Public dry run dryrun-a43e907efd9d
Source commit: a43e907efd9d1561c23fe73499478e881f868355 Public tree identity: sha256:453dea30195485dd8939f575a69b39f4bb7acd84c4df23f8aa29b55d044f2673
This commit is contained in:
Clusterflux release dry run
commit
6f52bb46cd
210 changed files with 77158 additions and 0 deletions
300
scripts/node-attach-smoke.js
Executable file
300
scripts/node-attach-smoke.js
Executable file
|
|
@ -0,0 +1,300 @@
|
|||
#!/usr/bin/env node
|
||||
|
||||
const assert = require("assert");
|
||||
const cp = require("child_process");
|
||||
const crypto = require("crypto");
|
||||
const net = require("net");
|
||||
const path = require("path");
|
||||
const { coordinatorWireRequest } = require("./coordinator-wire");
|
||||
|
||||
const repo = path.resolve(__dirname, "..");
|
||||
const identities = new Map();
|
||||
|
||||
function waitForJsonLine(child) {
|
||||
return new Promise((resolve, reject) => {
|
||||
let buffer = "";
|
||||
child.stdout.on("data", (chunk) => {
|
||||
buffer += chunk.toString();
|
||||
const newline = buffer.indexOf("\n");
|
||||
if (newline < 0) return;
|
||||
try {
|
||||
resolve(JSON.parse(buffer.slice(0, newline).trim()));
|
||||
} catch (error) {
|
||||
reject(error);
|
||||
}
|
||||
});
|
||||
child.once("exit", (code) => {
|
||||
reject(new Error(`process exited before JSON line with code ${code}`));
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function send(addr, message) {
|
||||
return new Promise((resolve, reject) => {
|
||||
const socket = net.connect(addr.port, addr.host, () => {
|
||||
socket.write(`${JSON.stringify(coordinatorWireRequest(message))}\n`);
|
||||
});
|
||||
let buffer = "";
|
||||
socket.on("data", (chunk) => {
|
||||
buffer += chunk.toString();
|
||||
const newline = buffer.indexOf("\n");
|
||||
if (newline < 0) return;
|
||||
socket.end();
|
||||
try {
|
||||
resolve(JSON.parse(buffer.slice(0, newline)));
|
||||
} catch (error) {
|
||||
reject(error);
|
||||
}
|
||||
});
|
||||
socket.on("error", reject);
|
||||
});
|
||||
}
|
||||
|
||||
function nodeIdentity(node) {
|
||||
const existing = identities.get(node);
|
||||
if (existing) return existing;
|
||||
const { privateKey: privateKeyObject, publicKey } =
|
||||
crypto.generateKeyPairSync("ed25519");
|
||||
const privateDer = privateKeyObject.export({ format: "der", type: "pkcs8" });
|
||||
const publicDer = publicKey.export({
|
||||
format: "der",
|
||||
type: "spki",
|
||||
});
|
||||
const privateSeed = Buffer.from(privateDer).subarray(-32);
|
||||
const identity = {
|
||||
privateKey: `ed25519:${privateSeed.toString("base64")}`,
|
||||
publicKey: `ed25519:${Buffer.from(publicDer).subarray(-32).toString("base64")}`,
|
||||
privateKeyObject,
|
||||
};
|
||||
identities.set(node, identity);
|
||||
return identity;
|
||||
}
|
||||
|
||||
function nodeSignatureMessage(
|
||||
node,
|
||||
requestKind,
|
||||
payloadDigest,
|
||||
nonce,
|
||||
issuedAtEpochSeconds
|
||||
) {
|
||||
const parts = [
|
||||
"clusterflux-node-request-signature:v2",
|
||||
node,
|
||||
requestKind,
|
||||
payloadDigest,
|
||||
nonce,
|
||||
String(issuedAtEpochSeconds),
|
||||
];
|
||||
return Buffer.concat(
|
||||
parts.flatMap((part) => [
|
||||
Buffer.from(`${Buffer.byteLength(part)}:`),
|
||||
Buffer.from(part),
|
||||
Buffer.from("\n"),
|
||||
])
|
||||
);
|
||||
}
|
||||
|
||||
function signedNodeHeartbeat(node, identity) {
|
||||
const nonce = `node-attach-heartbeat-${process.pid}-${Date.now()}`;
|
||||
const issuedAt = Math.floor(Date.now() / 1000);
|
||||
const payloadDigest = `sha256:${crypto
|
||||
