gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-09-21 18:13:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(scanner): require ABBA collector credentials (#7700)

Browse Source 
Co-authored-by: zhi22915 <qiuzgang@gmail.com>
This commit is contained in:
houseme
2026-09-12 17:03:48 +08:00
committed by GitHub
parent 4f0e050b39
commit 59f1c68759
2 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/scanner_abba.py
+2
View File
@@ -650,6 +650,8 @@ def collect_live(prepared, request, request_path, adapter):
connection = prepared["collector"]
require(set(connection) == {"alias", "endpoint", "metrics_endpoints"}, "invalid collector connection")
require(all(isinstance(value, str) and value for value in connection.values()), "missing collector endpoint")
require(os.environ.get("RUSTFS_ACCESS_KEY"), "collector requires RUSTFS_ACCESS_KEY")
require(os.environ.get("RUSTFS_SECRET_KEY"), "collector requires RUSTFS_SECRET_KEY")
expected_metrics_endpoints = None
if request.get("evidence") == "measured":
expected_metrics_endpoints = request["release_evidence"]["distributed"]["metrics_endpoints"]
scripts/test_scanner_abba.py
+19 -3
View File
@@ -278,7 +278,8 @@ class ScannerAbbaTest(unittest.TestCase):
try:
with patch.dict(os.environ, {"SCANNER_ABBA_TEST_FAULT": "stubborn-child"}), \
patch.object(harness, "__file__", str(self.root / "scanner_abba.py")), \
patch.object(harness, "invoke", side_effect=failed_measure):
patch.object(harness, "invoke", side_effect=failed_measure), \
patch.dict(os.environ, {"RUSTFS_ACCESS_KEY": "test", "RUSTFS_SECRET_KEY": "test"}):
with self.assertRaisesRegex(ValueError, "injected measurement failure"):
harness.collect_live({"collector": {"alias": "fixture", "endpoint": "fixture", "metrics_endpoints": "fixture"}},
{"duration_seconds": 900}, request, self.adapter)
@@ -537,7 +538,8 @@ class ScannerAbbaTest(unittest.TestCase):
process = Mock(pid=123, wait=Mock(return_value=1 if name == "collector-exit" else 0))
with patch.object(harness, "OwnedCommand", return_value=process), \
patch.object(harness, "invoke", return_value={"sample_count": 10}), \
patch.object(harness.time, "monotonic", side_effect=(0, 900)):
patch.object(harness.time, "monotonic", side_effect=(0, 900)), \
patch.dict(os.environ, {"RUSTFS_ACCESS_KEY": "test", "RUSTFS_SECRET_KEY": "test"}):
if error:
with self.assertRaisesRegex(ValueError, error):
harness.collect_live(prepared, {"duration_seconds": 900}, self.root / "request.json", self.adapter)
@@ -547,6 +549,19 @@ class ScannerAbbaTest(unittest.TestCase):
process.finish.assert_called_once_with(terminate=True)
def test_live_collector_requires_credentials_before_measurement(self):
request = self.root / "request.json"
harness.write_json(request, {})
prepared = {"collector": {"alias": "test", "endpoint": "http://node-a:9000",
"metrics_endpoints": "http://node-a:9000"}}
with patch.object(harness, "OwnedCommand") as command, \
patch.object(harness, "invoke") as invoke, \
patch.dict(os.environ, {}, clear=True):
with self.assertRaisesRegex(ValueError, "collector requires RUSTFS_ACCESS_KEY"):
harness.collect_live(prepared, {"duration_seconds": 900}, request, self.adapter)
command.assert_not_called()
invoke.assert_not_called()
def test_live_collector_binds_release_evidence_metrics_endpoints(self):
telemetry = self.root / "telemetry"
for name in ("status", "heal", "metrics"):
@@ -570,7 +585,8 @@ class ScannerAbbaTest(unittest.TestCase):
process = Mock(pid=123, wait=Mock(return_value=0))
with patch.object(harness, "OwnedCommand", return_value=process), \
patch.object(harness, "invoke", return_value={"sample_count": 10}), \
patch.object(harness.time, "monotonic", side_effect=(0, 900)):
patch.object(harness.time, "monotonic", side_effect=(0, 900)), \
patch.dict(os.environ, {"RUSTFS_ACCESS_KEY": "test", "RUSTFS_SECRET_KEY": "test"}):
with self.assertRaisesRegex(ValueError, "collector metrics endpoints"):
harness.collect_live(prepared, request, self.root / "request.json", self.adapter)
process.finish.assert_called_once_with(terminate=True)