mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-11-05 10:37:23 +00:00
Josh Siviour
6f1c9a939c
* feat: run Spinifex on latitude.sh bare metal Add a latitude.sh provider and deploy script. One node uses a static Elastic IP pool. Three nodes use a latitude floating pool over a fixed Elastic IP set, with the cluster and Geneve planes on a latitude.sh VLAN. The floating engine gains a FixedSet provider interface. Its allocation token, re-read before a move and holder label apply to fixed sets only, so Vultr records and behaviour are unchanged. Bead mulga-c43h3.3 * fix: check a server's project before destroy and refuse mismatched response IDs A recorded server must sit in the project this deployment's Terraform holds, so a recycled ID with the same hostname elsewhere stops destroy. A missing project or ID refuses too. The client rejects an Elastic IP response whose ID is not the requested one, without showing it. Bead mulga-c43h3.3 * feat: cap a latitude pool at five Elastic IPs Config validation rejects a source="latitude" pool listing more than MaxLatitudeElasticIPs addresses, so an allocation makes at most five bounded provider reads. Bead mulga-c43h3.3 * fix: remember the project ID before destroy for the cleanup sweep The Terraform output that names the project is gone once destroy has run, so the sweep could not tell a matching server from a foreign one and kept both. Bead mulga-c43h3.3
42 lines
1.8 KiB
Bash
Executable File
42 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Tests remote_join_cmd from install-node.sh: the join token must reach spx only on stdin, so
|
|
# sudo's log (which holds the command it was given) never contains it, and the other values must
|
|
# arrive as plain arguments even when they hold shell syntax.
|
|
# preflight runs this with sh
|
|
[ -n "${BASH_VERSION:-}" ] || exec bash "$0" "$@"
|
|
set -euo pipefail
|
|
here="$(cd "$(dirname "$0")" && pwd)"
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "$work"' EXIT
|
|
mkdir "$work/bin"
|
|
cd "$work"
|
|
|
|
cat > "$work/bin/sudo" <<'SH'
|
|
#!/bin/sh
|
|
echo "$*" >> "$FAKE_SUDO_LOG"
|
|
exec "$@"
|
|
SH
|
|
cat > "$work/bin/spx" <<'SH'
|
|
#!/bin/sh
|
|
for a in "$@"; do printf '<%s>' "$a"; done > "$FAKE_SPX_ARGV"
|
|
SH
|
|
chmod +x "$work/bin/sudo" "$work/bin/spx"
|
|
export FAKE_SUDO_LOG="$work/sudo.log" FAKE_SPX_ARGV="$work/spx.argv" PATH="$work/bin:$PATH"
|
|
|
|
eval "$(sed -n '/^remote_join_cmd()/,/^}/p' "$here/install-node.sh")"
|
|
|
|
fails=0
|
|
check() { if [ "$2" = "$3" ]; then echo "ok $1"; else echo "FAIL $1: want '$3' got '$2'"; fails=$((fails + 1)); fi; }
|
|
|
|
TOKEN=spx_join_FAKETOKEN-abc_1
|
|
cmd="$(remote_join_cmd node2 10.0.0.2 203.0.113.2 '10.0.0.1:4432;touch PWNED' us-east-1 'az $(touch PWNED2)')"
|
|
bash -c "$cmd" <<<"$TOKEN"
|
|
|
|
check "the token is not in the command" "$(printf '%s' "$cmd" | grep -c FAKETOKEN || true)" 0
|
|
check "the token is not in sudo's log" "$(grep -c FAKETOKEN "$FAKE_SUDO_LOG" || true)" 0
|
|
check "spx got the token" "$(grep -o '<--token><[^>]*>' "$FAKE_SPX_ARGV")" "<--token><$TOKEN>"
|
|
check "spx got the other values as given" "$(cat "$FAKE_SPX_ARGV")" "<admin><join><--force><--node><node2><--bind><10.0.0.2><--cluster-bind><10.0.0.2><--advertise><203.0.113.2><--host><10.0.0.1:4432;touch PWNED><--token><$TOKEN><--region><us-east-1><--az><az \$(touch PWNED2)>"
|
|
check "no value was run as a command" "$(find "$work" -maxdepth 1 -name 'PWNED*' | wc -l | tr -d ' ')" 0
|
|
|
|
[ "$fails" -eq 0 ]
|