Compare commits
8
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 shcizo
|
cbcb8290d0 | ||
|
shcizo
|
cdda174178 | ||
|
shcizo
|
dd2b90bece | ||
|
shcizo
|
11c876af7f | ||
|
shcizo
|
9d5f24b125 | ||
|
shcizo
|
307e46e4c7 | ||
|
shcizo
|
f95e5319a8 | ||
|
shcizo
|
1664e47183 |
@@ -36,8 +36,11 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
|
||||
- `internal/master/config` — env-var loading
|
||||
- `internal/master/store` — Postgres access and migrations
|
||||
- `internal/master/hub` — agent connections: auth, per-connection writer, routing, job reconcile on hello
|
||||
- `internal/master/registry` — HEAD-only digest lookup against a registry (go-containerregistry, `DOCKER_CONFIG` credentials)
|
||||
- `internal/master/poller` — every `POLL_INTERVAL`: one lookup per followed `repo:tag`, sets the available version, starts auto jobs
|
||||
- `internal/master/jobs` — decides whether a service may be updated and starts a job on the right agent
|
||||
- `internal/master/webhook` — `POST /update`: records the available version, starts jobs for auto services, waits for them
|
||||
- `internal/master/web/icons` — embedded Simple Icons path data; slug derived from the image ref; regenerate with `go generate ./internal/master/web/icons`
|
||||
- `internal/master/web`, `webauth` — HTMX UI behind OIDC login, SSE signals
|
||||
- `internal/master/events` — in-process publish/subscribe for UI refresh signals
|
||||
- `internal/master/model` — domain types shared by the above
|
||||
@@ -68,6 +71,26 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
|
||||
|
||||
## Gotchas
|
||||
|
||||
- **Registry access is HEAD only** (`internal/master/registry`). Docker Hub counts a manifest
|
||||
GET as a pull; the client never falls back to GET, and a test asserts this.
|
||||
- **`image_versions` uses `''` instead of NULL** for a missing tag or digest, so
|
||||
`UNIQUE (repo, tag, digest)` deduplicates. The webhook records `(repo, tag, '')`; that
|
||||
row is hidden from `RecentVersions` when a row with the same tag and a digest was first
|
||||
seen at or after it.
|
||||
- **The UI picks a version by `image_versions.id`, never by a ref from the form**, and the row
|
||||
must belong to the service's `image_repo`. A digest-pinned or tagless pick needs agent
|
||||
protocol 3 (`protocol.MinPinnedRefVersion`); `Hub.Route` takes the minimum version.
|
||||
- **Picking a tagless version (`repo@digest`) leaves the service following no tag:** it is no
|
||||
longer polled and the plain Update button is refused.
|
||||
- **`services.last_tag_digest`** is set by the poller when it starts an auto job and when it
|
||||
sees the service already running the tag's digest, and by `FinishJob` after any successful
|
||||
plain tag job (not pinned/tagless picks; the digest is the one the agent pinned). The poller
|
||||
starts no job for that digest, nor for one `desired_ref` (`ref@digest`) already names, and
|
||||
re-reads the service before `Start`; so a rollback of an auto service holds until the
|
||||
registry shows a different digest. `ErrJobActive` and `NotUpdatableError` leave it unset so
|
||||
the next cycle retries.
|
||||
- **A bare image's running version is recorded with tag `latest`** (like `jobs.FollowedRef`);
|
||||
`repo@digest` is recorded with tag `''`. Only `sha256:<64 hex>` digests are recorded.
|
||||
- **Image matching is case-sensitive.** The tricky case is `localhost:5000/foo:v1` where
|
||||
the first colon is a port, not a tag. See `internal/imageref`.
|
||||
- **Path safety uses `filepath.Rel` + ".." prefix check**, NOT `strings.HasPrefix`.
|
||||
@@ -83,6 +106,12 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
|
||||
agent's own jobs always pass it explicitly.
|
||||
- **Override entries are never pruned.** A service deleted from the stack file keeps its
|
||||
`image:` line in `compose.override.yaml`.
|
||||
- **The override file gets the owner of the existing override, else of the stack's first
|
||||
compose file.** The exception is a root-owned existing override (written before this
|
||||
fix): then the compose file's owner is used, so it stops being root-owned. The agent runs
|
||||
as root, so `WriteOverride` chowns the open temp file before the rename (never the path
|
||||
afterwards: a symlink could be swapped in). A failure is a `warning:` line in the job
|
||||
output, never a failed job.
|
||||
- **There is no `STACKS_ROOT`.** Stack directories must be mounted read-write at the host
|
||||
path (`/path:/path`), and `SELF_ID` must resolve to the agent's own container. On Docker
|
||||
Desktop/OrbStack bind sources are translated, so Compose jobs fail there.
|
||||
@@ -94,6 +123,8 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
|
||||
- **Swarm updates need manager-node API access** for the agent doing the update.
|
||||
- **The image's default entrypoint is `updater-agent`.** The master overrides it with
|
||||
`updater-master`.
|
||||
- **The example stack runs the master as nobody (`user: "65534:65534"`).** Never add `USER`
|
||||
to the Dockerfile: the agent uses the same image and needs root for the Docker socket.
|
||||
- **The webhook waits via a broker signal plus a store re-read, with a fallback poll**
|
||||
(the broker drops signals for slow subscribers). Marking and starting jobs runs on
|
||||
`context.WithoutCancel`, so a client that disconnects cannot leave a queued job no agent
|
||||
@@ -102,11 +133,14 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
|
||||
repo, never from the request's image string. With an explicit target the "follows no tag"
|
||||
refusal does not apply; removed, self, built and container still do.
|
||||
- **`available_*` is cleared by `FinishJob`** on success only when the job's `to_ref`
|
||||
(as created, without `@digest`) equals `available_ref` and `available_at <= job.created_at`
|
||||
(that version is now running). A manual Update of the followed tag does not clear a
|
||||
badge for a different tag.
|
||||
(as created, without `@digest`) equals `available_ref`, `available_at <= job.created_at`
|
||||
(that version is now running) and, when the job's `to_ref` carries a digest, that digest
|
||||
equals `available_digest`. A rollback to an older digest of the tag therefore keeps the
|
||||
newer suggestion, and a digest-pinned pick does not clear a digest-less (webhook) one.
|
||||
- **Job output is capped at `protocol.MaxJobOutput` (128 KiB, tail).** NUL bytes are
|
||||
stripped by the hub because Postgres text rejects them.
|
||||
- **The SSE stream sends a named `ping` event every 25 s**; the sidebar Live indicator relies on it.
|
||||
- **Agents persist `swarm_cluster_id`.** Only managers report it, so workers show no role.
|
||||
|
||||
## References
|
||||
|
||||
@@ -114,6 +148,7 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
|
||||
- Phase 1 plan: `docs/superpowers/plans/2026-10-12-master-agent-phase-1-inventory.md`
|
||||
- Phase 2 plan: `docs/superpowers/plans/2026-10-12-master-agent-phase-2-jobs.md`
|
||||
- Phase 3 plan: `docs/superpowers/plans/2026-10-12-master-agent-phase-3-webhook.md`
|
||||
- Phase 4 plan: `docs/superpowers/plans/2026-10-13-master-agent-phase-4-polling.md`
|
||||
- Original single-instance design (historical):
|
||||
`docs/superpowers/specs/2026-05-22-package-updater-design.md`
|
||||
- Consumer-side CI integration: `gitea-action/` (calls the master's `POST /update`)
|
||||
|
||||
@@ -9,6 +9,7 @@ the same image: `updater-master` and `updater-agent` (the default entrypoint).
|
||||
Design: [master/agent spec](docs/superpowers/specs/2026-10-12-master-agent-design.md).
|
||||
Phase 2 plan: [jobs and manual update](docs/superpowers/plans/2026-10-12-master-agent-phase-2-jobs.md).
|
||||
Phase 3 plan: [webhook and auto mode](docs/superpowers/plans/2026-10-12-master-agent-phase-3-webhook.md).
|
||||
Phase 4 plan: [registry polling and version history](docs/superpowers/plans/2026-10-13-master-agent-phase-4-polling.md).
|
||||
|
||||
## What an update does
|
||||
|
||||
@@ -27,12 +28,16 @@ a time per service, and one job at a time per agent.
|
||||
Use [`deploy/master.stack.yml`](deploy/master.stack.yml) as a starting point (Swarm stack;
|
||||
needs Postgres and an OIDC provider). The master listens for the UI on `PORT` (default
|
||||
`8080`, put it behind your reverse proxy) and for agents on `AGENT_PORT` (default `8090`,
|
||||
pinned TLS, reached directly on the internal network).
|
||||
pinned TLS, reached directly on the internal network). The example runs the master as
|
||||
`nobody` (`65534`); it needs no root. The agent runs as root because access to the Docker
|
||||
socket is root on the host anyway.
|
||||
|
||||
| Variable | Required | Default | Purpose |
|
||||
|---|---|---|---|
|
||||
| `UPDATER_API_KEY` | no | — | Bearer token for `POST /update`. Without it the webhook answers `503` and the master logs `webhook_disabled`. |
|
||||
| `UPDATE_TIMEOUT` | no | `5m` | How long one `POST /update` waits for its auto jobs (Go duration). |
|
||||
| `POLL_INTERVAL` | no | `6h` | Time between registry polling cycles (Go duration, must be positive). The first cycle runs one minute after start. |
|
||||
| `DOCKER_CONFIG` | no | `~/.docker` | Directory with a `config.json` holding registry credentials for polling, readable by the master's user. Only inline `auths` entries work; see [Registry polling](#registry-polling). |
|
||||
|
||||
The master's other settings (`DATABASE_URL`, `PUBLIC_URL`, `AGENT_URL`, `OIDC_*`,
|
||||
`ALLOWED_GROUP`, `AGENT_IMAGE`, `PORT`, `AGENT_PORT`, `LOG_LEVEL`) are shown in
|
||||
@@ -112,6 +117,80 @@ The request is open for as long as the jobs run, so the reverse proxy in front o
|
||||
master must allow a read timeout longer than `UPDATE_TIMEOUT`. If the client disconnects,
|
||||
marking and starting jobs still complete; only the waiting stops.
|
||||
|
||||
## Registry polling
|
||||
|
||||
Besides the webhook, the master asks each registry whether the tag a service follows has
|
||||
a new digest. Every `POLL_INTERVAL` it sends one `HEAD /v2/<repo>/manifests/<tag>` per
|
||||
distinct followed `repo:tag` (a bare image counts as `:latest`; `repo:tag@digest` is polled
|
||||
as `repo:tag`). It never downloads a manifest: Docker Hub counts a `GET` as a pull against
|
||||
the rate limit and a `HEAD` as nothing
|
||||
([source](https://docs.docker.com/docker-hub/usage/pulls/)), and Docker Hub also has a
|
||||
separate abuse limit for many pulls from one IP address, so the poller stays HEAD-only. For a
|
||||
multi-arch image the digest is the index digest, the same one `docker inspect` shows in
|
||||
`RepoDigests`.
|
||||
|
||||
- **What counts as new.** A digest different from the one the service runs becomes the
|
||||
service's *available* version (the overview badge, source `poll`). A digest the master
|
||||
already suggested is not suggested again. A service in **auto** mode also gets an update
|
||||
job to `repo:tag` (the agent resolves the digest itself, so agents on protocol version 2
|
||||
keep working). The master remembers the newest digest it started or deployed for the tag
|
||||
in `services.last_tag_digest` (set when polling starts a job, when polling sees the
|
||||
service already running that digest, and when any plain tag job succeeds, whoever started
|
||||
it) and starts no job for that digest again, whether the job
|
||||
failed or the user rolled back afterwards. If the service already had a job when the
|
||||
digest was found, the next cycle tries again.
|
||||
- **What is not polled.** Services that follow no tag (`repo@digest`), `build:` services, and
|
||||
services without a registry digest (locally built images). The service page says which.
|
||||
The updater's own services and plain containers are polled, so their badge works, but
|
||||
jobs for them are still refused.
|
||||
- **Errors.** A failed lookup is stored for the services that follow that tag and shown as a
|
||||
"poll failed" badge on the overview and in the "Polling" row of the service page; other
|
||||
tags continue. A later success clears it.
|
||||
- **Credentials.** The master reads `$DOCKER_CONFIG/config.json` (a file written by
|
||||
`docker login`), mounted read-only into the container; without it registries are accessed
|
||||
anonymously. The directory and file must be readable by the master's user (`65534` in the
|
||||
example stack) without being world-readable: `chown -R 65534:65534` the directory and keep
|
||||
`0700`/`0600`. Only inline `auths` entries are supported. A `credsStore` or `credHelpers`
|
||||
entry makes every lookup fail with `error getting credentials ... executable file not found
|
||||
in $PATH`, because the container has no credential helper binaries. The master logs
|
||||
`registry_credentials` at startup with the directory, `config_json_found` and
|
||||
`config_json_readable`, never the contents. If the file exists but cannot be opened it also
|
||||
logs a `registry_credentials_unreadable` warning with the error.
|
||||
- **Requests go wherever the image name points.** The master sends the lookup to the
|
||||
registry host in the image name, including a `GET /v2/` ping that follows redirects.
|
||||
Anyone who can start containers on a managed host can therefore make the master send
|
||||
blind requests to internal hosts. The registry's answer is not shown: an error keeps only
|
||||
the HTTP status and the registry's error codes; any other failure shows only "timeout",
|
||||
"cannot reach registry" or "lookup failed". The full error goes to the master's log
|
||||
(`registry_lookup_failed`).
|
||||
|
||||
### Version history and rollback
|
||||
|
||||
The master records every version it sees (webhook, polling, and what agents report as
|
||||
running) in `image_versions`. The service page lists the 10 most recently first seen
|
||||
versions of the service's image repo, marks the one that is running, and has a *Deploy*
|
||||
button on each row. A webhook announces a tag but not its digest, so such a row has no
|
||||
digest until polling or an agent reports one; it is hidden when a row with the same tag
|
||||
and a digest was first seen at or after it. A bare image (`postgres`) is recorded as tag
|
||||
`latest`.
|
||||
|
||||
Picking a version starts a manual job to exactly that reference. Picking an older one is a
|
||||
rollback, including to a digest-pinned reference. A version without a tag deploys
|
||||
`repo@digest` and the service then follows no tag, so it is no longer polled or updatable
|
||||
with the plain *Update* button until it is moved to a tagged version again. Picks of
|
||||
digest-pinned or tagless versions need an agent speaking protocol version 3 (this
|
||||
release); on an older agent the job fails with "agent too old to deploy a pinned version
|
||||
(needs protocol 3)".
|
||||
|
||||
A rollback made before the first poll cycle after the upgrade has seen the service is not
|
||||
protected, because the master has not yet recorded the digest it was running.
|
||||
|
||||
A service in **auto** mode stays auto after a rollback. Polling does not undo it: the
|
||||
service stays on the older version until the registry shows a digest of the followed tag
|
||||
that differs from the newest one the master deployed. The newer version it was rolled back
|
||||
from stays marked as available. A webhook that names a tag still starts a job for an auto
|
||||
service every time, so a CI push moves it forward again.
|
||||
|
||||
## Adding agents
|
||||
|
||||
Open the master's **Agents** page and add one. It shows a ready-to-run compose file with
|
||||
|
||||
+60
-2
@@ -11,6 +11,7 @@ import (
|
||||
"net/http"
|
||||
"os"
|
||||
"os/signal"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
@@ -20,6 +21,8 @@ import (
|
||||
"github.com/shcizo/package-updater/internal/master/events"
|
||||
"github.com/shcizo/package-updater/internal/master/hub"
|
||||
"github.com/shcizo/package-updater/internal/master/jobs"
|
||||
"github.com/shcizo/package-updater/internal/master/poller"
|
||||
"github.com/shcizo/package-updater/internal/master/registry"
|
||||
"github.com/shcizo/package-updater/internal/master/store"
|
||||
"github.com/shcizo/package-updater/internal/master/web"
|
||||
"github.com/shcizo/package-updater/internal/master/webauth"
|
||||
@@ -37,6 +40,39 @@ func main() {
|
||||
}
|
||||
}
|
||||
|
||||
// pollFirstDelay is how long the master runs before its first registry
|
||||
// polling cycle, so agents have reported their inventory.
|
||||
const pollFirstDelay = time.Minute
|
||||
|
||||
// pollWorkers is how many registry lookups run at once.
|
||||
const pollWorkers = 4
|
||||
|
||||
// registryCredentialsDir returns the directory the registry client reads
|
||||
// credentials from (DOCKER_CONFIG, else ~/.docker), whether a config.json is
|
||||
// in it, and the error from opening it when it exists but cannot be read (for
|
||||
// example because the master runs as another user than the file owner). The
|
||||
// file is opened and closed, never read; only the path is logged.
