mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-22 16:16:41 +00:00
fix(mesh): bias Sencho static IP via IPAM IPRange (F-13) (#1162)
* fix(mesh): reserve Sencho static IP via IPAM auxiliary address (F-13)
Sencho pins itself to <network>+2 on sencho_mesh, but the IPAM block only
declared Subnet, so Docker freely handed that address to any meshed
workload that restarted while Sencho was offline. A real-world hit on
arrapps-prod during a Sencho upgrade had tautulli grab 172.30.0.2, which
blocked the new Sencho container's mesh attach with "Address already in
use" and left compose in a half-state needing manual disconnect/recreate.
The fix reserves <network>+2 via AuxiliaryAddresses on the IPAM Config
when creating sencho_mesh. Aux-listed addresses are removed from the
auto-allocatable pool, so Docker refuses to hand the IP to any container
that does not explicitly request it. Sencho's own attach via
connectContainerToNetwork({ ipv4Address }) is unaffected because
explicit pins still bind aux-reserved addresses. Workload containers
without a pinned IP get .3 and up.
Wire format verified against the Docker Engine REST v1.33 OpenAPI spec:
the JSON key on POST /networks/create (and on the inspect response) is
AuxiliaryAddresses inside each IPAM.Config item, value { sencho: <ip> }.
Adopt-existing path: when Sencho boots against a sencho_mesh that
pre-dates this reservation, the data plane still comes up but a one-time
warn fires (mesh.enable activity at level: 'warn' plus a [Mesh] console
line so docker logs surfaces it). The advisory explains the squat risk
and gives the recreate recipe.
Tests: 5 cases added to mesh-setup-error-classification.test.ts covering
the explicit-env create payload, the candidate-iteration winner payload,
the adopt-legacy warn (env-unset), the adopt-already-reserved silent
path, and the TOCTOU 409 race-winner adopt-legacy warn.
Docs: one sentence added to docs/features/sencho-mesh.mdx under
"Customising the mesh subnet" describing the reservation positively.
No tier/role/capability/flag gates touched (no frontend changes).
* fix(mesh): use IPRange upper-half bias instead of aux-address reservation
The initial F-13 fix used IPAM AuxiliaryAddresses to reserve <network>+2
on sencho_mesh. Empirical probe against Docker 29.4.3 confirmed this
also blocks explicit pins via EndpointConfig.IPAMConfig.IPv4Address:
libnetwork's RequestAddress() rejects a preferred-address request when
the bit is already set by the aux reservation. Result: the freshly-
reserved network refuses Sencho's own ensureSelfAttached, and the data
plane never comes up.
The pivot uses IPRange instead. IPRange constrains Docker's auto-
allocation to the configured CIDR; preferred-address requests via
RequestAddress(prefAddress) skip the IPRange check and only consult
the subnet-wide bitmap. So setting IPRange to the upper half of the
subnet (e.g. 172.30.0.128/25 for 172.30.0.0/24) biases workloads
without an explicit IP to <network>+128 and up, while Sencho's
explicit pin to <network>+2 still succeeds.
Verified on Docker 29.4.3 with the same workstation that produced the
original audit:
- `docker run --rm --network N --ip 10.99.99.2` against a network
with `--aux-address sencho=10.99.99.2` → "Address already in use"
(rejects explicit pin).
- Same `--ip` against a network with `--ip-range 10.99.99.128/25` →
succeeds (10.99.99.2 is outside the range but inside the subnet).
- Auto-allocated workload on the IPRange network lands at .129.
Adopt-existing legacy detection now compares IPRange instead of
AuxiliaryAddresses. inspectExistingMeshSubnet returns { subnet,
ipRange } and the warn fires when ipRange differs from the expected
upper-half CIDR. Same once-per-process semantics as before.
createMeshNetwork now derives the IPRange via a new
getMeshIpRangeFromSubnet helper. The five regression tests assert
IPRange = <network>+128/<prefix+1> in the create payload and the
expected/actual IPRange in the legacy-warn details.