.createHash("sha256")
|
||||
.update(JSON.stringify({ node, type: "node_heartbeat" }))
|
||||
.digest("hex")}`;
|
||||
const signature = crypto.sign(
|
||||
null,
|
||||
nodeSignatureMessage(node, "node_heartbeat", payloadDigest, nonce, issuedAt),
|
||||
identity.privateKeyObject
|
||||
);
|
||||
return {
|
||||
nonce,
|
||||
issued_at_epoch_seconds: issuedAt,
|
||||
signature: `ed25519:${signature.toString("base64")}`,
|
||||
};
|
||||
}
|
||||
|
||||
function runAttach(addr, grant) {
|
||||
const identity = nodeIdentity("node-attach");
|
||||
return new Promise((resolve, reject) => {
|
||||
const child = cp.spawn(
|
||||
"cargo",
|
||||
[
|
||||
"run",
|
||||
"-q",
|
||||
"-p",
|
||||
"clusterflux-cli",
|
||||
"--bin",
|
||||
"clusterflux",
|
||||
"--",
|
||||
"node",
|
||||
"attach",
|
||||
"--coordinator",
|
||||
`${addr.host}:${addr.port}`,
|
||||
"--tenant",
|
||||
"tenant",
|
||||
"--project-id",
|
||||
"project",
|
||||
"--node",
|
||||
"node-attach",
|
||||
"--public-key",
|
||||
identity.publicKey,
|
||||
"--enrollment-grant",
|
||||
grant,
|
||||
"--cap",
|
||||
"quic-direct",
|
||||
"--json",
|
||||
],
|
||||
{
|
||||
cwd: repo,
|
||||
env: {
|
||||
...process.env,
|
||||
CLUSTERFLUX_NODE_PRIVATE_KEY: identity.privateKey,
|
||||
},
|
||||
}
|
||||
);
|
||||
let stdout = "";
|
||||
let stderr = "";
|
||||
child.stdout.on("data", (chunk) => {
|
||||
stdout += chunk.toString();
|
||||
});
|
||||
child.stderr.on("data", (chunk) => {
|
||||
stderr += chunk.toString();
|
||||
});
|
||||
child.on("exit", (code) => {
|
||||
if (code !== 0) {
|
||||
reject(new Error(`node attach failed with code ${code}\n${stderr}`));
|
||||
return;
|
||||
}
|
||||
try {
|
||||
resolve(JSON.parse(stdout));
|
||||
} catch (error) {
|
||||
reject(
|
||||
new Error(`node attach output was not JSON: ${stdout}\n${error.stack || error.message}`)
|
||||
);
|
||||
}
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
(async () => {
|
||||
const coordinator = cp.spawn(
|
||||
"cargo",
|
||||
[
|
||||
"run",
|
||||
"-q",
|
||||
"-p",
|
||||
"clusterflux-coordinator",
|
||||
"--bin",
|
||||
"clusterflux-coordinator",
|
||||
"--",
|
||||
"--listen",
|
||||
"127.0.0.1:0",
|
||||
"--allow-local-trusted-loopback",
|
||||
],
|
||||
{ cwd: repo }
|
||||
);
|
||||
|
||||
try {
|
||||
const ready = await waitForJsonLine(coordinator);
|
||||
const [host, portText] = ready.listen.split(":");
|
||||
const addr = { host, port: Number(portText) };
|
||||
assert.strictEqual((await send(addr, { type: "ping" })).type, "pong");
|
||||
|
||||
const grant = await send(addr, {
|
||||
type: "create_node_enrollment_grant",
|
||||
tenant: "tenant",
|
||||
project: "project",
|
||||
actor_user: "operator",
|
||||
ttl_seconds: 900
|
||||
});
|
||||
assert.strictEqual(grant.type, "node_enrollment_grant_created");
|
||||
assert.strictEqual(grant.tenant, "tenant");
|
||||
assert.strictEqual(grant.project, "project");
|
||||
assert.match(grant.grant, /^node_grant_[A-Za-z0-9_-]+$/);
|
||||
assert.strictEqual(grant.scope, "node:attach");
|
||||
assert(grant.expires_at_epoch_seconds > Math.floor(Date.now() / 1000));
|
||||
assert(grant.expires_at_epoch_seconds <= Math.floor(Date.now() / 1000) + 900);
|
||||
|
||||
const report = await runAttach(addr, grant.grant);
|
||||
assert.strictEqual(report.plan.node, "node-attach");
|
||||
assert.strictEqual(report.plan.coordinator, `${addr.host}:${addr.port}`);
|
||||
assert.strictEqual(report.plan.enrollment.grant, grant.grant);
|
||||
assert.match(report.plan.enrollment.public_key_fingerprint, /^sha256:[0-9a-f]{64}$/);
|
||||