|
||||
func registryCredentialsDir() (dir string, found bool, readErr error) {
|
||||
dir = os.Getenv("DOCKER_CONFIG")
|
||||
if dir == "" {
|
||||
home, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
return "", false, nil
|
||||
}
|
||||
dir = filepath.Join(home, ".docker")
|
||||
}
|
||||
path := filepath.Join(dir, "config.json")
|
||||
if _, err := os.Stat(path); err != nil {
|
||||
return dir, false, nil
|
||||
}
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return dir, true, err
|
||||
}
|
||||
_ = f.Close()
|
||||
return dir, true, nil
|
||||
}
|
||||
|
||||
func run() error {
|
||||
cfg, err := config.Load()
|
||||
if err != nil {
|
||||
@@ -81,6 +117,7 @@ func run() error {
|
||||
|
||||
ui, err := web.New(st, agentHub, jobService, broker, web.Config{
|
||||
AgentURL: cfg.AgentURL, MasterKey: fingerprint, AgentImage: cfg.AgentImage,
|
||||
PollInterval: cfg.PollInterval, Version: version,
|
||||
}, logger)
|
||||
if err != nil {
|
||||
return err
|
||||
@@ -127,22 +164,43 @@ func run() error {
|
||||
BaseContext: baseContext,
|
||||
}
|
||||
|
||||
credDir, credFound, credReadErr := registryCredentialsDir()
|
||||
logger.Info("registry_credentials", "docker_config", credDir, "config_json_found", credFound,
|
||||
"config_json_readable", credFound && credReadErr == nil)
|
||||
if credReadErr != nil {
|
||||
logger.Warn("registry_credentials_unreadable", "docker_config", credDir, "error", credReadErr)
|
||||
}
|
||||
pollCtx, stopPolling := context.WithCancel(ctx)
|
||||
defer stopPolling()
|
||||
registryPoller := poller.New(st, jobService, registry.New("package-updater-master/"+version, logger), broker, poller.Config{
|
||||
Interval: cfg.PollInterval, FirstDelay: pollFirstDelay, Workers: pollWorkers,
|
||||
}, logger)
|
||||
pollDone := make(chan struct{})
|
||||
go func() {
|
||||
defer close(pollDone)
|
||||
registryPoller.Run(pollCtx)
|
||||
}()
|
||||
|
||||
errCh := make(chan error, 2)
|
||||
go func() { errCh <- webSrv.ListenAndServe() }()
|
||||
go func() { errCh <- agentSrv.ListenAndServeTLS("", "") }()
|
||||
logger.Info("listening", "web", webSrv.Addr, "agents", agentSrv.Addr)
|
||||
|
||||
var serveErr error
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
logger.Info("shutdown_signal")
|
||||
case err := <-errCh:
|
||||
if !errors.Is(err, http.ErrServerClosed) {
|
||||
return err
|
||||
serveErr = err
|
||||
}
|
||||
}
|
||||
shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||||
defer cancel()
|
||||
_ = webSrv.Shutdown(shutdownCtx)
|
||||
_ = agentSrv.Shutdown(shutdownCtx)
|
||||
return nil
|
||||
// The poller writes to the store, which is closed when run returns.
|
||||
stopPolling()
|
||||
<-pollDone
|
||||
return serveErr
|
||||
}
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestRegistryCredentialsDir(t *testing.T) {
|
||||
t.Run("missing file", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
t.Setenv("DOCKER_CONFIG", dir)
|
||||
got, found, readErr := registryCredentialsDir()
|
||||
assert.Equal(t, dir, got)
|
||||
assert.False(t, found)
|
||||
assert.NoError(t, readErr)
|
||||
})
|
||||
|
||||
t.Run("readable file", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "config.json"), []byte("{}"), 0o600))
|
||||
t.Setenv("DOCKER_CONFIG", dir)
|
||||
_, found, readErr := registryCredentialsDir()
|
||||
assert.True(t, found)
|
||||
assert.NoError(t, readErr)
|
||||
})
|
||||
|
||||
t.Run("unreadable file", func(t *testing.T) {
|
||||
if os.Geteuid() == 0 {
|
||||
t.Skip("root can read any file")
|
||||
}
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "config.json"), []byte("{}"), 0o000))
|
||||
t.Setenv("DOCKER_CONFIG", dir)
|
||||
_, found, readErr := registryCredentialsDir()
|
||||
assert.True(t, found)
|
||||
assert.Error(t, readErr)
|
||||
})
|
||||
}
|
||||
@@ -10,9 +10,19 @@
|
||||
# To run without the webhook, remove the pu_updater_api_key lines (the UPDATER_API_KEY
|
||||
# part of the entrypoint, the service secret and the secrets entry); the endpoint then answers 503.
|
||||
# The reverse proxy must allow a read timeout longer than UPDATE_TIMEOUT (default 5m).
|
||||
# 5. Optional, for registry polling of private images: put a config.json written by
|
||||
# `docker login` (inline "auths" only; no credsStore) in /path/to/docker-config and
|
||||
# uncomment DOCKER_CONFIG and the volumes entry below. The master runs as 65534:65534, so
|
||||
# the directory and config.json must be readable by that user while staying private:
|
||||
# `chown -R 65534:65534 /path/to/docker-config` (keep 0700/0600), or set `user:` below
|
||||
# to the owner's uid:gid. Do not make config.json world-readable; it holds registry
|
||||
# passwords. The directory must exist on every manager node (the master is placed on a
|
||||
# manager), or Swarm rejects the task. Without it registries are accessed anonymously.
|
||||
services:
|
||||
master:
|
||||
image: gitea.shcizo.se/shcizo/package-updater:latest
|
||||
# Runs as nobody: the master needs no root (the agent does, for the Docker socket).
|
||||
user: "65534:65534"
|
||||
entrypoint: ["/bin/sh", "-c", "DATABASE_URL=$$(cat /run/secrets/pu_database_url) OIDC_CLIENT_SECRET=$$(cat /run/secrets/pu_oidc_client_secret) UPDATER_API_KEY=$$(cat /run/secrets/pu_updater_api_key) exec /usr/local/bin/updater-master"]
|
||||
environment:
|
||||
PUBLIC_URL: https://updater.example.com
|
||||
@@ -21,10 +31,14 @@ services:
|
||||
OIDC_CLIENT_ID: package-updater
|
||||
ALLOWED_GROUP: updater-admins
|
||||
# UPDATE_TIMEOUT: 5m
|
||||
# POLL_INTERVAL: 6h
|
||||
# DOCKER_CONFIG: /docker-config # step 5
|
||||
secrets:
|
||||
- pu_database_url
|
||||
- pu_oidc_client_secret
|
||||
- pu_updater_api_key
|
||||
# volumes: # step 5
|
||||
# - /path/to/docker-config:/docker-config:ro
|
||||
ports:
|
||||
# Agents connect here directly over the internal network, not via the proxy.
|
||||
- target: 8090
|
||||
|
||||
@@ -0,0 +1,311 @@
|
||||
# Master/Agent Phase 4 — Registry Polling and Version History Implementation Plan
|
||||
|
||||
> This plan documents what to build for issue #9 and where it deviates from the spec. Code in "Frozen contracts" is final; tasks give the contract and the test cases.
|
||||
|
||||
**Goal:** The master records every version it sees (webhook, registry polling, running inventory) in `image_versions`. Every `POLL_INTERVAL` (default 6h) it checks each distinct followed `repo:tag` against its registry with one HEAD request. A new digest becomes the service's available suggestion, and `auto` services get a job. The Service page lists the 10 most recent versions of the service's repo. Picking one starts a manual job to exactly that reference; picking an older one is a rollback, including to a digest-pinned or tagless reference.
|
||||
|
||||
**Architecture:**
|
||||
- New package `internal/master/registry`: thin wrapper around `go-containerregistry`'s `remote.Head` with `authn.DefaultKeychain` (reads `DOCKER_CONFIG`/`config.json`).
|
||||
- New package `internal/master/poller`: owns the cycle (list services, group by followed ref, run HEADs with bounded concurrency, then set available / start auto jobs / store poll error per service). `cmd/master` runs it as a background goroutine on the signal context.
|
||||
- Store: `image_versions` written in `SetAvailable` (webhook and poll, same transaction) and in `upsertService` (running inventory, inside the existing snapshot/upsert transactions).
|
||||
- Jobs gains `TriggerVersion`, which takes a version ID, never a ref from the form. `Hub.Route` gains a minimum protocol version so a pinned or tagless ref only goes to agents that understand it.
|
||||
- Agent: resolver passes digest-pinned refs through unchanged. Protocol version goes to 3.
|
||||
|
||||
**Tech Stack:** adds `github.com/google/go-containerregistry` (`pkg/name`, `pkg/v1/remote`, `pkg/authn`; `pkg/registry` and `pkg/v1/random` in tests only).
|
||||
|
||||
**Spec:** `docs/superpowers/specs/2026-10-12-master-agent-design.md`, sections "Versions: what the system has seen", "Data model", "Update", "Failure handling", "Registry polling", "UI". Phase 3 plan conventions still apply.
|
||||
|
||||
## Global Constraints
|
||||
|
||||
- `go test ./...` passes with no Docker, no Postgres and no network. Registry tests use `httptest` plus `ggcr/pkg/registry`. Postgres tests carry `//go:build integration`.
|
||||
- Interfaces declared at the consumer (`poller.Store`, `poller.Jobs`, `poller.Registry`). Hand-written fakes and testify, table-driven where there is more than one case.
|
||||
- GoDoc on every exported identifier. Conventional Commits, each ending with ` (#9)`.
|
||||
- Registry credentials never appear in logs or in `last_poll_error`. Error text stored truncated to 500 bytes.
|
||||
- Registry traffic is HEAD only: never `GET /v2/<repo>/manifests/...` (Docker Hub counts GETs as pulls). A test asserts this.
|
||||
- A pick from the UI is a POST with the CSRF token and a version ID. The ref is built server-side from the `image_versions` row, and the row must belong to the service's `image_repo`.
|
||||
- The poller never overlaps itself. Next cycle is scheduled after the previous one finishes.
|
||||
- `go.mod` `go` directive must stay `1.26.3` after `go get`.
|
||||
|
||||
## Deliberate deviations from the spec in this phase
|
||||
|
||||
1. **Webhook records `(repo, tag, '')`, no digest.** The master does not resolve the digest at webhook time (no registry round-trip/credentials in the CI path). The digest arrives later from polling or running inventory. The picker hides a digest-less row when a row with the same `(repo, tag)` and a digest was first seen at or after it.
|
||||
2. **Empty string instead of NULL** for missing tag or digest in `image_versions`, so `UNIQUE (repo, tag, digest)` works. A CHECK forbids both being empty.
|
||||
3. **`first_seen_at` is never bumped.** Re-observation is `ON CONFLICT DO NOTHING`; `source` is the first source that saw it. "10 most recent" = "10 most recently first seen". A new digest of a tag is a new row at the top; old digest stays below (enables rollback of moving tags).
|
||||
4. **Not polled:** services that follow no tag, `build:` services, services with empty `actual_digest`. UI shows the reason. Self and container services ARE polled (badge informative; jobs still refused by `jobs`).
|
||||
5. **Poller does not re-suggest the same version.** If `available_ref == ref && available_digest == D`, the badge is not written again (no `available_at` bump). The auto job is decided separately: it starts only if the service is auto, `actual_digest != D`, `D != last_tag_digest` and `desired_ref != ref@D`, on a fresh read of the row. `last_tag_digest` is set when a job row was created (not on `ErrJobActive`/`NotUpdatableError`, which retry next cycle). A failed auto job is not retried every interval; a rollback of an auto service is not undone by polling until a new digest appears. The poller also sets `last_tag_digest` to D when `actual_digest == D` (seeding services that predate the column). `FinishJob` also sets `last_tag_digest` to the pinned digest after any successful job whose `to_ref` as created has no digest (manual, webhook or poll); pinned and tagless picks leave it, so a rollback holds whoever started the update.
|
||||
6. **FinishJob clearing rule gets a digest condition** (C3). Rollback to an older digest of the same tag no longer clears the newer-version badge.
|
||||
7. **Poll auto jobs use `repo:tag`, not `repo:tag@D`.** v2 agents keep working for poll and webhook jobs. Only UI picks of digest-pinned or tagless versions need a v3 agent.
|
||||
8. **First cycle runs 1 minute after start**, then every `POLL_INTERVAL` measured from the end of the previous cycle.
|
||||
9. **No `last_polled_at` column** (YAGNI).
|
||||
10. **Overview gets two new badges: "follows no tag" and "poll failed"** (error as `title`). Service page gets a "Polling" row. "Drifted" is not in this phase.
|
||||
11. **Credentials from `DOCKER_CONFIG`** (a directory), same name and meaning as on the agent. Only inline `auths` entries supported in the container.
|
||||
|
||||
## Implementation notes (differences found while building)
|
||||
|
||||
- The plan's test names `TestResolve` and `TestComposeWritesPinnedRef` became `TestResolver`
|
||||
(extended), a subtest of `TestComposeExecutor` and `TestSwarmUsesPinnedRef`.
|
||||
- Tasks 2 and 3 are one commit: changing `Hub.Route`'s signature breaks `jobs` and the e2e hub
|
||||
wrapper until both are updated.
|
||||
- `Poller.Cycle` runs the registry lookups concurrently and then records the results
|
||||
sequentially (on `context.WithoutCancel`).
|
||||
- `web.Config` gained `PollInterval` for the "every <interval>" text.
|
||||
- `authn.DefaultKeychain` with a `credsStore` whose helper binary is missing makes the lookup fail
|
||||
with `error getting credentials - err: exec: "docker-credential-...": executable file not found in $PATH`
|
||||
(covered by `TestCredsStoreWithoutHelperFailsTheLookup`); it does not fall back to anonymous access.
|
||||
|
||||
## Review Focus
|
||||
|
||||
| Failure case | Test that covers it |
|
||||
|---|---|
|
||||
| Registry access is HEAD only; no manifest GET ever happens. | registry `TestDigestUsesHeadOnly` |
|
||||
| Multi-arch: digest returned is the index digest (same as `RepoDigests` / Swarm spec). | registry `TestDigestOfIndexIsIndexDigest` |
|
||||
| Credentials from `$DOCKER_CONFIG/config.json` are sent; anonymous works without the file. | registry `TestCredentialsFromDockerConfig`, `TestAnonymousWithoutConfig` |
|
||||
| One HEAD per distinct followed ref (`repo:tag`, `repo:tag@d`, bare → `:latest`). | poller `TestOneHeadPerDistinctRef` |
|
||||
| No tag / built / no digest are skipped, no HEAD. | poller `TestSkipped` |
|
||||
| Error on one ref goes into its services' `last_poll_error`; others continue; later success clears it. | poller `TestErrorIsPerRef`, `TestErrorClearedOnSuccess` |
|
||||
| Already-suggested digest neither re-suggested nor re-started. | poller `TestSameSuggestionIsIdempotent` |
|
||||
| Auto gets exactly one `TriggerPoll` job to `repo:tag`; manual only gets marked. | poller `TestNewDigest` table |
|
||||
| `ErrJobActive` / `NotUpdatableError` from `Start` do not abort the cycle. | poller `TestStartErrorsDoNotAbortCycle` |
|
||||
| Concurrency within limit; cancellation stops the cycle; marking/starting on `WithoutCancel`. | poller `TestConcurrencyLimit`, `TestRunStopsOnCancel` |
|
||||
| Form cannot deploy an arbitrary ref: unknown version ID → 404; version of another repo → 404, no job. | jobs `TestTriggerVersion_*`, web `TestUpdateService_Version*` |
|
||||
| Pinned/tagless refs routed only to protocol ≥ 3 agents; old agents → failed "agent too old to deploy a pinned version (needs protocol 3)" job (`ErrAgentTooOldForPinned`, which also satisfies `errors.Is(err, ErrAgentTooOld)`). | jobs `TestTriggerVersion_RequiresPinnedProtocol`, hub `TestRoute` |
|
||||
| Agent deploys a pinned ref verbatim, no registry resolve. | updater `TestResolve`, `TestComposeWritesPinnedRef`, `TestSwarmUsesPinnedRef` |
|
||||
| Rollback to older digest of same tag keeps newer suggestion; pick of suggested digest clears it. | store `TestFinishJob_ClearsAvailableOnlyWhenThatVersionWasDeployed` (extended) |
|
||||
| Running versions recorded only with a digest; re-snapshot does not duplicate or reorder. | store `TestSnapshotRecordsRunningVersions` |
|
||||
| Digest-less webhook row hidden once the tag's digest is known; order, limit, repo filter. | store `TestRecentVersions` |
|
||||
| `available_source = 'poll'` passes the CHECK. | store `TestSetAvailable_RecordsVersion` |
|
||||
| E2E: pick of a pinned version reaches the agent as that exact ref. | e2e `TestPickPinnedVersion` |
|
||||
|
||||
## Frozen contracts
|
||||
|
||||
### C1. Migration `internal/master/store/migrations/0004_polling.sql`
|
||||
|
||||
```sql
|
||||
ALTER TABLE services DROP CONSTRAINT services_available_source_check;
|
||||
ALTER TABLE services ADD CONSTRAINT services_available_source_check
|
||||
CHECK (available_source IN ('', 'webhook', 'poll'));
|
||||
ALTER TABLE services ADD COLUMN available_digest text NOT NULL DEFAULT '';
|
||||
ALTER TABLE services ADD COLUMN last_poll_error text NOT NULL DEFAULT '';
|
||||
ALTER TABLE services ADD COLUMN last_tag_digest text NOT NULL DEFAULT '';
|
||||
|
||||
-- Every version the master has seen. '' means "no tag" / "digest unknown";
|
||||
-- never NULL, so the unique constraint deduplicates.