This commit is contained in:
Anso
@@ -442,6 +442,157 @@ describe('MeshService.setupMeshNetwork subnet auto-fallback', () => {
|
||||
});
|
||||
});
|
||||
|
||||
describe('MeshService static IP reservation (F-13)', () => {
|
||||
it('emits IPRange for the upper half of the subnet when creating with an explicit env subnet', async () => {
|
||||
process.env.SENCHO_MESH_SUBNET = '10.42.0.0/24';
|
||||
process.env.HOSTNAME = 'sencho';
|
||||
const createNetwork = vi.fn().mockResolvedValue(undefined);
|
||||
const inspectNetwork = vi.fn().mockRejectedValue({ statusCode: 404, message: 'no such network' });
|
||||
mockDocker({ createNetwork, inspectNetwork });
|
||||
|
||||
const svc = MeshService.getInstance();
|
||||
await callSetup(svc);
|
||||
|
||||
expect(svc.getDataPlaneStatus().ok).toBe(true);
|
||||
expect(createNetwork).toHaveBeenCalledTimes(1);
|
||||
const payload = createNetwork.mock.calls[0][0] as {
|
||||
IPAM?: { Config?: Array<{ Subnet?: string; IPRange?: string }> };
|
||||
};
|
||||
expect(payload.IPAM?.Config?.[0]?.Subnet).toBe('10.42.0.0/24');
|
||||
expect(payload.IPAM?.Config?.[0]?.IPRange).toBe('10.42.0.128/25');
|
||||
});
|
||||
|
||||
it('emits the IPRange on the winning candidate when env is unset and the first candidate overlaps', async () => {
|
||||
delete process.env.SENCHO_MESH_SUBNET;
|
||||
process.env.HOSTNAME = 'sencho';
|
||||
const overlap = Object.assign(
|
||||
new Error('Pool overlaps with other one on this address space'),
|
||||
{ statusCode: 500 },
|
||||
);
|
||||
const createNetwork = vi.fn()
|
||||
.mockRejectedValueOnce(overlap)
|
||||
.mockResolvedValueOnce(undefined);
|
||||
const inspectNetwork = vi.fn().mockRejectedValue({ statusCode: 404, message: 'no such network' });
|
||||
mockDocker({ createNetwork, inspectNetwork });
|
||||
|
||||
const svc = MeshService.getInstance();
|
||||
await callSetup(svc);
|
||||
|
||||
expect(svc.getDataPlaneStatus().ok).toBe(true);
|
||||
expect(svc.getDataPlaneStatus().subnet).toBe('172.31.0.0/24');
|
||||
expect(createNetwork).toHaveBeenCalledTimes(2);
|
||||
const winningPayload = createNetwork.mock.calls[1][0] as {
|
||||
IPAM?: { Config?: Array<{ Subnet?: string; IPRange?: string }> };
|
||||
};
|
||||
expect(winningPayload.IPAM?.Config?.[0]?.Subnet).toBe('172.31.0.0/24');
|
||||
expect(winningPayload.IPAM?.Config?.[0]?.IPRange).toBe('172.31.0.128/25');
|
||||
});
|
||||
|
||||
it('emits a legacy warn when adopting a sencho_mesh without the upper-half IPRange', async () => {
|
||||
delete process.env.SENCHO_MESH_SUBNET;
|
||||
process.env.HOSTNAME = 'sencho';
|
||||
const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
|
||||
const createNetwork = vi.fn();
|
||||
// Legacy network: Subnet only, no IPRange (Docker defaults auto-
|
||||
// allocation to the entire subnet, including .2).
