98 lines
4.1 KiB
Nix
98 lines
4.1 KiB
Nix
# `checks.module-eval-ci-metrics` — see ./lib.nix for the shared rationale
|
|
# (why this suite exists, naming convention, "evaluates not executes"). The CI
|
|
# run poller's unit and timer, its default, its collector route and its IdP
|
|
# registration; its store grants are in ./bao-grants.nix beside every other
|
|
# principal's, and its dashboard in ./grafana.nix.
|
|
#
|
|
# Every fixture is a shared one, so this cluster evaluates no host of its own.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
self,
|
|
nixosSystem,
|
|
shared,
|
|
}:
|
|
let
|
|
inherit
|
|
(import ./lib.nix {
|
|
inherit
|
|
pkgs
|
|
lib
|
|
self
|
|
nixosSystem
|
|
;
|
|
})
|
|
runGroup
|
|
;
|
|
|
|
bare = shared.bareWithController;
|
|
# Every swarm service on one host: the store mints the poller's leaf, so the
|
|
# poller defaults on, beside authelia, the publisher and the collector.
|
|
allLocal = shared.allLocal;
|
|
|
|
svc = allLocal.systemd.services.swarm-ci-metrics;
|
|
env = svc.environment;
|
|
clientId = allLocal.services.hyperhive.swarm.ci-metrics.clientId;
|
|
otel = allLocal.services.hyperhive.swarm.otel;
|
|
|
|
cases = [
|
|
{
|
|
# The control is the same unit and timer on the all-local host: a
|
|
# misspelled attribute path would make the absence arm pass alone.
|
|
name = "the CI run poller's unit and timer exist only where its host enables it";
|
|
ok =
|
|
!(bare.systemd.services ? swarm-ci-metrics)
|
|
&& !(bare.systemd.timers ? swarm-ci-metrics)
|
|
&& allLocal.services.hyperhive.deploy.ci-metrics.enable
|
|
&& svc.serviceConfig.Type == "oneshot"
|
|
&& !(svc.serviceConfig.RemainAfterExit or false)
|
|
&& allLocal.systemd.timers.swarm-ci-metrics.timerConfig.OnUnitInactiveSec == "5min"
|
|
&& lib.elem "timers.target" allLocal.systemd.timers.swarm-ci-metrics.wantedBy;
|
|
}
|
|
{
|
|
# The leaf is handed in as a credential, never an argument; the forge
|
|
# token and the client secret are read from the store per pass.
|
|
name = "the poller loads only its store leaf, keeps its cursor in its state directory and carries no secret in its unit";
|
|
ok =
|
|
lib.elem "bao-client-key.pem:/var/lib/swarm-bao-pki/ci-metrics-key.pem" svc.serviceConfig.LoadCredential
|
|
&& lib.elem "bao-client.pem:/var/lib/swarm-bao-pki/ci-metrics.pem" svc.serviceConfig.LoadCredential
|
|
&& env.BAO_CLIENT_KEY == "/run/credentials/swarm-ci-metrics.service/bao-client-key.pem"
|
|
&& svc.serviceConfig.DynamicUser
|
|
&& svc.serviceConfig.StateDirectory == "swarm-ci-metrics"
|
|
&& !(lib.any (n: lib.hasSuffix "TOKEN" n || lib.hasSuffix "SECRET" n) (lib.attrNames env));
|
|
}
|
|
{
|
|
# The endpoint the poller pushes to is the route the collector admits
|
|
# its client on, and that route feeds the swarm tier's metrics pipeline.
|
|
name = "the poller pushes to its own collector route, which admits its client into the metrics pipeline";
|
|
ok =
|
|
let
|
|
h = shared.baoWithCollector;
|
|
s = h.containers.swarm-otel.config.services.opentelemetry-collector.settings;
|
|
in
|
|
env.SWARM_CI_METRICS_OTLP_ENDPOINT == "https://${otel.domain}/swarm-ci-metrics"
|
|
&& env.SWARM_CI_METRICS_OIDC_CLIENT_ID == clientId
|
|
&& otel.serviceProducers.swarm-ci-metrics.clientId == clientId
|
|
&& s.receivers."otlp/swarm-ci-metrics".protocols.http.auth.authenticator == "oidc/swarm-ci-metrics"
|
|
&& s.extensions."oidc/swarm-ci-metrics".audience == clientId
|
|
&& lib.elem "otlp/swarm-ci-metrics" s.service.pipelines."metrics/${otel.producerName}".receivers
|
|
&& h.services.nginx.virtualHosts.${otel.domain}.locations ? "/swarm-ci-metrics/";
|
|
}
|
|
{
|
|
name = "the poller's client is registered as a machine, and the publisher carries its secret";
|
|
ok =
|
|
let
|
|
c = lib.findFirst (
|
|
c: c.id == clientId
|
|
) null allLocal.services.hyperhive.swarm.authelia.oidc.clients;
|
|
in
|
|
c != null
|
|
&& c.kind == "machine"
|
|
&& c.audience == [ clientId ]
|
|
&& lib.hasInfix "secret/swarm/services/${clientId}/oidc/client" (
|
|
allLocal.containers.swarm-authelia.config.systemd.services.swarm-secret-publish.script
|
|
);
|
|
}
|
|
];
|
|
in
|
|
runGroup "ci-metrics" cases
|