|
||||
CREATE TABLE image_versions (
|
||||
id bigserial PRIMARY KEY,
|
||||
repo text NOT NULL,
|
||||
tag text NOT NULL DEFAULT '',
|
||||
digest text NOT NULL DEFAULT '',
|
||||
source text NOT NULL CHECK (source IN ('webhook', 'poll', 'running')),
|
||||
first_seen_at timestamptz NOT NULL,
|
||||
CONSTRAINT image_versions_tag_or_digest CHECK (tag <> '' OR digest <> ''),
|
||||
CONSTRAINT image_versions_unique UNIQUE (repo, tag, digest)
|
||||
);
|
||||
CREATE INDEX image_versions_recent ON image_versions (repo, first_seen_at DESC, id DESC);
|
||||
```
|
||||
|
||||
Confirm the existing constraint name in `0003_webhook.sql` before relying on it.
|
||||
|
||||
### C2. `internal/master/model`
|
||||
|
||||
```go
|
||||
// Service gains:
|
||||
AvailableDigest string // digest of AvailableRef when known (poll); "" from the webhook
|
||||
LastPollError string // last registry error for this service's followed ref; "" when fine
|
||||
|
||||
const SourcePoll = "poll" // alongside SourceWebhook
|
||||
const SourceRunning = "running" // image_versions only
|
||||
|
||||
type Available struct { Ref, Digest, Source string; At time.Time } // Digest added
|
||||
|
||||
// ImageVersion is one row of image_versions.
|
||||
type ImageVersion struct {
|
||||
ID int64
|
||||
Repo, Tag, Digest, Source string
|
||||
FirstSeenAt time.Time
|
||||
}
|
||||
// Ref returns "repo:tag@digest", "repo:tag" or "repo@digest".
|
||||
func (v ImageVersion) Ref() string
|
||||
```
|
||||
|
||||
### C3. Store
|
||||
|
||||
```go
|
||||
// SetAvailable sets available_ref/_digest/_source/_at and, in the same
|
||||
// transaction, inserts image_versions(repo, tag parsed from a.Ref, a.Digest,
|
||||
// a.Source, a.At) ON CONFLICT DO NOTHING.
|
||||
SetAvailable(ctx, id int64, a model.Available) error
|
||||
|
||||
// RecentVersions returns up to limit versions of repo, newest first_seen_at
|
||||
// first (ties: id DESC). It leaves out a digest-less row when a row with the
|
||||
// same repo and tag and a digest was first seen at or after it.
|
||||
RecentVersions(ctx, repo string, limit int) ([]model.ImageVersion, error)
|
||||
|
||||
// GetImageVersion returns one version or model.ErrNotFound.
|
||||
GetImageVersion(ctx, id int64) (model.ImageVersion, error)
|
||||
|
||||
// SetPollError sets last_poll_error on the given services ("" clears).
|
||||
SetPollError(ctx, ids []int64, msg string) error
|
||||
```
|
||||
|
||||
`RecentVersions` SQL:
|
||||
|
||||
```sql
|
||||
SELECT id, repo, tag, digest, source, first_seen_at FROM image_versions v
|
||||
WHERE v.repo = $1
|
||||
AND NOT (v.digest = '' AND EXISTS (
|
||||
SELECT 1 FROM image_versions d
|
||||
WHERE d.repo = v.repo AND d.tag = v.tag AND d.digest <> ''
|
||||
AND d.first_seen_at >= v.first_seen_at))
|
||||
ORDER BY v.first_seen_at DESC, v.id DESC
|
||||
LIMIT $2
|
||||
```
|
||||
|
||||
`upsertService` (running inventory): after the service upsert, on the same `execer`, only when `svc.Digest` matches `^sha256:[0-9a-f]{64}$`:
|
||||
|
||||
```sql
|
||||
INSERT INTO image_versions (repo, tag, digest, source, first_seen_at)
|
||||
VALUES ($1, $2, $3, 'running', $4) ON CONFLICT DO NOTHING
|
||||
```
|
||||
|
||||
`repo`/`tag` from `imageref.Parse(svc.Image)`, `digest` = `svc.Digest`. A bare image (no tag, no digest in the name) is recorded with `tag = 'latest'`, like `jobs.FollowedRef`, so it dedupes with the poll row; `repo@digest` is recorded with `tag = ''`. Covers `ApplySnapshot` and `UpsertService` with no hub change.
|
||||
|
||||
`serviceColumns` / `scanService` gain `s.available_digest, s.last_poll_error, s.last_tag_digest`. `SetLastTagDigest(ctx, id, digest)` sets the last column; inventory writes never touch it.
|
||||
|
||||
`FinishJob` clearing rule (replaces phase 3's). With `requestedRef, requestedDigest, _ := strings.Cut(to_ref_as_created, "@")`:
|
||||
|
||||
```sql
|
||||
available_ref = $4 AND available_at <= $3
|
||||
AND ($5 = '' OR available_digest = $5)
|
||||
```
|
||||
|
||||
`$5` = `requestedDigest`. A digest-pinned job does NOT clear a digest-less (webhook) suggestion: a rollback to `main@old` must not hide that a newer `main` was announced. The badge then stays until a plain tag job succeeds; that is accepted. Clearing sets `available_ref=''`, `available_digest=''`, `available_source=''`, `available_at=NULL`.
|
||||
|
||||
### C4. `internal/master/registry`
|
||||
|
||||
```go
|
||||
// Client looks up tag digests with HEAD requests only.
|
||||
type Client struct{ /* keychain authn.Keychain, userAgent string */ }
|
||||
// New uses authn.DefaultKeychain ($DOCKER_CONFIG/config.json, else ~/.docker/config.json).
|
||||
func New(userAgent string) *Client
|
||||
// Digest returns the digest ref ("repo:tag", any digest suffix ignored) points
|
||||
// at: the index digest for multi-arch images. HEAD /v2/<repo>/manifests/<tag> only.
|
||||
func (c *Client) Digest(ctx context.Context, ref string) (string, error)
|
||||
```
|
||||
|
||||
Implementation: `name.ParseReference(repo+":"+tag)`; `remote.Head(r, remote.WithContext(ctx), remote.WithAuthFromKeychain(c.keychain), remote.WithUserAgent(c.userAgent))`; return `desc.Digest.String()`. Never fall back to GET if `Docker-Content-Digest` is missing.
|
||||
|
||||
### C5. `internal/master/poller`
|
||||
|
||||
```go
|
||||
type Store interface {
|
||||
ListServices(ctx context.Context) ([]model.Service, error)
|
||||
GetService(ctx context.Context, id int64) (model.Service, error)
|
||||
SetAvailable(ctx context.Context, id int64, a model.Available) error
|
||||
SetLastTagDigest(ctx context.Context, id int64, digest string) error
|
||||
SetPollError(ctx context.Context, ids []int64, msg string) error
|
||||
}
|
||||
type Jobs interface {
|
||||
Start(ctx context.Context, svc model.Service, req jobs.StartRequest) (model.Job, error)
|
||||
}
|
||||
type Registry interface { Digest(ctx context.Context, ref string) (string, error) }
|
||||
type Publisher interface { Publish(t events.Topic) }
|
||||
|
||||
type Config struct {
|
||||
Interval time.Duration // POLL_INTERVAL
|
||||
FirstDelay time.Duration // 1m in production; small in tests
|
||||
Workers int // 4
|
||||
}
|
||||
func New(st Store, j Jobs, reg Registry, pub Publisher, cfg Config, log *slog.Logger) *Poller
|
||||
// Run polls until ctx is done. Blocking.
|
||||
func (p *Poller) Run(ctx context.Context)
|
||||
// Cycle runs one poll over all services (exported for tests and e2e).
|
||||
func (p *Poller) Cycle(ctx context.Context)
|
||||
// SkipReason says why svc is not polled: "follows no tag", "built from
|
||||
// source", "no registry digest", or "" when it is polled.
|
||||
func SkipReason(svc model.Service) string
|
||||
```
|
||||
|
||||
Cycle semantics, per distinct `ref = jobs.FollowedRef(svc.ActualRef)` over non-removed, non-skipped services:
|
||||
1. `D, err := reg.Digest(ctx, ref)` with a 30s timeout per call.
|
||||
2. On error: `SetPollError(ids whose LastPollError != msg, msg)`, log `poll_failed` (ref, error).
|
||||
3. On success: `SetPollError(ids with LastPollError != "", "")`. Then per service:
|
||||
- Suggestion: `svc.ActualDigest == D` → nothing; `svc.AvailableRef == ref && svc.AvailableDigest == D` → no write; otherwise `SetAvailable({ref, D, poll, now})`.
|
||||
- Auto job, independent of the suggestion: if `UpdateMode == auto && ActualDigest != D && D != LastTagDigest && DesiredRef != ref+"@"+D`, re-read the service (`GetService`), re-check the same condition and removed/mode on the fresh row, then `Start(TriggerPoll, Ref: ref)`. If a job row was created, `SetLastTagDigest(D)`. `ErrJobActive` and `NotUpdatableError` are logged at debug and ignored, leaving `last_tag_digest` unset so the next cycle retries.
|
||||
|
||||
Steps 2 and 3 use `context.WithoutCancel(ctx)`. At the end, publish `events.Services` if anything was written; log `poll_cycle` with refs, ok, failed, suggested, jobs, skipped, duration_ms.
|
||||
|
||||
### C6. `internal/master/jobs` and hub
|
||||
|
||||
```go
|
||||
// Hub.Route gains the minimum protocol version for this job:
|
||||
Route(svc model.Service, minProtocol int) (model.Route, error)
|
||||
|
||||
// Store gains:
|
||||
GetImageVersion(ctx context.Context, id int64) (model.ImageVersion, error)
|
||||
|
||||
// TriggerVersion starts a manual job to exactly version versionID of the
|
||||
// service's repo. model.ErrNotFound for an unknown service, an unknown
|
||||
// version, or a version of another repo. Otherwise what Start returns.
|
||||
func (s *Service) TriggerVersion(ctx context.Context, serviceID, versionID int64, requestedBy string) (model.Job, error)
|
||||
```
|
||||
|
||||
- Ref = `svc.ImageRepo` + `":"+tag` if tag set + `"@"+digest` if digest set.
|
||||
- Calls `Start` with `TriggerManual` and explicit ref ("follows no tag" refusal does not apply; removed, self, built, container still do).
|
||||
- `Start` passes `protocol.MinPinnedRefVersion` to `Route` when the ref has a digest or no tag, otherwise `protocol.MinJobVersion`.
|
||||
|
||||
### C7. Protocol and agent
|
||||
|
||||
```go
|
||||
const Version = 3
|
||||
const MinJobVersion = 2 // unchanged: repo:tag jobs
|
||||
const MinPinnedRefVersion = 3 // jobs whose Ref has a digest or no tag
|
||||
```
|
||||
|
||||
`JobStart` doc: "Ref is `repo:tag`, `repo:tag@digest` or `repo@digest`. For `repo:tag` the agent resolves the tag's current digest; a ref with a digest is deployed as is."
|
||||
|
||||
`Resolver.Resolve`: digest present → return ref unchanged, no `DistributionInspect`; tag present → resolve as today; neither → error "has no tag to resolve" (unchanged). Compose writes the ref verbatim into the override, Swarm sets it as the image. Executors print `pinned <ref>` instead of `resolved <ref>` when nothing was resolved.
|
||||
|
||||
### C8. Master configuration
|
||||
|
||||
- `POLL_INTERVAL`: default `6h`, positive Go duration, error `"POLL_INTERVAL must be a positive duration such as 6h, got %q"`.
|
||||
- `DOCKER_CONFIG`: not parsed by `config`; `go-containerregistry` reads it. `main` logs `registry_credentials` with the path and whether `config.json` exists, never its contents.
|
||||
|
||||
### C9. Web
|
||||
|
||||
- `POST /services/{id}/update` gains optional form field `version` (an `image_versions.id`): empty → `Trigger` as today; non-numeric → `400 invalid version`; otherwise `TriggerVersion`. Results: `303` to the job (also on `ErrJobActive`), `404` on `ErrNotFound`, `409` re-render "Cannot update: <reason>."
|
||||
- `web.Store` gains `RecentVersions`; `web.Jobs` gains `TriggerVersion`.
|
||||
- Service page: "Versions" table, up to 10 rows: ref (shortRef, full ref as title), source, first seen, "running" marker when digest equals `ActualDigest`, a POST form with `csrf_token` and `version`. Forms shown only when `AutoBlocked == ""`. Rows with empty tag note "the service will follow no tag afterwards". When the service is `auto`, header notes auto mode will move it forward at the next new version. A "Polling" row shows `SkipReason`, or `last_poll_error`, or "every <interval>".
|
||||
- Overview: badge "follows no tag" when `FollowedRef(ActualRef) == ""`; badge "poll failed" (title = error) when `LastPollError != ""`. Template func `followsNoTag`.
|
||||
|
||||
## Tasks
|
||||
|
||||
### Task 1: Store and model (C1, C2, C3)
|
||||
Migration, model fields, store methods, `upsertService` running versions, `FinishJob` rule. Integration tests: SetAvailable writes digest/source poll and records version, second call keeps first_seen_at; TestSnapshotRecordsRunningVersions (tag+digest, tagless digest, no digest skipped, re-snapshot idempotent); TestRecentVersions (order, limit 10, repo filter, digest-less row hidden only when a digest row for the same tag was first seen at or after it); GetImageVersion ErrNotFound; SetPollError sets/clears, upsert does not touch last_poll_error/available_*; FinishJob table extended (tag job clears poll suggestion; pick tag@old keeps suggestion tag@new; pick tag@new clears; webhook suggestion (digest '') cleared by matching tag; tagless pick keeps it). Update the e2e `memStore` in the same commit.
|
||||
|
||||
### Task 2: Protocol, agent and hub routing (C7, C6 Route)
|
||||
Bump protocol, MinPinnedRefVersion, docs; Resolver pass-through; compose/swarm output line; `hub.Route(svc, minProtocol)`. Tests: TestResolve table (tag resolves; tag@d and @d pass through with zero inspect calls; bare errors); compose pinned ref verbatim in override; swarm spec image equals pinned ref; route rows v2 agent + min 3 → ErrAgentTooOld, v3 → ok, swarm fallback to v3 manager when reporting manager is v2.
|
||||
|
||||
### Task 3: Jobs (C6)
|
||||
`Start` picks min version from the ref; `TriggerVersion`. Tests: version of other repo → ErrNotFound, no CreateJob; ref construction table; min version passed to fake hub (plain Trigger → 2, pinned → 3); explicit ref bypasses no-tag but not removed/self/built/container; existing tests green.
|
||||
|
||||
### Task 4: Registry client and poller (C4, C5)
|
||||
Registry tests (local httptest + ggcr/pkg/registry, no network): random.Index digest equals index digest; recording handler shows only HEAD on /manifests/; basic-auth handler succeeds with temp DOCKER_CONFIG (t.Setenv) and fails without; 404 → error. Verify behaviour of DefaultKeychain when config.json has credsStore but no helper binary; document. Poller tests per Review Focus, plus Run test (first cycle after delay, no overlap, returns on cancel).
|
||||
|
||||
### Task 5: Config, wiring, web (C8, C9)
|
||||
Config POLL_INTERVAL with tests; add to setAll list. `cmd/master/main.go`: registry.New, poller, `go p.Run(ctx)` with done channel, wait for it after HTTP shutdown and before st.Close; log registry_credentials. Web handlers/templates per C9 with tests (picker ≤10 rows with CSRF and version IDs; hidden for built/self/container/removed; POST with version → TriggerVersion, without → Trigger; 400/404/409; overview badges; Polling row).
|
||||
|
||||
### Task 6: End-to-end
|
||||
`internal/e2e/versions_test.go`: TestPickPinnedVersion; TestPollStartsAutoJob (poller.Cycle with fake registry → one TriggerPoll job to repo:tag; second Cycle starts nothing). `currentHub.Route` new signature.
|
||||
|
||||
### Task 7: Documentation
|
||||
README (POLL_INTERVAL, DOCKER_CONFIG, "Registry polling" section: polled/skipped, credentials only inline auths, Docker Hub note, version picker & rollback, auto caveat, agent protocol 3 for pinned/tagless picks). Spec: replace "Believed not to count against Docker Hub pull limits for HEAD requests — verify during implementation" with verified statement + source link (docs.docker.com/docker-hub/usage/pulls: "Using GET emulates a real pull and counts towards the limit. Using HEAD won't."; note the separate unquantified abuse rate limit). `deploy/master.stack.yml`: mount config dir read-only, set DOCKER_CONFIG. CLAUDE.md: architecture entries for registry and poller; gotchas (HEAD only; digest-less webhook row hidden once digest known; image_versions uses '' not NULL; picks by version ID and pinned/tagless need protocol 3; FinishJob rule includes digest (replace existing bullet); rollback to repo@digest makes the service follow no tag); phase 4 plan reference. Save this plan as `docs/superpowers/plans/2026-10-13-master-agent-phase-4-polling.md`.
|
||||
|
||||
## Final verification
|
||||
|
||||
```bash
|
||||
gofmt -l . ; go vet ./...
|
||||
go build ./cmd/master ./cmd/agent && rm -f master agent
|
||||
go test ./...
|
||||
go test -race ./internal/agent/... ./internal/master/... ./internal/e2e/
|
||||
DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
|
||||
```
|
||||
@@ -247,8 +247,12 @@ them. An agent recreating itself would kill the job it is running.
|
||||
- Mechanism: `HEAD /v2/<repo>/manifests/<tag>`; the returned digest is compared with
|
||||
`actual_digest`. Use `go-containerregistry` — it handles Docker Hub's token auth and
|
||||
multi-arch indexes.
|
||||
- Interval `POLL_INTERVAL`, default 6h. Believed not to count against Docker Hub pull
|
||||
limits for HEAD requests — verify during implementation.
|
||||
- Interval `POLL_INTERVAL`, default 6h. Docker Hub documents that HEAD requests do not
|
||||
count against the pull limit ("Using GET emulates a real pull and counts towards the
|
||||
limit. Using HEAD won't."; verified against
|
||||
https://docs.docker.com/docker-hub/usage/pulls/). The same page mentions a separate,
|
||||
unquantified abuse rate limit for many pulls from one IP address, so the poller stays
|
||||
HEAD-only and never downloads a manifest.
|
||||
- Credentials: a Docker `config.json` (as written by `docker login`) mounted into the
|
||||
master. No credential UI, no encryption in Postgres.
