
|
||||
expect_rc 0
|
||||
expect_no_err "Permission denied"
|
||||
expect_file "$rt/proxy.env" "$(proxy_env "$proxy_no")"
|
||||
|
||||
setup PROXY "an unchanged credential leaves the file alone"
|
||||
proxy_env "$proxy_no" >"$rt/proxy.env"
|
||||
before=$(stat -c %i "$rt/proxy.env")
|
||||
go
|
||||
expect_rc 0
|
||||
expect_out "are unchanged"
|
||||
if [ "$(stat -c %i "$rt/proxy.env")" != "$before" ]; then fail "the unchanged file was replaced"; fi
|
||||
expect_no_file "$rt/proxy.env.new"
|
||||
|
||||
setup PROXY "a changed credential replaces the file whole"
|
||||
proxy_env old.example >"$rt/proxy.env"
|
||||
go
|
||||
expect_rc 0
|
||||
expect_file "$rt/proxy.env" "$(proxy_env "$proxy_no")"
|
||||
|
||||
setup PROXY "a value that is not a base64url secret is refused and the file kept"
|
||||
proxy_env old.example >"$rt/proxy.env"
|
||||
kv_out=$'abc\nNO_PROXY=*'
|
||||
go
|
||||
expect_rc 1
|
||||
expect_err "is not a base64url secret"
|
||||
expect_file "$rt/proxy.env" "$(proxy_env old.example)"
|
||||
if grep -qF abc "$dir/out" "$dir/err"; then fail "the refused value was printed"; fi
|
||||
|
||||
setup PROXY "an empty value is refused"
|
||||
kv_out=
|
||||
go
|
||||
expect_rc 1
|
||||
expect_err "is not a base64url secret"
|
||||
expect_no_file "$rt/proxy.env"
|
||||
|
||||
# A hive that predates the facts, or whose squid does not announce itself, gets
|
||||
# no proxy: the store is not asked and nothing is written.
|
||||
no_fact() {
|
||||
expect_rc 0
|
||||
expect_err "this hive's facts name no squid proxy"
|
||||
expect_calls
|
||||
expect_no_file "$rt/proxy.env"
|
||||
expect_secret_unprinted
|
||||
}
|
||||
|
||||
setup PROXY "a hive that writes no egress facts means no proxy"
|
||||
printf 'HIVE_DASHBOARD_PORT=7000\nHYPERHIVE_HIVE_DOMAIN=t.hive\n' >"$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
no_fact
|
||||
|
||||
setup PROXY "no facts file means no proxy"
|
||||
rm "$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
no_fact
|
||||
|
||||
setup PROXY "a proxy fact without the direct hosts means no proxy"
|
||||
printf 'HIVE_SQUID_PROXY=10.42.0.1:3128\n' >"$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
no_fact
|
||||
|
||||
setup PROXY "direct hosts without a proxy fact mean no proxy"
|
||||
printf 'HIVE_EGRESS_NO_PROXY=10.42.0.1,t.hive\n' >"$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
no_fact
|
||||
|
||||
for bad in 'not-an-address' 'http://10.42.0.1:3128' '10.42.0.1' 'proxy.t.local:3128'; do
|
||||
setup PROXY "a proxy fact that is not an address and a port is refused: $bad"
|
||||
printf 'HIVE_SQUID_PROXY=%s\nHIVE_EGRESS_NO_PROXY=10.42.0.1\n' "$bad" >"$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
no_fact
|
||||
done
|
||||
|
||||
setup PROXY "direct hosts that are not host names are refused"
|
||||
printf 'HIVE_SQUID_PROXY=10.42.0.1:3128\nHIVE_EGRESS_NO_PROXY=a b,c\n' >"$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
no_fact
|
||||
|
||||
setup PROXY "no facts leave the file in place"
|
||||
proxy_env old.example >"$rt/proxy.env"
|
||||
rm "$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
expect_rc 0
|
||||
expect_file "$rt/proxy.env" "$(proxy_env old.example)"
|
||||
|
||||
setup PROXY "the direct hosts are used as the hive wrote them, after the loopback names"
|
||||
printf 'HIVE_SQUID_PROXY=10.9.8.7:3129\nHIVE_EGRESS_NO_PROXY=10.9.8.7,x.t.hive,y.t.hive\n' >"$dir/etc/hyperhive-hive-facts"
|
||||
go
|
||||
expect_rc 0
|
||||
expect_file "$rt/proxy.env" "$(proxy_url=http://a1:the-secret@10.9.8.7:3129 proxy_env localhost,127.0.0.1,::1,10.9.8.7,x.t.hive,y.t.hive)"
|
||||
|
||||
if [ "$failures" -ne 0 ]; then
|
||||
echo "script-test-agent-bao-fetch: $failures failed assertions over $count runs" >&2
|
||||
exit 1
|
||||
|
|
|
|||
Loading…
Reference in a new issue