assert.strictEqual(
|
||||
report.plan.enrollment.exchanges_short_lived_grant_for_long_lived_node_identity,
|
||||
true
|
||||
);
|
||||
assert.ok(report.plan.capabilities.arch.length > 0);
|
||||
assert.ok(report.plan.capabilities.source_providers.includes("filesystem"));
|
||||
assert.ok(report.plan.capabilities.capabilities.includes("QuicDirect"));
|
||||
assert.strictEqual(report.plan.detection.auto_detected, true);
|
||||
assert.strictEqual(report.plan.detection.arch, report.plan.capabilities.arch);
|
||||
assert.deepStrictEqual(report.plan.detection.manual_capability_overrides, ["quic-direct"]);
|
||||
assert(
|
||||
report.plan.detection.recognized_capability_overrides.includes("QuicDirect")
|
||||
);
|
||||
assert.strictEqual(
|
||||
report.plan.detection.os_arch_capabilities_require_manual_flags,
|
||||
false
|
||||
);
|
||||
assert.strictEqual(report.plan.detection.command_backend, "native-command");
|
||||
assert.strictEqual(report.plan.detection.command_backend_available, true);
|
||||
assert(
|
||||
report.plan.detection.source_provider_backends.some(
|
||||
(provider) => provider.provider === "filesystem" && provider.detected
|
||||
)
|
||||
);
|
||||
assert(
|
||||
report.grant_disclosures.length > 0,
|
||||
"node attach should disclose capability grants before reporting capabilities"
|
||||
);
|
||||
assert(
|
||||
report.grant_disclosures.every(
|
||||
(disclosure) => disclosure.coordinator_policy_limited === true
|
||||
),
|
||||
"node attach should mark all capability grants as coordinator-policy-limited"
|
||||
);
|
||||
assert(
|
||||
report.grant_disclosures.some(
|
||||
(disclosure) => disclosure.grant === "native_command_execution"
|
||||
),
|
||||
"node attach should disclose native command execution when detected"
|
||||
);
|
||||
assert(
|
||||
report.grant_disclosures.some(
|
||||
(disclosure) => disclosure.grant === "source_access"
|
||||
),
|
||||
"node attach should disclose source access when detected"
|
||||
);
|
||||
assert.strictEqual(report.boundary.cli_contacted_coordinator, true);
|
||||
assert.strictEqual(report.boundary.used_enrollment_exchange, true);
|
||||
assert.strictEqual(report.boundary.coordinator_session_requests, 3);
|
||||
assert.strictEqual(report.coordinator_response.type, "node_enrollment_exchanged");
|
||||
assert.strictEqual(report.coordinator_response.node, "node-attach");
|
||||
assert.strictEqual(report.coordinator_response.credential.node, "node-attach");
|
||||
assert.strictEqual(report.coordinator_response.credential.scope, "node:attach");
|
||||
assert.strictEqual(report.coordinator_response.credential.credential_kind, "NodeCredential");
|
||||
assert.match(
|
||||
report.coordinator_response.credential.capability_policy_digest,
|
||||
/^sha256:[0-9a-f]{64}$/
|
||||
);
|
||||
assert.strictEqual(report.heartbeat_response.type, "node_heartbeat");
|
||||
assert.strictEqual(report.capability_response.type, "node_capabilities_recorded");
|
||||
|
||||
const heartbeat = await send(addr, {
|
||||
type: "node_heartbeat",
|
||||
node: "node-attach",
|
||||
node_signature: signedNodeHeartbeat("node-attach", nodeIdentity("node-attach")),
|
||||
});
|
||||
assert.strictEqual(heartbeat.type, "node_heartbeat");
|
||||
assert.strictEqual(heartbeat.node, "node-attach");
|
||||
|
||||
} finally {
|
||||
coordinator.kill("SIGTERM");
|
||||
}
|
||||
|
||||
console.log("Node attach smoke passed");
|
||||
})().catch((error) => {
|
||||
console.error(error.stack || error.message);
|
||||
process.exit(1);
|
||||
});
|
||||
Loading…
Add table
Add a link
Reference in a new issue