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ require (
|
||||
github.com/coreos/go-oidc/v3 v3.21.0
|
||||
github.com/distribution/reference v0.6.0
|
||||
github.com/docker/docker v28.5.2+incompatible
|
||||
github.com/google/go-containerregistry v0.22.1
|
||||
github.com/jackc/pgx/v5 v5.10.0
|
||||
github.com/opencontainers/go-digest v1.0.0
|
||||
github.com/stretchr/testify v1.11.1
|
||||
@@ -21,6 +22,8 @@ require (
|
||||
github.com/containerd/errdefs/pkg v0.3.0 // indirect
|
||||
github.com/containerd/log v0.1.0 // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/docker/cli v29.7.2+incompatible // indirect
|
||||
github.com/docker/docker-credential-helpers v0.9.3 // indirect
|
||||
github.com/docker/go-connections v0.7.0 // indirect
|
||||
github.com/docker/go-units v0.5.0 // indirect
|
||||
github.com/felixge/httpsnoop v1.0.4 // indirect
|
||||
@@ -30,6 +33,7 @@ require (
|
||||
github.com/jackc/pgpassfile v1.0.0 // indirect
|
||||
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
||||
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
||||
github.com/klauspost/compress v1.19.2 // indirect
|
||||
github.com/moby/docker-image-spec v1.3.1 // indirect
|
||||
github.com/moby/sys/atomicwriter v0.1.0 // indirect
|
||||
github.com/moby/term v0.5.2 // indirect
|
||||
@@ -37,14 +41,15 @@ require (
|
||||
github.com/opencontainers/image-spec v1.1.1 // indirect
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||||
github.com/sirupsen/logrus v1.9.4 // indirect
|
||||
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
||||
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
|
||||
go.opentelemetry.io/otel v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
||||
go.opentelemetry.io/otel/trace v1.43.0 // indirect
|
||||
golang.org/x/sync v0.20.0 // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/sync v0.22.0 // indirect
|
||||
golang.org/x/sys v0.47.0 // indirect
|
||||
golang.org/x/text v0.35.0 // indirect
|
||||
golang.org/x/time v0.15.0 // indirect
|
||||
gotest.tools/v3 v3.5.2 // indirect
|
||||
|
||||
@@ -21,8 +21,12 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
|
||||
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
|
||||
github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY=
|
||||
github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
|
||||
github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
|
||||
github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||
github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
|
||||
github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
|
||||
github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
|
||||
github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
|
||||
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
|
||||
@@ -38,6 +42,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
|
||||
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
|
||||
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||
github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84=
|
||||
github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0=
|
||||
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
|
||||
@@ -50,6 +56,8 @@ github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
|
||||
github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
|
||||
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
|
||||
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
|
||||
github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
|
||||
github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
|
||||
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
|
||||
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
|
||||
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||
@@ -74,8 +82,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
|
||||
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
|
||||
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
|
||||
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
|
||||
github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
|
||||
github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
@@ -101,18 +109,22 @@ go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09
|
||||
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
|
||||
go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
|
||||
go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
|
||||
golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
|
||||
golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
|
||||
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
|
||||
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
|
||||
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
|
||||
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
|
||||
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
|
||||
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
|
||||
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
|
||||
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
|
||||
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
|
||||
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
|
||||
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
|
||||
golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
|
||||
golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
|
||||
|
||||
@@ -91,10 +91,10 @@ func NewComposeExecutor(cli ComposeDocker, resolve *Resolver, selfID string, run
|
||||
return &ComposeExecutor{cli: cli, resolve: resolve, selfID: selfID, run: run, build: NewBuildChecker(cli, selfID, runOut)}
|
||||
}
|
||||
|
||||
// Execute pins job.Ref to its current digest, writes it to the stack's
|
||||
// override file and recreates the service. Working directory and config
|
||||
// files come from the service's container labels on this machine, never from
|
||||
// the job. It returns the pinned ref.
|
||||
// Execute pins job.Ref to its current digest (a ref that has one is used as
|
||||
// is), writes it to the stack's override file and recreates the service.
|
||||
// Working directory and config files come from the service's container
|
||||
// labels on this machine, never from the job. It returns the pinned ref.
|
||||
func (e *ComposeExecutor) Execute(ctx context.Context, job protocol.JobStart, out io.Writer) (string, error) {
|
||||
project, service := job.ComposeProject, job.ComposeService
|
||||
cts, err := e.cli.ContainerList(ctx, container.ListOptions{
|
||||
@@ -150,11 +150,17 @@ func (e *ComposeExecutor) Execute(ctx context.Context, job protocol.JobStart, ou
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
fmt.Fprintf(out, "resolved %s\n", pinned)
|
||||
fmt.Fprintln(out, resolveNote(job.Ref, pinned))
|
||||
|
||||
if _, err := WriteOverride(dir, service, pinned); err != nil {
|
||||
// Giving the override the stack's owner is best effort: a failure is only
|
||||
// a warning, the update itself is fine.
|
||||
_, ownerErr, err := WriteOverride(dir, service, pinned, files[0])
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if ownerErr != nil {
|
||||
fmt.Fprintf(out, "warning: could not give the override the stack's owner: %v\n", ownerErr)
|
||||
}
|
||||
|
||||
base := composeBase(project, workingDir, files, envs)
|
||||
for _, step := range [][]string{{"pull", service}, {"up", "-d", service}} {
|
||||
|
||||
@@ -69,6 +69,7 @@ func TestComposeExecutor(t *testing.T) {
|
||||
root, _ := filepath.EvalSymlinks(t.TempDir())
|
||||
stack := filepath.Join(root, "slusk")
|
||||
require.NoError(t, os.MkdirAll(stack, 0o755))
|
||||
composeFile := stackFile(t, stack)
|
||||
job := protocol.JobStart{Kind: protocol.KindCompose, ComposeProject: "slusk", ComposeService: "web", Ref: "gitea.shcizo.se/shcizo/slusk:1.4"}
|
||||
pinned := job.Ref + "@" + d
|
||||
|
||||
@@ -107,6 +108,37 @@ func TestComposeExecutor(t *testing.T) {
|
||||
_, doc := readOverride(t, stack)
|
||||
assert.Equal(t, pinned, serviceImage(doc, "web"))
|
||||
assert.Contains(t, out.String(), "resolved "+pinned)
|
||||
assert.NotContains(t, out.String(), "warning")
|
||||
})
|
||||
t.Run("an unreadable owner is a warning and the job still succeeds", func(t *testing.T) {
|
||||
t.Cleanup(cleanOverride)
|
||||
require.NoError(t, os.Rename(composeFile, composeFile+".bak"))
|
||||
t.Cleanup(func() { os.Rename(composeFile+".bak", composeFile) })
|
||||
var out strings.Builder
|
||||
got, err := setup(fakeCompose{rw, []container.Summary{ct}}, &fakeDist{digest: d}, &recorder{}).Execute(context.Background(), job, &out)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, pinned, got)
|
||||
assert.Contains(t, out.String(), "warning: could not give the override the stack's owner: read owner: ")
|
||||
_, doc := readOverride(t, stack)
|
||||
assert.Equal(t, pinned, serviceImage(doc, "web"))
|
||||
})
|
||||
t.Run("a pinned ref is written verbatim and not resolved", func(t *testing.T) {
|
||||
t.Cleanup(cleanOverride)
|
||||
for _, ref := range []string{"gitea.shcizo.se/shcizo/slusk:1.3@" + d, "gitea.shcizo.se/shcizo/slusk@" + d} {
|
||||
rec := &recorder{}
|
||||
dist := &fakeDist{digest: "sha256:other"}
|
||||
var out strings.Builder
|
||||
pinnedJob := job
|
||||
pinnedJob.Ref = ref
|
||||
got, err := setup(fakeCompose{rw, []container.Summary{ct}}, dist, rec).Execute(context.Background(), pinnedJob, &out)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, ref, got)
|
||||
assert.Empty(t, dist.refs, "no registry lookup")
|
||||
_, doc := readOverride(t, stack)
|
||||
assert.Equal(t, ref, serviceImage(doc, "web"))
|
||||
assert.Contains(t, out.String(), "pinned "+ref)
|
||||
assert.NotContains(t, out.String(), "resolved")
|
||||
}
|
||||
})
|
||||
t.Run("built from source is refused before anything is written", func(t *testing.T) {
|
||||
t.Cleanup(cleanOverride)
|
||||
|
||||
@@ -8,6 +8,7 @@ import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"syscall"
|
||||
|
||||
"github.com/docker/docker/api/types/container"
|
||||
"github.com/docker/docker/api/types/mount"
|
||||
@@ -34,15 +35,68 @@ var overrideNames = []string{
|
||||
// keeping every other entry in the file, and returns the file's path. It
|
||||
// refuses when the file exists without the header, or when another
|
||||
// auto-loaded override file exists in dir. The write is atomic.
|
||||
func WriteOverride(dir, service, ref string) (string, error) {
|
||||
//
|
||||
// composeFile is the stack's first compose file. The new file gets the owner
|
||||
// of the existing override, or of composeFile when there is none or the
|
||||
// existing one is owned by root (see pickOwner). The agent runs as root and the
|
||||
// rename creates a new file, so without this the stack's owner would lose
|
||||
// control of the file. ownerErr reports that the owner could not be read or
|
||||
// set; the override is still written. err means it was not written.
|
||||
func WriteOverride(dir, service, ref, composeFile string) (path string, ownerErr error, err error) {
|
||||
overridePath := filepath.Join(dir, OverrideName)
|
||||
return writeOverride(dir, service, ref, func() (fileOwner, error) {
|
||||
return resolveOwner(overridePath, composeFile)
|
||||
})
|
||||
}
|
||||
|
||||
// fileOwner is the uid and gid of a file.
|
||||
type fileOwner struct{ uid, gid int }
|
||||
|
||||
// readOwner returns the owner of the file at path.
|
||||
func readOwner(path string) (fileOwner, error) {
|
||||
fi, err := os.Stat(path)
|
||||
if err != nil {
|
||||
return fileOwner{}, fmt.Errorf("read owner: %w", err)
|
||||
}
|
||||
st, ok := fi.Sys().(*syscall.Stat_t)
|
||||
if !ok {
|
||||
return fileOwner{}, fmt.Errorf("read owner of %s: not available on this platform", path)
|
||||
}
|
||||
return fileOwner{int(st.Uid), int(st.Gid)}, nil
|
||||
}
|
||||
|
||||
// pickOwner chooses the owner of a new override: the existing override's
|
||||
// (nil when there is none), unless that is root, then the compose file's.
|
||||
// Overrides written before the agent set owners are root-owned and would
|
||||
// otherwise stay so. compose is only called when needed.
|
||||
func pickOwner(override *fileOwner, compose func() (fileOwner, error)) (fileOwner, error) {
|
||||
if override != nil && override.uid != 0 {
|
||||
return *override, nil
|
||||
}
|
||||
return compose()
|
||||
}
|
||||
|
||||
// resolveOwner applies pickOwner to the files on disk.
|
||||
func resolveOwner(overridePath, composeFile string) (fileOwner, error) {
|
||||
var existing *fileOwner
|
||||
if o, err := readOwner(overridePath); err == nil {
|
||||
existing = &o
|
||||
} else if !errors.Is(err, os.ErrNotExist) {
|
||||
return fileOwner{}, err
|
||||
}
|
||||
return pickOwner(existing, func() (fileOwner, error) { return readOwner(composeFile) })
|
||||
}
|
||||
|
||||
// writeOverride is WriteOverride with the owner lookup injected, for tests.
|
||||
func writeOverride(dir, service, ref string, owner func() (fileOwner, error)) (string, error, error) {
|
||||
for _, name := range overrideNames {
|
||||
if name == OverrideName {
|
||||
continue
|
||||
}
|
||||
if _, err := os.Lstat(filepath.Join(dir, name)); err == nil {
|
||||
return "", fmt.Errorf("refused: %s exists; the agent only manages %s and never edits operator files", name, OverrideName)
|
||||
return "", nil, fmt.Errorf("refused: %s exists; the agent only manages %s and never edits operator files", name, OverrideName)
|
||||
} else if !errors.Is(err, os.ErrNotExist) {
|
||||
return "", fmt.Errorf("check %s: %w", name, err)
|
||||
return "", nil, fmt.Errorf("check %s: %w", name, err)
|
||||
}
|
||||
}
|
||||
path := filepath.Join(dir, OverrideName)
|
||||
@@ -51,12 +105,12 @@ func WriteOverride(dir, service, ref string) (string, error) {
|
||||
switch {
|
||||
case errors.Is(err, os.ErrNotExist):
|
||||
case err != nil:
|
||||
return "", fmt.Errorf("read override: %w", err)
|
||||
return "", nil, fmt.Errorf("read override: %w", err)
|
||||
case !bytes.HasPrefix(raw, []byte(overrideHeader)):
|
||||
return "", fmt.Errorf("refused: %s exists and was not written by package-updater", path)
|
||||
return "", nil, fmt.Errorf("refused: %s exists and was not written by package-updater", path)
|
||||
default:
|
||||
if err := yaml.Unmarshal(raw, &doc); err != nil {
|
||||
return "", fmt.Errorf("parse override: %w", err)
|
||||
return "", nil, fmt.Errorf("parse override: %w", err)
|
||||
}
|
||||
if doc == nil {
|
||||
doc = map[string]any{}
|
||||
@@ -75,30 +129,38 @@ func WriteOverride(dir, service, ref string) (string, error) {
|
||||
doc["services"] = services
|
||||
body, err := yaml.Marshal(doc)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("encode override: %w", err)
|
||||
return "", nil, fmt.Errorf("encode override: %w", err)
|
||||
}
|
||||
// Temp file in the same directory + rename: a crash never leaves a
|
||||
// half-written override that compose would then load.
|
||||
tmp, err := os.CreateTemp(dir, "."+OverrideName+".*")
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("write override: %w", err)
|
||||
return "", nil, fmt.Errorf("write override: %w", err)
|
||||
}
|
||||
defer os.Remove(tmp.Name()) // no-op after a successful rename
|
||||
if _, err := tmp.WriteString(overrideHeader + string(body)); err != nil {
|
||||
tmp.Close()
|
||||
return "", fmt.Errorf("write override: %w", err)
|
||||
return "", nil, fmt.Errorf("write override: %w", err)
|
||||
}
|
||||
if err := tmp.Chmod(0o644); err != nil {
|
||||
tmp.Close()
|
||||
return "", fmt.Errorf("write override: %w", err)
|
||||
return "", nil, fmt.Errorf("write override: %w", err)
|
||||
}
|
||||
// Chown the open file, not the path after the rename: a path could have
|
||||
// been swapped for a symlink by someone with write access to the stack.
|
||||
var ownerErr error
|
||||
if o, err := owner(); err != nil {
|
||||
ownerErr = err
|
||||
} else if err := tmp.Chown(o.uid, o.gid); err != nil {
|
||||
ownerErr = fmt.Errorf("set owner %d:%d: %w", o.uid, o.gid, err)
|
||||
}
|
||||
if err := tmp.Close(); err != nil {
|
||||
return "", fmt.Errorf("write override: %w", err)
|
||||
return "", nil, fmt.Errorf("write override: %w", err)
|
||||
}
|
||||
if err := os.Rename(tmp.Name(), path); err != nil {
|
||||
return "", fmt.Errorf("write override: %w", err)
|
||||
return "", nil, fmt.Errorf("write override: %w", err)
|
||||
}
|
||||
return path, nil
|
||||
return path, ownerErr, nil
|
||||
}
|
||||
|
||||
// SelfInspector is the subset of the Docker SDK MountRoots needs.
|
||||
|
||||
@@ -29,11 +29,96 @@ func serviceImage(doc map[string]any, name string) any {
|
||||
return entry["image"]
|
||||
}
|
||||
|
||||
// stackFile creates dir/compose.yaml and returns its path.