|
||||
const inspectNetwork = vi.fn().mockResolvedValue({
|
||||
IPAM: { Config: [{ Subnet: '172.30.0.0/24' }] },
|
||||
});
|
||||
mockDocker({ createNetwork, inspectNetwork });
|
||||
|
||||
const svc = MeshService.getInstance();
|
||||
await callSetup(svc);
|
||||
|
||||
const status = svc.getDataPlaneStatus();
|
||||
expect(status.ok).toBe(true);
|
||||
expect(status.subnet).toBe('172.30.0.0/24');
|
||||
expect(createNetwork).not.toHaveBeenCalled();
|
||||
|
||||
const all = (svc as unknown as { activity: MeshActivityEvent[] }).activity;
|
||||
const warns = all.filter((e) => e.level === 'warn' && /without the upper-half IPAM IPRange/.test(e.message));
|
||||
expect(warns).toHaveLength(1);
|
||||
expect(warns[0].details).toMatchObject({
|
||||
subnet: '172.30.0.0/24',
|
||||
expectedIpRange: '172.30.0.128/25',
|
||||
actualIpRange: null,
|
||||
});
|
||||
|
||||
const meshLines = warnSpy.mock.calls
|
||||
.map((args) => String(args[0]))
|
||||
.filter((line) => /\[Mesh\] sencho_mesh adopted without the upper-half IPAM IPRange/.test(line));
|
||||
expect(meshLines.length).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
it('stays silent on the adopt path when the existing sencho_mesh already carries the upper-half IPRange', async () => {
|
||||
delete process.env.SENCHO_MESH_SUBNET;
|
||||
process.env.HOSTNAME = 'sencho';
|
||||
const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
|
||||
const createNetwork = vi.fn();
|
||||
const inspectNetwork = vi.fn().mockResolvedValue({
|
||||
IPAM: {
|
||||
Config: [{
|
||||
Subnet: '172.30.0.0/24',
|
||||
IPRange: '172.30.0.128/25',
|
||||
}],
|
||||
},
|
||||
});
|
||||
mockDocker({ createNetwork, inspectNetwork });
|
||||
|
||||
const svc = MeshService.getInstance();
|
||||
await callSetup(svc);
|
||||
|
||||
const status = svc.getDataPlaneStatus();
|
||||
expect(status.ok).toBe(true);
|
||||
|
||||
const all = (svc as unknown as { activity: MeshActivityEvent[] }).activity;
|
||||
const warns = all.filter((e) => e.level === 'warn' && /IPAM IPRange/.test(e.message));
|
||||
expect(warns).toHaveLength(0);
|
||||
|
||||
const meshLines = warnSpy.mock.calls
|
||||
.map((args) => String(args[0]))
|
||||
.filter((line) => /IPAM IPRange/.test(line));
|
||||
expect(meshLines).toHaveLength(0);
|
||||
});
|
||||
|
||||
it('emits the legacy warn when a TOCTOU 409 race-winner is a legacy network', async () => {
|
||||
// Operator-explicit subnet matches a race-winner that pre-dates the
|
||||
// upper-half IPRange bias: another process created sencho_mesh
|
||||
// between our initial inspect and our create. We adopt it, the data
|
||||
// plane comes up, and the warn fires because the race-winner's IPAM
|
||||
// block has no IPRange entry. Exercises the subtle assignment in
|
||||
// setupMeshNetwork that reassigns existingSubnet = raceWinner.
|
||||
process.env.SENCHO_MESH_SUBNET = '10.42.0.0/24';
|
||||
process.env.HOSTNAME = 'sencho';
|
||||
const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
|
||||
const conflict = Object.assign(
|
||||
new Error('network with name sencho_mesh already exists'),
|
||||
{ statusCode: 409 },
|
||||
);
|
||||
const createNetwork = vi.fn().mockRejectedValue(conflict);
|
||||
const inspectNetwork = vi.fn()
|
||||
.mockRejectedValueOnce({ statusCode: 404, message: 'no such network' })
|
||||
.mockResolvedValueOnce({ IPAM: { Config: [{ Subnet: '10.42.0.0/24' }] } });
|
||||
mockDocker({ createNetwork, inspectNetwork });
|
||||
|
||||
const svc = MeshService.getInstance();
|
||||
await callSetup(svc);
|
||||
|
||||
expect(svc.getDataPlaneStatus().ok).toBe(true);
|
||||
const all = (svc as unknown as { activity: MeshActivityEvent[] }).activity;
|
||||
const warns = all.filter((e) => e.level === 'warn' && /without the upper-half IPAM IPRange/.test(e.message));
|
||||
expect(warns).toHaveLength(1);
|
||||
expect(warns[0].details).toMatchObject({
|
||||
subnet: '10.42.0.0/24',
|
||||
expectedIpRange: '10.42.0.128/25',
|
||||
actualIpRange: null,
|
||||
});
|
||||
const meshLines = warnSpy.mock.calls
|
||||
.map((args) => String(args[0]))
|
||||
.filter((line) => /\[Mesh\] sencho_mesh adopted without the upper-half IPAM IPRange/.test(line));
|
||||
expect(meshLines.length).toBeGreaterThan(0);
|
||||
});
|
||||
});
|
||||
|
||||
describe('MeshService console.log mirror (F-5)', () => {
|
||||
it('mirrors a setup failure to console.error with the [Mesh] prefix', async () => {
|
||||
process.env.SENCHO_MESH_SUBNET = '10.42.0.0/24';
|
||||
|
||||
Reference in New Issue
Block a user