|
||||
func stackFile(t *testing.T, dir string) string {
|
||||
t.Helper()
|
||||
p := filepath.Join(dir, "compose.yaml")
|
||||
require.NoError(t, os.WriteFile(p, []byte("services: {}\n"), 0o644))
|
||||
return p
|
||||
}
|
||||
|
||||
func TestPickOwner(t *testing.T) {
|
||||
compose := fileOwner{1000, 1000}
|
||||
fromCompose := func() (fileOwner, error) { return compose, nil }
|
||||
failing := func() (fileOwner, error) { return fileOwner{}, errors.New("boom") }
|
||||
tests := []struct {
|
||||
name string
|
||||
override *fileOwner
|
||||
compose func() (fileOwner, error)
|
||||
want fileOwner
|
||||
wantErr bool
|
||||
}{
|
||||
{"no override uses the compose file", nil, fromCompose, compose, false},
|
||||
{"override owned by a user wins", &fileOwner{1001, 1002}, fromCompose, fileOwner{1001, 1002}, false},
|
||||
{"root-owned override uses the compose file", &fileOwner{0, 0}, fromCompose, compose, false},
|
||||
{"compose file is not read when the override decides", &fileOwner{1001, 1002}, failing, fileOwner{1001, 1002}, false},
|
||||
{"unreadable compose file is an error", nil, failing, fileOwner{}, true},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := pickOwner(tt.override, tt.compose)
|
||||
assert.Equal(t, tt.wantErr, err != nil)
|
||||
assert.Equal(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestResolveOwner(t *testing.T) {
|
||||
me := fileOwner{os.Getuid(), os.Getgid()}
|
||||
t.Run("no override uses the compose file", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
got, err := resolveOwner(filepath.Join(dir, OverrideName), stackFile(t, dir))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, me, got)
|
||||
})
|
||||
t.Run("existing override is used without the compose file", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, OverrideName), nil, 0o644))
|
||||
got, err := resolveOwner(filepath.Join(dir, OverrideName), filepath.Join(dir, "missing.yaml"))
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, me, got)
|
||||
})
|
||||
t.Run("neither file is an error", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
_, err := resolveOwner(filepath.Join(dir, OverrideName), filepath.Join(dir, "missing.yaml"))
|
||||
assert.Error(t, err)
|
||||
})
|
||||
}
|
||||
|
||||
func TestWriteOverride_Owner(t *testing.T) {
|
||||
t.Run("success sets no ownerErr", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
_, ownerErr, err := WriteOverride(dir, "web", "a:1@sha256:aa", stackFile(t, dir))
|
||||
require.NoError(t, err)
|
||||
assert.NoError(t, ownerErr)
|
||||
})
|
||||
t.Run("unreadable owner is reported and the file is still written", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
_, ownerErr, err := WriteOverride(dir, "web", "a:1@sha256:aa", filepath.Join(dir, "missing.yaml"))
|
||||
require.NoError(t, err)
|
||||
assert.ErrorContains(t, ownerErr, "read owner")
|
||||
_, doc := readOverride(t, dir)
|
||||
assert.Equal(t, "a:1@sha256:aa", serviceImage(doc, "web"))
|
||||
})
|
||||
t.Run("chown failure is reported and the file is still written", func(t *testing.T) {
|
||||
if os.Getuid() == 0 {
|
||||
t.Skip("root can chown to anyone")
|
||||
}
|
||||
dir := t.TempDir()
|
||||
_, ownerErr, err := writeOverride(dir, "web", "a:1@sha256:aa", func() (fileOwner, error) { return fileOwner{0, 0}, nil })
|
||||
require.NoError(t, err)
|
||||
assert.ErrorContains(t, ownerErr, "set owner 0:0")
|
||||
_, doc := readOverride(t, dir)
|
||||
assert.Equal(t, "a:1@sha256:aa", serviceImage(doc, "web"))
|
||||
})
|
||||
}
|
||||
|
||||
func TestWriteOverride(t *testing.T) {
|
||||
t.Run("new file", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
path, err := WriteOverride(dir, "web", "a:1@sha256:aa")
|
||||
path, ownerErr, err := WriteOverride(dir, "web", "a:1@sha256:aa", stackFile(t, dir))
|
||||
require.NoError(t, err)
|
||||
assert.NoError(t, ownerErr)
|
||||
assert.Equal(t, filepath.Join(dir, OverrideName), path)
|
||||
raw, doc := readOverride(t, dir)
|
||||
assert.True(t, len(raw) > len(overrideHeader) && raw[:len(overrideHeader)] == overrideHeader)
|
||||
@@ -42,7 +127,7 @@ func TestWriteOverride(t *testing.T) {
|
||||
t.Run("keeps other services", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, OverrideName), []byte(overrideHeader+"services:\n db:\n image: db:1\n"), 0o644))
|
||||
_, err := WriteOverride(dir, "web", "a:1@sha256:aa")
|
||||
_, _, err := WriteOverride(dir, "web", "a:1@sha256:aa", stackFile(t, dir))
|
||||
require.NoError(t, err)
|
||||
_, doc := readOverride(t, dir)
|
||||
assert.Equal(t, "db:1", serviceImage(doc, "db"))
|
||||
@@ -51,7 +136,7 @@ func TestWriteOverride(t *testing.T) {
|
||||
t.Run("replaces own entry", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, OverrideName), []byte(overrideHeader+"services:\n web:\n image: old\n"), 0o644))
|
||||
_, err := WriteOverride(dir, "web", "a:2@sha256:bb")
|
||||
_, _, err := WriteOverride(dir, "web", "a:2@sha256:bb", stackFile(t, dir))
|
||||
require.NoError(t, err)
|
||||
_, doc := readOverride(t, dir)
|
||||
assert.Equal(t, "a:2@sha256:bb", serviceImage(doc, "web"))
|
||||
@@ -60,7 +145,7 @@ func TestWriteOverride(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
const body = "services:\n web:\n environment: [A=1]\n"
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, OverrideName), []byte(body), 0o644))
|
||||
_, err := WriteOverride(dir, "web", "a:1@sha256:aa")
|
||||
_, _, err := WriteOverride(dir, "web", "a:1@sha256:aa", stackFile(t, dir))
|
||||
assert.ErrorContains(t, err, "refused")
|
||||
got, _ := os.ReadFile(filepath.Join(dir, OverrideName))
|
||||
assert.Equal(t, body, string(got))
|
||||
@@ -69,7 +154,7 @@ func TestWriteOverride(t *testing.T) {
|
||||
t.Run("refuses next to "+other, func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, other), []byte("services: {}\n"), 0o644))
|
||||
_, err := WriteOverride(dir, "web", "a:1@sha256:aa")
|
||||
_, _, err := WriteOverride(dir, "web", "a:1@sha256:aa", stackFile(t, dir))
|
||||
assert.ErrorContains(t, err, other)
|
||||
_, statErr := os.Stat(filepath.Join(dir, OverrideName))
|
||||
assert.True(t, errors.Is(statErr, os.ErrNotExist))
|
||||
@@ -77,12 +162,13 @@ func TestWriteOverride(t *testing.T) {
|
||||
}
|
||||
t.Run("leaves no temp files", func(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
_, err := WriteOverride(dir, "web", "a:1@sha256:aa")
|
||||
_, _, err := WriteOverride(dir, "web", "a:1@sha256:aa", stackFile(t, dir))
|
||||
require.NoError(t, err)
|
||||
entries, err := os.ReadDir(dir)
|
||||
require.NoError(t, err)
|
||||
require.Len(t, entries, 1)
|
||||
assert.Equal(t, OverrideName, entries[0].Name())
|
||||
require.Len(t, entries, 2)
|
||||
assert.Equal(t, "compose.override.yaml", entries[0].Name())
|
||||
assert.Equal(t, "compose.yaml", entries[1].Name())
|
||||
})
|
||||
}
|
||||
|
||||
|
||||
@@ -16,7 +16,8 @@ type DistributionClient interface {
|
||||
}
|
||||
|
||||
// Resolver turns "repo:tag" into "repo:tag@digest" by asking the local
|
||||
// daemon, which contacts the registry.
|
||||
// daemon, which contacts the registry. A ref that already has a digest is
|
||||
// passed through.
|
||||
type Resolver struct {
|
||||
cli DistributionClient
|
||||
auth *RegistryAuth
|
||||
@@ -27,13 +28,15 @@ func NewResolver(cli DistributionClient, auth *RegistryAuth) *Resolver {
|
||||
return &Resolver{cli: cli, auth: auth}
|
||||
}
|
||||
|
||||
// Resolve returns ref pinned to the digest its tag currently points at. It
|
||||
// fails for a ref without a tag or with a digest already.
|
||||
// Resolve returns ref pinned to the digest its tag currently points at. A ref
|
||||
// that already has a digest ("repo:tag@digest" or "repo@digest") is returned
|
||||
// unchanged without asking the daemon. It fails for a ref with neither tag nor
|
||||
// digest.
|
||||
func (r *Resolver) Resolve(ctx context.Context, ref string) (string, error) {
|
||||
p := imageref.Parse(ref)
|
||||
switch {
|
||||
case p.Digest != "":
|
||||
return "", fmt.Errorf("image %q already has a digest", ref)
|
||||
return ref, nil
|
||||
case p.Tag == "":
|
||||
return "", fmt.Errorf("image %q has no tag to resolve", ref)
|
||||
}
|
||||
@@ -46,3 +49,13 @@ func (r *Resolver) Resolve(ctx context.Context, ref string) (string, error) {
|
||||
}
|
||||
return ref + "@" + info.Descriptor.Digest.String(), nil
|
||||
}
|
||||
|
||||
// resolveNote is the job-output line that says which ref is deployed:
|
||||
// "resolved" when pinned came from resolving a tag, "pinned" when ref already
|
||||
// carried its digest.
|
||||
func resolveNote(ref, pinned string) string {
|
||||
if pinned == ref {
|
||||
return "pinned " + pinned
|
||||
}
|
||||
return "resolved " + pinned
|
||||
}
|
||||
|
||||
@@ -21,14 +21,21 @@ func TestResolver(t *testing.T) {
|
||||
assert.Equal(t, []string{"gitea.shcizo.se/shcizo/slusk:1.4"}, dist.refs)
|
||||
assert.Equal(t, []string{"enc-gitea"}, dist.auths)
|
||||
})
|
||||
t.Run("digest or missing tag is refused without asking the daemon", func(t *testing.T) {
|
||||
for _, ref := range []string{"repo@sha256:x", "repo:1@sha256:x", "repo"} {
|
||||
t.Run("a ref with a digest passes through without asking the daemon", func(t *testing.T) {
|
||||
for _, ref := range []string{"repo@sha256:x", "repo:1@sha256:x", "localhost:5000/repo:1@sha256:x"} {
|
||||
dist := &fakeDist{digest: d}
|
||||
_, err := NewResolver(dist, nil).Resolve(context.Background(), ref)
|
||||
assert.Error(t, err, ref)
|
||||
got, err := NewResolver(dist, nil).Resolve(context.Background(), ref)
|
||||
require.NoError(t, err, ref)
|
||||
assert.Equal(t, ref, got)
|
||||
assert.Empty(t, dist.refs)
|
||||
}
|
||||
})
|
||||
t.Run("a bare ref is refused without asking the daemon", func(t *testing.T) {
|
||||
dist := &fakeDist{digest: d}
|
||||
_, err := NewResolver(dist, nil).Resolve(context.Background(), "repo")
|
||||
assert.ErrorContains(t, err, "has no tag to resolve")
|
||||
assert.Empty(t, dist.refs)
|
||||
})
|
||||
t.Run("daemon error is wrapped", func(t *testing.T) {
|
||||
cause := errors.New("unauthorized")
|
||||
_, err := NewResolver(&fakeDist{err: cause}, nil).Resolve(context.Background(), "repo:1")
|
||||
|
||||
@@ -35,11 +35,11 @@ func NewSwarmExecutor(cli SwarmClient, resolve *Resolver, auth *RegistryAuth) *S
|
||||
}
|
||||
|
||||
// Execute checks that the local daemon is a manager of the job's cluster,
|
||||
// pins job.Ref to its current digest and updates the service to it. The
|
||||
// update is addressed by the ID and version of the service that was
|
||||
// inspected, so it changes exactly that object. Success means the daemon
|
||||
// accepted the new spec, not that the tasks have converged. It returns the
|
||||
// pinned ref.
|
||||
// pins job.Ref to its current digest (a ref that has one is used as is) and
|
||||
// updates the service to it. The update is addressed by the ID and version of
|
||||
// the service that was inspected, so it changes exactly that object. Success
|
||||
// means the daemon accepted the new spec, not that the tasks have converged.
|
||||
// It returns the pinned ref.
|
||||
func (e *SwarmExecutor) Execute(ctx context.Context, job protocol.JobStart, out io.Writer) (string, error) {
|
||||
info, err := e.cli.Info(ctx)
|
||||
if err != nil {
|
||||
@@ -71,7 +71,7 @@ func (e *SwarmExecutor) Execute(ctx context.Context, job protocol.JobStart, out
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
fmt.Fprintf(out, "resolved %s\n", pinned)
|
||||
fmt.Fprintln(out, resolveNote(job.Ref, pinned))
|
||||
|
||||
spec := svc.Spec
|
||||
spec.TaskTemplate.ContainerSpec.Image = pinned
|
||||
|
||||
@@ -77,6 +77,22 @@ func swarmSvc(name string) swarm.Service {
|
||||
}
|
||||
}
|
||||
|
||||
func TestSwarmUsesPinnedRef(t *testing.T) {
|
||||
const ref = "gitea/gitea:1.26@sha256:abababababababababababababababababababababababababababababababab"
|
||||
job := protocol.JobStart{Kind: protocol.KindSwarm, SwarmClusterID: "c1", SwarmService: "gitea_gitea", Ref: ref}
|
||||
fake := &fakeSwarm{info: managerOf("c1"), svc: swarmSvc("gitea_gitea")}
|
||||
dist := &fakeDist{digest: "sha256:other"}
|
||||
var out bytes.Buffer
|
||||
|
||||
got, err := NewSwarmExecutor(fake, NewResolver(dist, nil), nil).Execute(context.Background(), job, &out)
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, ref, got)
|
||||
assert.Equal(t, ref, fake.updSpec.TaskTemplate.ContainerSpec.Image)
|
||||
assert.Empty(t, dist.refs, "no registry lookup")
|
||||
assert.Contains(t, out.String(), "pinned "+ref)
|
||||
}
|
||||
|
||||
func TestSwarmExecutor(t *testing.T) {
|
||||
job := protocol.JobStart{Kind: protocol.KindSwarm, SwarmClusterID: "c1", SwarmService: "gitea_gitea", Ref: "gitea/gitea:1.27"}
|
||||
workerInfo := managerOf("c1")
|
||||
|
||||
@@ -11,6 +11,7 @@ import (
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strings"
|
||||
"sync"
|
||||
@@ -31,6 +32,9 @@ import (
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
// digestPattern is the digest format the real store records.
|
||||
var digestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
|
||||
|
||||
type memStore struct {
|
||||
mu sync.Mutex
|
||||
agents map[string]model.Agent
|
||||
@@ -44,6 +48,63 @@ type memStore struct {
|
||||
jobs map[int64]*model.Job
|
||||
nextJob int64
|
||||
finishApplied int // FinishJob calls that returned true
|
||||
versions map[int64]model.ImageVersion
|
||||
}
|
||||
|
||||
// seedVersion adds an image_versions row that GetImageVersion returns.
|
||||
func (m *memStore) seedVersion(v model.ImageVersion) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
if m.versions == nil {
|
||||
m.versions = map[int64]model.ImageVersion{}
|
||||
}
|
||||
m.versions[v.ID] = v
|
||||
}
|
||||
|
||||
func (m *memStore) GetImageVersion(_ context.Context, id int64) (model.ImageVersion, error) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
v, ok := m.versions[id]
|
||||
if !ok {
|
||||
return model.ImageVersion{}, model.ErrNotFound
|
||||
}
|
||||
return v, nil
|
||||
}
|
||||
|
||||
func (m *memStore) ListServices(_ context.Context) ([]model.Service, error) {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
var out []model.Service
|
||||
for _, svc := range m.svcRows {
|
||||
if svc.RemovedAt == nil {
|
||||
out = append(out, svc)
|
||||
}
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool { return out[i].ID < out[j].ID })
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (m *memStore) SetPollError(_ context.Context, ids []int64, msg string) error {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
for _, id := range ids {
|
||||
svc := m.svcRows[id]
|
||||
svc.LastPollError = msg
|
||||
m.svcRows[id] = svc
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *memStore) SetLastTagDigest(_ context.Context, id int64, digest string) error {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
svc, ok := m.svcRows[id]
|
||||
if !ok {
|
||||
return model.ErrNotFound
|
||||
}
|
||||
svc.LastTagDigest = digest
|
||||
m.svcRows[id] = svc
|
||||
return nil
|
||||
}
|
||||
|
||||
// seedService adds a service row that jobs can be triggered for.
|
||||
@@ -88,7 +149,7 @@ func (m *memStore) SetAvailable(_ context.Context, id int64, a model.Available)
|
||||
if !ok {
|
||||
return model.ErrNotFound
|
||||
}
|
||||
svc.AvailableRef, svc.AvailableSource, svc.AvailableAt = a.Ref, a.Source, &a.At
|
||||
svc.AvailableRef, svc.AvailableDigest, svc.AvailableSource, svc.AvailableAt = a.Ref, a.Digest, a.Source, &a.At
|
||||
m.svcRows[id] = svc
|
||||
return nil
|
||||
}
|
||||
@@ -184,10 +245,14 @@ func (m *memStore) FinishJob(_ context.Context, agentID, jobID int64, f model.Jo
|
||||
if f.Status == model.JobSucceeded {
|
||||
svc := m.svcRows[j.ServiceID]
|
||||
svc.DesiredRef = f.Ref
|
||||
if _, d, _ := strings.Cut(f.Ref, "@"); !strings.Contains(requestedRef, "@") && digestPattern.MatchString(d) {
|
||||
svc.LastTagDigest = d
|
||||
}
|
||||
// Same rule as the SQL: the job was created for the suggested ref after it was reported.
|
||||
requested, _, _ := strings.Cut(requestedRef, "@")
|
||||
if svc.AvailableAt != nil && svc.AvailableRef == requested && !svc.AvailableAt.After(j.CreatedAt) {
|
||||
svc.AvailableRef, svc.AvailableSource, svc.AvailableAt = "", "", nil
|
||||
requested, digest, _ := strings.Cut(requestedRef, "@")
|
||||
if svc.AvailableAt != nil && svc.AvailableRef == requested && !svc.AvailableAt.After(j.CreatedAt) &&
|
||||
(digest == "" || svc.AvailableDigest == digest) {
|
||||
svc.AvailableRef, svc.AvailableDigest, svc.AvailableSource, svc.AvailableAt = "", "", "", nil
|
||||
}
|
||||
m.svcRows[j.ServiceID] = svc
|
||||
}
|
||||
@@ -282,7 +347,9 @@ type currentHub struct{ p atomic.Pointer[hub.Hub] }
|
||||
|
||||
func (c *currentHub) ServeHTTP(w http.ResponseWriter, r *http.Request) { c.p.Load().ServeHTTP(w, r) }
|
||||
func (c *currentHub) Disconnect(id int64) { c.p.Load().Disconnect(id) }
|
||||
func (c *currentHub) Route(svc model.Service) (model.Route, error) { return c.p.Load().Route(svc) }
|
||||
func (c *currentHub) Route(svc model.Service, minProtocol int) (model.Route, error) {
|
||||
return c.p.Load().Route(svc, minProtocol)
|
||||
}
|
||||
func (c *currentHub) StartJob(r model.Route, id int64, s protocol.JobStart) error {
|
||||
return c.p.Load().StartJob(r, id, s)
|
||||
}
|
||||
|
||||
@@ -32,6 +32,9 @@ const (
|
||||
lostMessage = "lost: the agent did not know this job when it reconnected"
|
||||
)
|
||||
|
||||
// e2eDigest is the digest the fake executor pins a tag to.
|
||||
const e2eDigest = "sha256:" + "e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0e2e0"
|
||||
|
||||
// gateExecutor writes a line of output, then blocks until release is closed
|
||||
// or the job is cancelled.
|
||||
type gateExecutor struct {
|
||||
@@ -52,7 +55,10 @@ func (g *gateExecutor) Execute(ctx context.Context, job protocol.JobStart, out i
|
||||
return "", ctx.Err()
|
||||
}
|
||||
_, _ = io.WriteString(out, "recreated\n")
|
||||
return job.Ref + "@sha256:e2e", nil
|
||||
if strings.Contains(job.Ref, "@") {
|
||||
return job.Ref, nil
|
||||
}
|
||||
return job.Ref + "@" + e2eDigest, nil
|
||||
}
|
||||
|
||||
// jobAgent is a connected agent with a real runner and its two lifetimes: the
|
||||
@@ -119,7 +125,7 @@ func (e *jobEnv) waitRoutable(t *testing.T) {
|
||||
t.Helper()
|
||||
svc, err := e.store.GetService(context.Background(), 1)
|
||||
require.NoError(t, err)
|
||||
require.Eventually(t, func() bool { _, err := e.m.hub.Route(svc); return err == nil }, waitFor, pollEvery)
|
||||
require.Eventually(t, func() bool { _, err := e.m.hub.Route(svc, protocol.MinJobVersion); return err == nil }, waitFor, pollEvery)
|
||||
}
|
||||
|
||||
func (e *jobEnv) job(t *testing.T, id int64) model.Job {
|
||||
@@ -159,12 +165,12 @@ func TestManualJobFlowsToAgentAndBack(t *testing.T) {
|
||||
j := e.trigger(t)
|
||||
done := e.waitStatus(t, j.ID, model.JobSucceeded)
|
||||
|
||||
assert.Equal(t, slusk+":1.4.2@sha256:e2e", done.ToRef)
|
||||
assert.Equal(t, slusk+":1.4.2@"+e2eDigest, done.ToRef)
|
||||
assert.Contains(t, done.Output, "pulling "+slusk+":1.4.2")
|
||||
assert.Contains(t, done.Output, "recreated")
|
||||
svc, err := e.store.GetService(context.Background(), 1)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, slusk+":1.4.2@sha256:e2e", svc.DesiredRef)
|
||||
assert.Equal(t, slusk+":1.4.2@"+e2eDigest, svc.DesiredRef)
|
||||
require.Eventually(t, func() bool { return len(e.agent.runner.Known()) == 0 }, waitFor, pollEvery, "the result must be acked")
|
||||
}
|
||||
|
||||
@@ -240,7 +246,7 @@ func TestPhaseOneAgentGetsNoJobs(t *testing.T) {
|
||||
require.NoError(t, wsjson.Write(ctx, c, snap))
|
||||
|
||||
require.Eventually(t, func() bool {
|
||||
_, err := m.hub.Route(svcRow)
|
||||
_, err := m.hub.Route(svcRow, protocol.MinJobVersion)
|
||||
return errors.Is(err, model.ErrAgentTooOld)
|
||||
}, waitFor, pollEvery)
|
||||
|
||||
|
||||
@@ -0,0 +1,133 @@
|
||||
package e2e
|
||||
|
||||
import (
|
||||
"context"
|
||||
"io"
|
||||
"log/slog"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/jobs"
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
"github.com/shcizo/package-updater/internal/master/poller"
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
// jobCount is the number of jobs created so far.
|
||||
func (m *memStore) jobCount() int {
|
||||
m.mu.Lock()
|
||||
defer m.mu.Unlock()
|
||||
return len(m.jobs)
|
||||
}
|
||||
|
||||
// fixedRegistry answers every lookup from a fixed table.
|
||||
type fixedRegistry struct {
|
||||
digests map[string]string
|
||||
calls int
|
||||
}
|
||||
|
||||
func (f *fixedRegistry) Digest(_ context.Context, ref string) (string, error) {
|
||||
f.calls++
|
||||
return f.digests[ref], nil
|
||||
}
|
||||
|
||||
func TestPickPinnedVersion(t *testing.T) {
|
||||
env := newJobEnv(t)
|
||||
env.store.seedVersion(model.ImageVersion{ID: 5, Repo: slusk, Tag: "1.3.0", Digest: "sha256:old130", Source: model.SourceRunning})
|
||||
|
||||
job, err := env.jobs.TriggerVersion(context.Background(), 1, 5, "alice")
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, slusk+":1.3.0@sha256:old130", job.ToRef)
|
||||
select {
|
||||
case ref := <-env.exec.started:
|
||||
assert.Equal(t, slusk+":1.3.0@sha256:old130", ref, "the agent receives exactly the picked version")
|
||||
case <-time.After(waitFor):
|
||||
t.Fatal("the agent never received the job")
|
||||
}
|
||||
close(env.exec.release)
|
||||
done := env.waitStatus(t, job.ID, model.JobSucceeded)
|
||||
assert.Equal(t, model.TriggerManual, done.Trigger)
|
||||
assert.Equal(t, "alice", done.RequestedBy)
|
||||
}
|
||||
|
||||
func TestPickVersionOfAnotherRepoIsRefused(t *testing.T) {
|
||||
env := newJobEnv(t)
|
||||
env.store.seedVersion(model.ImageVersion{ID: 6, Repo: "evil/other", Tag: "1", Digest: "sha256:x", Source: model.SourcePoll})
|
||||
|
||||
_, err := env.jobs.TriggerVersion(context.Background(), 1, 6, "alice")
|
||||
|
||||
assert.ErrorIs(t, err, model.ErrNotFound)
|
||||
assert.Zero(t, env.store.jobCount(), "no job was created")
|
||||
}
|
||||
|
||||
func TestPollStartsAutoJob(t *testing.T) {
|
||||
env := newJobEnv(t)
|
||||
env.store.seedService(model.Service{ID: 1, Kind: protocol.KindCompose, ComposeProject: "slusk", ComposeService: "web",
|
||||
AgentID: ptr(agentID), ImageRepo: slusk, ActualRef: slusk + ":1.4.2@sha256:old", ActualDigest: "sha256:old",
|
||||
UpdateMode: model.ModeAuto})
|
||||
reg := &fixedRegistry{digests: map[string]string{slusk + ":1.4.2": "sha256:new"}}
|
||||
p := poller.New(env.store, env.jobs, reg, env.m.broker, poller.Config{Workers: 1}, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
select {
|
||||
case ref := <-env.exec.started:
|
||||
assert.Equal(t, slusk+":1.4.2", ref, "the agent gets repo:tag and resolves the digest itself")
|
||||
case <-time.After(waitFor):
|
||||
t.Fatal("the agent never received the job")
|
||||
}
|
||||
require.Equal(t, 1, env.store.jobCount())
|
||||
job := env.job(t, 1)
|
||||
assert.Equal(t, model.TriggerPoll, job.Trigger)
|
||||
assert.Equal(t, slusk+":1.4.2", job.ToRef)
|
||||
svc, err := env.store.GetService(context.Background(), 1)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, slusk+":1.4.2", svc.AvailableRef)
|
||||
assert.Equal(t, "sha256:new", svc.AvailableDigest)
|
||||
assert.Equal(t, model.SourcePoll, svc.AvailableSource)
|
||||
assert.Equal(t, "sha256:new", svc.LastTagDigest)
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Equal(t, 2, reg.calls, "the registry is asked again")
|
||||
assert.Equal(t, 1, env.store.jobCount(), "the same digest does not start another job")
|
||||
close(env.exec.release)
|
||||
env.waitStatus(t, job.ID, model.JobSucceeded)
|
||||
}
|
||||
|
||||
// An update started by the webhook, then a rollback by hand: polling must not
|
||||
// redo the update while the registry still shows the digest that was deployed.
|
||||
func TestPollKeepsARollbackAfterAWebhookUpdate(t *testing.T) {
|
||||
env := newJobEnv(t)
|
||||
ctx := context.Background()
|
||||
close(env.exec.release)
|
||||
env.store.seedService(model.Service{ID: 1, Kind: protocol.KindCompose, ComposeProject: "slusk", ComposeService: "web",
|
||||
AgentID: ptr(agentID), ImageRepo: slusk, ActualRef: slusk + ":main@sha256:old", ActualDigest: "sha256:old",
|
||||
UpdateMode: model.ModeAuto})
|
||||
env.store.seedVersion(model.ImageVersion{ID: 5, Repo: slusk, Tag: "main", Digest: "sha256:old", Source: model.SourceRunning})
|
||||
svc, err := env.store.GetService(ctx, 1)
|
||||
require.NoError(t, err)
|
||||
|
||||
hook, err := env.jobs.Start(ctx, svc, jobs.StartRequest{Trigger: model.TriggerWebhook, Ref: slusk + ":main"})
|
||||
require.NoError(t, err)
|
||||
env.waitStatus(t, hook.ID, model.JobSucceeded)
|
||||
svc, err = env.store.GetService(ctx, 1)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, e2eDigest, svc.LastTagDigest, "the deployed digest of the tag is remembered")
|
||||
|
||||
pick, err := env.jobs.TriggerVersion(ctx, 1, 5, "alice")
|
||||
require.NoError(t, err)
|
||||
env.waitStatus(t, pick.ID, model.JobSucceeded)
|
||||
jobsBefore := env.store.jobCount()
|
||||
|
||||
reg := &fixedRegistry{digests: map[string]string{slusk + ":main": e2eDigest}}
|
||||
p := poller.New(env.store, env.jobs, reg, env.m.broker, poller.Config{Workers: 1}, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
||||
p.Cycle(ctx)
|
||||
|
||||
assert.Equal(t, 1, reg.calls)
|
||||
assert.Equal(t, jobsBefore, env.store.jobCount(), "the rollback stays")
|
||||
}
|
||||
@@ -16,6 +16,7 @@ import (
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
"github.com/shcizo/package-updater/internal/master/webhook"
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
// webhookServer mounts the webhook handler on a test server, wired to the
|
||||
@@ -98,7 +99,7 @@ func TestWebhookWaitsForAutoJob(t *testing.T) {
|
||||
job := e.job(t, r.body.Results[0].JobID)
|
||||
assert.Equal(t, model.TriggerWebhook, job.Trigger)
|
||||
assert.Equal(t, model.JobSucceeded, job.Status)
|
||||
assert.Equal(t, slusk+":2.0.0@sha256:e2e", job.ToRef)
|
||||
assert.Equal(t, slusk+":2.0.0@"+e2eDigest, job.ToRef)
|
||||
svc, err := e.store.GetService(context.Background(), 1)
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, svc.AvailableRef, "the job deployed the suggestion, so it is cleared")
|
||||
@@ -111,7 +112,7 @@ func TestWebhookFailedAutoJobIs500(t *testing.T) {
|
||||
e.agent.stopConn() // no agent connection: the job fails at once with "agent offline"
|
||||
require.Eventually(t, func() bool {
|
||||
svc, _ := e.store.GetService(context.Background(), 1)
|
||||
_, err := e.m.hub.Route(svc)
|
||||
_, err := e.m.hub.Route(svc, protocol.MinJobVersion)
|
||||
return err != nil
|
||||
}, waitFor, pollEvery)
|
||||
|
||||
|
||||
@@ -30,6 +30,12 @@ func Parse(ref string) Ref {
|
||||
return r
|
||||
}
|
||||
|
||||
// IsRegistryHost reports whether the first path segment of a repository names
|
||||
// a registry: it contains a "." or ":" or is "localhost".
|
||||
func IsRegistryHost(segment string) bool {
|
||||
return strings.ContainsAny(segment, ".:") || segment == "localhost"
|
||||
}
|
||||
|
||||
// String reassembles the reference as repo[:tag][@digest].
|
||||
func (r Ref) String() string {
|
||||
s := r.Repo
|
||||
|
||||
@@ -27,3 +27,23 @@ func TestParse(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsRegistryHost(t *testing.T) {
|
||||
cases := []struct {
|
||||
in string
|
||||
want bool
|
||||
}{
|
||||
{"lscr.io", true},
|
||||
{"localhost:5000", true},
|
||||
{"localhost", true},
|
||||
{"registry:5000", true},
|
||||
{"gitea", false},
|
||||
{"library", false},
|
||||
{"", false},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.in, func(t *testing.T) {
|
||||
assert.Equal(t, c.want, IsRegistryHost(c.in))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -28,11 +28,17 @@ type Config struct {
|
||||
// UpdateTimeout bounds how long one webhook request waits for its auto
|
||||
// jobs (UPDATE_TIMEOUT, default 5m).
|
||||
UpdateTimeout time.Duration
|
||||
// PollInterval is the time between registry polling cycles
|
||||
// (POLL_INTERVAL, default 6h).
|
||||
PollInterval time.Duration
|
||||
}
|
||||
|
||||
// defaultUpdateTimeout is used when UPDATE_TIMEOUT is unset.
|
||||
const defaultUpdateTimeout = 5 * time.Minute
|
||||
|
||||
// defaultPollInterval is used when POLL_INTERVAL is unset.
|
||||
const defaultPollInterval = 6 * time.Hour
|
||||
|
||||
// Load reads and validates the master configuration, failing fast on
|
||||
// anything missing so a half-configured master never starts.
|
||||
func Load() (*Config, error) {
|
||||
@@ -50,6 +56,7 @@ func Load() (*Config, error) {
|
||||
LogLevel: getenvDefault("LOG_LEVEL", "info"),
|
||||
UpdaterAPIKey: os.Getenv("UPDATER_API_KEY"),
|
||||
UpdateTimeout: defaultUpdateTimeout,
|
||||
PollInterval: defaultPollInterval,
|
||||
}
|
||||
for _, r := range []struct{ name, value string }{
|
||||
{"DATABASE_URL", cfg.DatabaseURL},
|
||||
@@ -77,6 +84,13 @@ func Load() (*Config, error) {
|
||||
}
|
||||
cfg.UpdateTimeout = d
|
||||
}
|
||||
if v := os.Getenv("POLL_INTERVAL"); v != "" {
|
||||
d, err := time.ParseDuration(v)
|
||||
if err != nil || d <= 0 {
|
||||
return nil, fmt.Errorf("POLL_INTERVAL must be a positive duration such as 6h, got %q", v)
|
||||
}
|
||||
cfg.PollInterval = d
|
||||
}
|
||||
return cfg, nil
|
||||
}
|
||||
|
||||
|
||||
@@ -22,7 +22,7 @@ func setAll(t *testing.T) {
|
||||
for k, v := range required {
|
||||
t.Setenv(k, v)
|
||||
}
|
||||
for _, k := range []string{"PORT", "AGENT_PORT", "AGENT_IMAGE", "LOG_LEVEL", "UPDATER_API_KEY", "UPDATE_TIMEOUT"} {
|
||||
for _, k := range []string{"PORT", "AGENT_PORT", "AGENT_IMAGE", "LOG_LEVEL", "UPDATER_API_KEY", "UPDATE_TIMEOUT", "POLL_INTERVAL"} {
|
||||
t.Setenv(k, "")
|
||||
}
|
||||
}
|
||||
@@ -38,6 +38,26 @@ func TestLoad_Defaults(t *testing.T) {
|
||||
assert.Equal(t, "updater-admins", cfg.AllowedGroup)
|
||||
assert.Empty(t, cfg.UpdaterAPIKey)
|
||||
assert.Equal(t, 5*time.Minute, cfg.UpdateTimeout)
|
||||
assert.Equal(t, 6*time.Hour, cfg.PollInterval)
|
||||
}
|
||||
|
||||
func TestLoad_PollInterval(t *testing.T) {
|
||||
setAll(t)
|
||||
t.Setenv("POLL_INTERVAL", "30m")
|
||||
cfg, err := Load()
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, 30*time.Minute, cfg.PollInterval)
|
||||
}
|
||||
|
||||
func TestLoad_InvalidPollInterval(t *testing.T) {
|
||||
for _, v := range []string{"abc", "0s", "-1h", "6"} {
|
||||
t.Run(v, func(t *testing.T) {
|
||||
setAll(t)
|
||||
t.Setenv("POLL_INTERVAL", v)
|
||||
_, err := Load()
|
||||
assert.ErrorContains(t, err, "POLL_INTERVAL must be a positive duration such as 6h, got")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoad_WebhookSettings(t *testing.T) {
|
||||
|
||||
@@ -43,7 +43,7 @@ func waitRoute(t *testing.T, h *Hub) model.Route {
|
||||
var r model.Route
|
||||
require.Eventually(t, func() bool {
|
||||
var err error
|
||||
r, err = h.Route(svc)
|
||||
r, err = h.Route(svc, protocol.MinJobVersion)
|
||||
return err == nil
|
||||
}, 2*time.Second, 5*time.Millisecond)
|
||||
return r
|
||||
@@ -61,7 +61,7 @@ func TestHub_ReconcilesBeforeRoutable(t *testing.T) {
|
||||
send(t, c, protocol.TypeHello, protocol.Hello{Hostname: "node-2", ProtocolVersion: 2, KnownJobs: []string{"7", "9", "x"}})
|
||||
svc := model.Service{Kind: protocol.KindCompose, AgentID: ptr(node2.ID)}
|
||||
time.Sleep(50 * time.Millisecond) // hello is now blocked inside FailLostJobs
|
||||
_, err = h.Route(svc)
|
||||
_, err = h.Route(svc, protocol.MinJobVersion)
|
||||
assert.ErrorIs(t, err, model.ErrAgentOffline)
|
||||
|
||||
close(store.lostGate)
|
||||
|
||||
@@ -14,9 +14,11 @@ type candidate struct {
|
||||
hello protocol.Hello
|
||||
}
|
||||
|
||||
// Route picks the connection a job for svc goes to. It returns
|
||||
// model.ErrAgentOffline or model.ErrAgentTooOld when there is none.
|
||||
func (h *Hub) Route(svc model.Service) (model.Route, error) {
|
||||
// Route picks the connection a job for svc goes to, among agents that speak
|
||||
// at least protocol version minProtocol. It returns model.ErrAgentOffline or
|
||||
// model.ErrAgentTooOld (model.ErrAgentTooOldForPinned when minProtocol asks
|
||||
// for a pinned ref) when there is none.
|
||||
func (h *Hub) Route(svc model.Service, minProtocol int) (model.Route, error) {
|
||||
h.mu.Lock()
|
||||
conns := make([]candidate, 0, len(h.conns))
|
||||
for id, c := range h.conns {
|
||||
@@ -25,7 +27,7 @@ func (h *Hub) Route(svc model.Service) (model.Route, error) {
|
||||
}
|
||||
}
|
||||
h.mu.Unlock()
|
||||
return route(svc, conns)
|
||||
return route(svc, conns, minProtocol)
|
||||
}
|
||||
|
||||
// route picks the connection a job for svc goes to. Compose services and
|
||||
@@ -33,7 +35,7 @@ func (h *Hub) Route(svc model.Service) (model.Route, error) {
|
||||
// run on the reporting agent if it qualifies, else on any other connected
|
||||
// manager of the same cluster (lowest agent ID first). Too-old wins over
|
||||
// offline only when a connection would otherwise have qualified.
|
||||
func route(svc model.Service, conns []candidate) (model.Route, error) {
|
||||
func route(svc model.Service, conns []candidate, minProtocol int) (model.Route, error) {
|
||||
sort.Slice(conns, func(a, b int) bool { return conns[a].agentID < conns[b].agentID })
|
||||
tooOld := false
|
||||
try := func(c candidate) bool {
|
||||
@@ -42,7 +44,7 @@ func route(svc model.Service, conns []candidate) (model.Route, error) {
|
||||
return false
|
||||
}
|
||||
}
|
||||
if c.hello.ProtocolVersion < protocol.MinJobVersion {
|
||||
if c.hello.ProtocolVersion < minProtocol {
|
||||
tooOld = true
|
||||
return false
|
||||
}
|
||||
@@ -63,6 +65,9 @@ func route(svc model.Service, conns []candidate) (model.Route, error) {
|
||||
}
|
||||
}
|
||||
if tooOld {
|
||||
if minProtocol >= protocol.MinPinnedRefVersion {
|
||||
return model.Route{}, model.ErrAgentTooOldForPinned
|
||||
}
|
||||
return model.Route{}, model.ErrAgentTooOld
|
||||
}
|
||||
return model.Route{}, model.ErrAgentOffline
|
||||
|
||||
@@ -12,37 +12,46 @@ import (
|
||||
func TestRoute(t *testing.T) {
|
||||
composeSvc := model.Service{Kind: protocol.KindCompose, AgentID: ptr(int64(2))}
|
||||
swarmSvc := model.Service{Kind: protocol.KindSwarm, AgentID: ptr(int64(1)), SwarmClusterID: "c1"}
|
||||
v2 := protocol.Hello{ProtocolVersion: protocol.Version}
|
||||
mgrV2 := protocol.Hello{ProtocolVersion: protocol.Version, SwarmManager: true, SwarmClusterID: "c1"}
|
||||
v2 := protocol.Hello{ProtocolVersion: 2}
|
||||
v3 := protocol.Hello{ProtocolVersion: 3}
|
||||
mgrV2 := protocol.Hello{ProtocolVersion: 2, SwarmManager: true, SwarmClusterID: "c1"}
|
||||
mgrV3 := protocol.Hello{ProtocolVersion: 3, SwarmManager: true, SwarmClusterID: "c1"}
|
||||
jobs, pinned := protocol.MinJobVersion, protocol.MinPinnedRefVersion
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
svc model.Service
|
||||
conns []candidate
|
||||
min int
|
||||
want model.Route
|
||||
err error
|
||||
}{
|
||||
{"compose on own agent", composeSvc, []candidate{{2, 20, v2}}, model.Route{AgentID: 2, ConnID: 20}, nil},
|
||||
{"compose, own agent too old", composeSvc, []candidate{{2, 20, protocol.Hello{}}}, model.Route{}, model.ErrAgentTooOld},
|
||||
{"compose, own agent missing", composeSvc, nil, model.Route{}, model.ErrAgentOffline},
|
||||
{"compose, only another agent online", composeSvc, []candidate{{5, 50, v2}}, model.Route{}, model.ErrAgentOffline},
|
||||
{"swarm on reporting agent", swarmSvc, []candidate{{1, 10, mgrV2}, {3, 30, mgrV2}}, model.Route{AgentID: 1, ConnID: 10}, nil},
|
||||
{"swarm, reporting agent offline, other manager", swarmSvc, []candidate{{3, 30, mgrV2}}, model.Route{AgentID: 3, ConnID: 30}, nil},
|
||||
{"swarm, lowest agent id first", swarmSvc, []candidate{{4, 40, mgrV2}, {3, 30, mgrV2}}, model.Route{AgentID: 3, ConnID: 30}, nil},
|
||||
{"compose on own agent", composeSvc, []candidate{{2, 20, v2}}, jobs, model.Route{AgentID: 2, ConnID: 20}, nil},
|
||||
{"compose, own agent too old", composeSvc, []candidate{{2, 20, protocol.Hello{}}}, jobs, model.Route{}, model.ErrAgentTooOld},
|
||||
{"compose, own agent missing", composeSvc, nil, jobs, model.Route{}, model.ErrAgentOffline},
|
||||
{"compose, only another agent online", composeSvc, []candidate{{5, 50, v2}}, jobs, model.Route{}, model.ErrAgentOffline},
|
||||
{"compose, v2 agent and a pinned ref", composeSvc, []candidate{{2, 20, v2}}, pinned, model.Route{}, model.ErrAgentTooOldForPinned},
|
||||
{"compose, v3 agent and a pinned ref", composeSvc, []candidate{{2, 20, v3}}, pinned, model.Route{AgentID: 2, ConnID: 20}, nil},
|
||||
{"swarm on reporting agent", swarmSvc, []candidate{{1, 10, mgrV2}, {3, 30, mgrV2}}, jobs, model.Route{AgentID: 1, ConnID: 10}, nil},
|
||||
{"swarm, reporting agent offline, other manager", swarmSvc, []candidate{{3, 30, mgrV2}}, jobs, model.Route{AgentID: 3, ConnID: 30}, nil},
|
||||
{"swarm, lowest agent id first", swarmSvc, []candidate{{4, 40, mgrV2}, {3, 30, mgrV2}}, jobs, model.Route{AgentID: 3, ConnID: 30}, nil},
|
||||
{"swarm, other manager in another cluster", swarmSvc,
|
||||
[]candidate{{3, 30, protocol.Hello{ProtocolVersion: 2, SwarmManager: true, SwarmClusterID: "c2"}}}, model.Route{}, model.ErrAgentOffline},
|
||||
[]candidate{{3, 30, protocol.Hello{ProtocolVersion: 2, SwarmManager: true, SwarmClusterID: "c2"}}}, jobs, model.Route{}, model.ErrAgentOffline},
|
||||
{"swarm, only a v0 manager of the cluster", swarmSvc,
|
||||
[]candidate{{1, 10, protocol.Hello{SwarmManager: true, SwarmClusterID: "c1"}}}, model.Route{}, model.ErrAgentTooOld},
|
||||
[]candidate{{1, 10, protocol.Hello{SwarmManager: true, SwarmClusterID: "c1"}}}, jobs, model.Route{}, model.ErrAgentTooOld},
|
||||
{"swarm, v0 manager but a v2 manager exists", swarmSvc,
|
||||
[]candidate{{1, 10, protocol.Hello{SwarmManager: true, SwarmClusterID: "c1"}}, {3, 30, mgrV2}}, model.Route{AgentID: 3, ConnID: 30}, nil},
|
||||
[]candidate{{1, 10, protocol.Hello{SwarmManager: true, SwarmClusterID: "c1"}}, {3, 30, mgrV2}}, jobs, model.Route{AgentID: 3, ConnID: 30}, nil},
|
||||
{"swarm, worker of the cluster", swarmSvc,
|
||||
[]candidate{{1, 10, protocol.Hello{ProtocolVersion: 2, SwarmClusterID: "c1"}}}, model.Route{}, model.ErrAgentOffline},
|
||||
[]candidate{{1, 10, protocol.Hello{ProtocolVersion: 2, SwarmClusterID: "c1"}}}, jobs, model.Route{}, model.ErrAgentOffline},
|
||||
{"swarm, manager with empty cluster id", model.Service{Kind: protocol.KindSwarm},
|
||||
[]candidate{{1, 10, protocol.Hello{ProtocolVersion: 2, SwarmManager: true}}}, model.Route{}, model.ErrAgentOffline},
|
||||
[]candidate{{1, 10, protocol.Hello{ProtocolVersion: 2, SwarmManager: true}}}, jobs, model.Route{}, model.ErrAgentOffline},
|
||||
{"swarm, pinned ref falls back to a v3 manager when the reporting one is v2", swarmSvc,
|
||||
[]candidate{{1, 10, mgrV2}, {3, 30, mgrV3}}, pinned, model.Route{AgentID: 3, ConnID: 30}, nil},
|
||||
{"swarm, pinned ref and only v2 managers", swarmSvc, []candidate{{1, 10, mgrV2}}, pinned, model.Route{}, model.ErrAgentTooOldForPinned},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := route(tt.svc, tt.conns)
|
||||
got, err := route(tt.svc, tt.conns, tt.min)
|
||||
assert.ErrorIs(t, err, tt.err)
|
||||
assert.Equal(t, tt.want, got)
|
||||
})
|
||||
|
||||
@@ -20,13 +20,15 @@ type Store interface {
|
||||
CreateJob(ctx context.Context, j model.NewJob) (model.Job, error)
|
||||
FailJob(ctx context.Context, id int64, msg string, at time.Time) (bool, error)
|
||||
GetJob(ctx context.Context, id int64) (model.Job, error)
|
||||
GetImageVersion(ctx context.Context, id int64) (model.ImageVersion, error)
|
||||
}
|
||||
|
||||
// Hub routes jobs to agent connections. *hub.Hub satisfies it.
|
||||
type Hub interface {
|
||||
// Route picks the connection for svc: model.ErrAgentOffline or
|
||||
// Route picks the connection for svc among agents speaking at least
|
||||
// protocol version minProtocol: model.ErrAgentOffline or
|
||||
// model.ErrAgentTooOld when there is none.
|
||||
Route(svc model.Service) (model.Route, error)
|
||||
Route(svc model.Service, minProtocol int) (model.Route, error)
|
||||
// StartJob sends job.start over exactly the routed connection.
|
||||
// model.ErrAgentOffline if that connection is gone or was replaced.
|
||||
StartJob(r model.Route, jobID int64, start protocol.JobStart) error
|
||||
@@ -116,8 +118,9 @@ func (s *Service) updatable(svc model.Service, explicitRef bool) error {
|
||||
type StartRequest struct {
|
||||
Trigger model.JobTrigger
|
||||
RequestedBy string // OIDC subject for manual jobs; "" otherwise
|
||||
// Ref is the ref to deploy ("repo:tag"). Empty means the service's
|
||||
// followed tag, derived from its actual ref.
|
||||
// Ref is the ref to deploy ("repo:tag", "repo:tag@digest" or
|
||||
// "repo@digest"). Empty means the service's followed tag, derived from
|
||||
// its actual ref.
|
||||
Ref string
|
||||
}
|
||||
|
||||
@@ -131,8 +134,31 @@ func (s *Service) Trigger(ctx context.Context, serviceID int64, requestedBy stri
|
||||
return s.Start(ctx, svc, StartRequest{Trigger: model.TriggerManual, RequestedBy: requestedBy})
|
||||
}
|
||||
|
||||
// TriggerVersion starts a manual update of the service to exactly the image
|
||||
// version versionID, which must be a version of the service's own repo; the
|
||||
// ref is built from the stored version, never taken from the caller. It
|
||||
// returns model.ErrNotFound for an unknown service, an unknown version or a
|
||||
// version of another repo, and otherwise what Start returns. A version
|
||||
// without a tag leaves the service following no tag.
|
||||
func (s *Service) TriggerVersion(ctx context.Context, serviceID, versionID int64, requestedBy string) (model.Job, error) {
|
||||
svc, err := s.store.GetService(ctx, serviceID)
|
||||
if err != nil {
|
||||
return model.Job{}, err
|
||||
}
|
||||
v, err := s.store.GetImageVersion(ctx, versionID)
|
||||
if err != nil {
|
||||
return model.Job{}, err
|
||||
}
|
||||
if v.Repo != svc.ImageRepo {
|
||||
return model.Job{}, model.ErrNotFound
|
||||
}
|
||||
return s.Start(ctx, svc, StartRequest{Trigger: model.TriggerManual, RequestedBy: requestedBy, Ref: v.Ref()})
|
||||
}
|
||||
|
||||
// Start starts an update of svc. It returns the job, which may already be
|
||||
// failed ("agent offline", "agent too old for updates"); a
|
||||
// failed ("agent offline", "agent too old for updates", or "agent too old to
|
||||
// deploy a pinned version" when the ref has a digest or no tag and the agent
|
||||
// speaks protocol version 2); a
|
||||
// *model.NotUpdatableError when the service cannot be updated (no job
|
||||
// created); the active job and model.ErrJobActive when one is queued or
|
||||
// running.
|
||||
@@ -145,7 +171,11 @@ func (s *Service) Start(ctx context.Context, svc model.Service, req StartRequest
|
||||
ref = FollowedRef(svc.ActualRef) // updatable checked the tag
|
||||
}
|
||||
|
||||
r, routeErr := s.hub.Route(svc)
|
||||
minProtocol := protocol.MinJobVersion
|
||||
if p := imageref.Parse(ref); p.Digest != "" || p.Tag == "" {
|
||||
minProtocol = protocol.MinPinnedRefVersion
|
||||
}
|
||||
r, routeErr := s.hub.Route(svc, minProtocol)
|
||||
nj := model.NewJob{
|
||||
ServiceID: svc.ID, FromRef: svc.ActualRef, ToRef: ref,
|
||||
Trigger: req.Trigger, RequestedBy: req.RequestedBy, CreatedAt: s.now(),
|
||||
|
||||
@@ -21,6 +21,7 @@ type fakeStore struct {
|
||||
jobs map[int64]model.Job
|
||||
created []model.NewJob
|
||||
active *model.Job // returned with ErrJobActive when set
|
||||
versions map[int64]model.ImageVersion
|
||||
|
||||
revokedAgents map[int64]bool // CreateJob returns ErrAgentOffline for these
|
||||
}
|
||||
@@ -54,6 +55,14 @@ func (f *fakeStore) FailJob(_ context.Context, id int64, msg string, at time.Tim
|
||||
return true, nil
|
||||
}
|
||||
|
||||
func (f *fakeStore) GetImageVersion(_ context.Context, id int64) (model.ImageVersion, error) {
|
||||
v, ok := f.versions[id]
|
||||
if !ok {
|
||||
return model.ImageVersion{}, model.ErrNotFound
|
||||
}
|
||||
return v, nil
|
||||
}
|
||||
|
||||
func (f *fakeStore) GetJob(_ context.Context, id int64) (model.Job, error) { return f.jobs[id], nil }
|
||||
|
||||
type startCall struct {
|
||||
@@ -63,13 +72,24 @@ type startCall struct {
|
||||
}
|
||||
|
||||
type fakeHub struct {
|
||||
route model.Route
|
||||
routeErr error
|
||||
startErr error
|
||||
starts []startCall
|
||||
route model.Route
|
||||
routeErr error
|
||||
startErr error
|
||||
starts []startCall
|
||||
agentProtocol int // when set, Route fails with ErrAgentTooOld for a higher minProtocol
|
||||
mins []int // minProtocol of every Route call
|
||||
}
|
||||
|
||||
func (h *fakeHub) Route(model.Service) (model.Route, error) { return h.route, h.routeErr }
|
||||
func (h *fakeHub) Route(_ model.Service, minProtocol int) (model.Route, error) {
|
||||
h.mins = append(h.mins, minProtocol)
|
||||
if h.agentProtocol != 0 && minProtocol > h.agentProtocol {
|
||||
if minProtocol >= protocol.MinPinnedRefVersion {
|
||||
return model.Route{}, model.ErrAgentTooOldForPinned
|
||||
}
|
||||
return model.Route{}, model.ErrAgentTooOld
|
||||
}
|
||||
return h.route, h.routeErr
|
||||
}
|
||||
|
||||
func (h *fakeHub) StartJob(r model.Route, id int64, s protocol.JobStart) error {
|
||||
h.starts = append(h.starts, startCall{r, id, s})
|
||||
@@ -341,3 +361,133 @@ func TestFollowedRef(t *testing.T) {
|
||||
assert.Equal(t, "localhost:5000/foo:latest", FollowedRef("localhost:5000/foo"))
|
||||
assert.Empty(t, FollowedRef("redis@sha256:abc"))
|
||||
}
|
||||
|
||||
func TestStart_RoutesWithTheMinimumProtocolOfTheRef(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
ref string // "" means the followed tag
|
||||
want int
|
||||
}{
|
||||
{"followed tag", "", protocol.MinJobVersion},
|
||||
{"repo:tag", "x/y:2", protocol.MinJobVersion},
|
||||
{"repo:tag@digest", "x/y:2@sha256:a", protocol.MinPinnedRefVersion},
|
||||
{"repo@digest", "x/y@sha256:a", protocol.MinPinnedRefVersion},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
st := &fakeStore{services: map[int64]model.Service{1: composeSvc}, jobs: map[int64]model.Job{}}
|
||||
h := &fakeHub{route: model.Route{AgentID: 7, ConnID: 70}}
|
||||
s, _ := newService(st, h)
|
||||
|
||||
_, err := s.Start(context.Background(), composeSvc, StartRequest{Trigger: model.TriggerManual, Ref: tt.ref})
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []int{tt.want}, h.mins)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestTriggerVersion_Ref(t *testing.T) {
|
||||
const repo = "gitea.shcizo.se/shcizo/slusk"
|
||||
noTag := model.Service{ID: 4, Kind: protocol.KindCompose, ComposeProject: "n", ComposeService: "n",
|
||||
AgentID: ptr(int64(7)), ImageRepo: repo, ActualRef: repo + "@sha256:d1"}
|
||||
svc := composeSvc
|
||||
svc.ImageRepo = repo
|
||||
tests := []struct {
|
||||
name string
|
||||
svc model.Service
|
||||
version model.ImageVersion
|
||||
wantRef string
|
||||
wantMin int
|
||||
}{
|
||||
{"tag and digest", svc, model.ImageVersion{ID: 10, Repo: repo, Tag: "1.3.0", Digest: "sha256:old"}, repo + ":1.3.0@sha256:old", protocol.MinPinnedRefVersion},
|
||||
{"tag only", svc, model.ImageVersion{ID: 10, Repo: repo, Tag: "main"}, repo + ":main", protocol.MinJobVersion},
|
||||
{"digest only", svc, model.ImageVersion{ID: 10, Repo: repo, Digest: "sha256:old"}, repo + "@sha256:old", protocol.MinPinnedRefVersion},
|
||||
{"service that follows no tag", noTag, model.ImageVersion{ID: 10, Repo: repo, Tag: "1.3.0", Digest: "sha256:old"}, repo + ":1.3.0@sha256:old", protocol.MinPinnedRefVersion},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
st := &fakeStore{
|
||||
services: map[int64]model.Service{tt.svc.ID: tt.svc},
|
||||
jobs: map[int64]model.Job{},
|
||||
versions: map[int64]model.ImageVersion{10: tt.version},
|
||||
}
|
||||
h := &fakeHub{route: model.Route{AgentID: 7, ConnID: 70}}
|
||||
s, _ := newService(st, h)
|
||||
|
||||
job, err := s.TriggerVersion(context.Background(), tt.svc.ID, 10, "sub-1")
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, model.JobQueued, job.Status)
|
||||
require.Len(t, st.created, 1)
|
||||
assert.Equal(t, model.TriggerManual, st.created[0].Trigger)
|
||||
assert.Equal(t, "sub-1", st.created[0].RequestedBy)
|
||||
assert.Equal(t, tt.wantRef, st.created[0].ToRef)
|
||||
require.Len(t, h.starts, 1)
|
||||
assert.Equal(t, tt.wantRef, h.starts[0].start.Ref)
|
||||
assert.Equal(t, []int{tt.wantMin}, h.mins)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestTriggerVersion_NotFound(t *testing.T) {
|
||||
const repo = "gitea.shcizo.se/shcizo/slusk"
|
||||
svc := composeSvc
|
||||
svc.ImageRepo = repo
|
||||
tests := []struct {
|
||||
name string
|
||||
serviceID int64
|
||||
versionID int64
|
||||
}{
|
||||
{"unknown service", 9, 10},
|
||||
{"unknown version", 1, 99},
|
||||
{"version of another repo", 1, 11},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
st := &fakeStore{
|
||||
services: map[int64]model.Service{1: svc},
|
||||
jobs: map[int64]model.Job{},
|
||||
versions: map[int64]model.ImageVersion{
|
||||
10: {ID: 10, Repo: repo, Tag: "1"},
|
||||
11: {ID: 11, Repo: "evil/other", Tag: "1"},
|
||||
},
|
||||
}
|
||||
h := &fakeHub{route: model.Route{AgentID: 7, ConnID: 70}}
|
||||
s, pub := newService(st, h)
|
||||
|
||||
_, err := s.TriggerVersion(context.Background(), tt.serviceID, tt.versionID, "sub-1")
|
||||
|
||||
assert.ErrorIs(t, err, model.ErrNotFound)
|
||||
assert.Empty(t, st.created, "no job")
|
||||
assert.Empty(t, h.starts)
|
||||
assert.Empty(t, pub.topics)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestTriggerVersion_RequiresPinnedProtocol(t *testing.T) {
|
||||
const repo = "gitea.shcizo.se/shcizo/slusk"
|
||||
svc := composeSvc
|
||||
svc.ImageRepo = repo
|
||||
st := &fakeStore{
|
||||
services: map[int64]model.Service{1: svc},
|
||||
jobs: map[int64]model.Job{},
|
||||
versions: map[int64]model.ImageVersion{
|
||||
10: {ID: 10, Repo: repo, Tag: "1.3.0", Digest: "sha256:old"},
|
||||
11: {ID: 11, Repo: repo, Tag: "main"},
|
||||
},
|
||||
}
|
||||
h := &fakeHub{route: model.Route{AgentID: 7, ConnID: 70}, agentProtocol: 2}
|
||||
s, _ := newService(st, h)
|
||||
|
||||
pinned, err := s.TriggerVersion(context.Background(), 1, 10, "sub-1")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, model.JobFailed, pinned.Status)
|
||||
assert.Equal(t, "agent too old to deploy a pinned version (needs protocol 3)", pinned.Error)
|
||||
assert.Empty(t, h.starts, "nothing sent to the old agent")
|
||||
|
||||
plain, err := s.TriggerVersion(context.Background(), 1, 11, "sub-1")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, model.JobQueued, plain.Status)
|
||||
}
|
||||
|
||||
@@ -15,8 +15,20 @@ var (
|
||||
// ErrAgentTooOld means the only agent that could run the job speaks a
|
||||
// protocol version without jobs.
|
||||
ErrAgentTooOld = errors.New("agent too old for updates")
|
||||
// ErrAgentTooOldForPinned means the only agent that could run the job
|
||||
// speaks protocol version 2, which cannot deploy a digest-pinned or
|
||||
// tagless ref. errors.Is(err, ErrAgentTooOld) is true for it as well.
|
||||
ErrAgentTooOldForPinned error = agentTooOldForPinned{}
|
||||
)
|
||||
|
||||
type agentTooOldForPinned struct{}
|
||||
|
||||
func (agentTooOldForPinned) Error() string {
|
||||
return "agent too old to deploy a pinned version (needs protocol 3)"
|
||||
}
|
||||
|
||||
func (agentTooOldForPinned) Is(target error) bool { return target == ErrAgentTooOld }
|
||||
|
||||
// NotUpdatableError says why a service cannot be updated. Reason is shown
|
||||
// in the UI as is.
|
||||
type NotUpdatableError struct {
|
||||
|
||||
@@ -8,6 +8,7 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/imageref"
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
@@ -26,9 +27,12 @@ type Agent struct {
|
||||
Hostname string
|
||||
AgentVersion string
|
||||
SwarmManager bool
|
||||
LastSeenAt *time.Time
|
||||
RevokedAt *time.Time
|
||||
CreatedAt time.Time
|
||||
// SwarmClusterID is the Swarm cluster the agent's daemon was in when it last
|
||||
// connected; "" outside a swarm.
|
||||
SwarmClusterID string
|
||||
LastSeenAt *time.Time
|
||||
RevokedAt *time.Time
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
// Service is one service as last reported by an agent.
|
||||
@@ -56,11 +60,20 @@ type Service struct {
|
||||
// AvailableRef is the newest ref a webhook or poll reported for this
|
||||
// service; "" if none, or if a later job already deployed it.
|
||||
AvailableRef string
|
||||
AvailableSource string // SourceWebhook; "" when AvailableRef is empty
|
||||
AvailableDigest string // digest of AvailableRef when known (poll); "" from the webhook
|
||||
AvailableSource string // SourceWebhook or SourcePoll; "" when AvailableRef is empty
|
||||
AvailableAt *time.Time
|
||||
FirstSeenAt time.Time
|
||||
UpdatedAt time.Time
|
||||
RemovedAt *time.Time
|
||||
LastPollError string // last registry error for the followed ref; "" when fine
|
||||
// LastTagDigest is the newest digest of the followed tag that was deployed
|
||||
// or started: set when the poller starts an auto job, when it sees the service
|
||||
// already running that digest, and when any plain tag job succeeds (the
|
||||
// digest the agent pinned); "" if never. The poller does
|
||||
// not start another job for the same digest, so a rollback sticks until the
|
||||
// registry shows a different one.
|
||||
LastTagDigest string
|
||||
FirstSeenAt time.Time
|
||||
UpdatedAt time.Time
|
||||
RemovedAt *time.Time
|
||||
}
|
||||
|
||||
// Update modes of a service.
|
||||
@@ -69,18 +82,40 @@ const (
|
||||
ModeAuto = "auto"
|
||||
)
|
||||
|
||||
// Sources of an available ref.
|
||||
// Sources of an available ref and of an ImageVersion.
|
||||
const (
|
||||
SourceWebhook = "webhook"
|
||||
SourcePoll = "poll"
|
||||
// SourceRunning is used by image_versions only: an agent reported the
|
||||
// version as running.
|
||||
SourceRunning = "running"
|
||||
)
|
||||
|
||||
// Available is a newer ref reported for a service.
|
||||
type Available struct {
|
||||
Ref string
|
||||
Source string // SourceWebhook
|
||||
Digest string // "" when unknown (webhook)
|
||||
Source string // SourceWebhook or SourcePoll
|
||||
At time.Time
|
||||
}
|
||||
|
||||
// ImageVersion is one version of an image repo the master has seen. Tag and
|
||||
// Digest are "" when the version has no tag or its digest is unknown; they
|
||||
// are never both empty.
|
||||
type ImageVersion struct {
|
||||
ID int64
|
||||
Repo string
|
||||
Tag string
|
||||
Digest string
|
||||
Source string // SourceWebhook, SourcePoll or SourceRunning: the first source that saw it
|
||||
FirstSeenAt time.Time
|
||||
}
|
||||
|
||||
// Ref returns "repo:tag@digest", "repo:tag" or "repo@digest".
|
||||
func (v ImageVersion) Ref() string {
|
||||
return imageref.Ref{Repo: v.Repo, Tag: v.Tag, Digest: v.Digest}.String()
|
||||
}
|
||||
|
||||
// DisplayName is the human-facing name of the service.
|
||||
func (s Service) DisplayName() string {
|
||||
switch s.Kind {
|
||||
|
||||
@@ -40,6 +40,24 @@ func TestDisplayName(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestImageVersionRef(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
v ImageVersion
|
||||
want string
|
||||
}{
|
||||
{"tag and digest", ImageVersion{Repo: "r/x", Tag: "1", Digest: "sha256:a"}, "r/x:1@sha256:a"},
|
||||
{"tag only", ImageVersion{Repo: "r/x", Tag: "1"}, "r/x:1"},
|
||||
{"digest only", ImageVersion{Repo: "r/x", Digest: "sha256:a"}, "r/x@sha256:a"},
|
||||
{"registry port", ImageVersion{Repo: "localhost:5000/x", Tag: "1"}, "localhost:5000/x:1"},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
assert.Equal(t, c.want, c.v.Ref())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestJob_Active(t *testing.T) {
|
||||
cases := []struct {
|
||||
status JobStatus
|
||||
|
||||
@@ -0,0 +1,320 @@
|
||||
// Package poller checks the registry for new digests of the tags the
|
||||
// services follow. A new digest becomes the service's available version, and
|
||||
// a service in auto mode gets an update job.
|
||||
package poller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/events"
|
||||
"github.com/shcizo/package-updater/internal/master/jobs"
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
)
|
||||
|
||||
// lookupTimeout bounds one registry lookup.
|
||||
const lookupTimeout = 30 * time.Second
|
||||
|
||||
// maxErrorBytes caps the registry error stored in services.last_poll_error.
|
||||
const maxErrorBytes = 500
|
||||
|
||||
// Store is the storage the poller needs. *store.Store satisfies it.
|
||||
type Store interface {
|
||||
ListServices(ctx context.Context) ([]model.Service, error)
|
||||
GetService(ctx context.Context, id int64) (model.Service, error)
|
||||
SetAvailable(ctx context.Context, id int64, a model.Available) error
|
||||
SetLastTagDigest(ctx context.Context, id int64, digest string) error
|
||||
SetPollError(ctx context.Context, ids []int64, msg string) error
|
||||
}
|
||||
|
||||
// Jobs starts updates. *jobs.Service satisfies it.
|
||||
type Jobs interface {
|
||||
Start(ctx context.Context, svc model.Service, req jobs.StartRequest) (model.Job, error)
|
||||
}
|
||||
|
||||
// Registry looks up the digest a "repo:tag" ref points at. *registry.Client
|
||||
// satisfies it.
|
||||
type Registry interface {
|
||||
Digest(ctx context.Context, ref string) (string, error)
|
||||
}
|
||||
|
||||
// Publisher receives change signals. *events.Broker satisfies it.
|
||||
type Publisher interface{ Publish(t events.Topic) }
|
||||
|
||||
// Config holds the poller settings.
|
||||
type Config struct {
|
||||
Interval time.Duration // time between the end of a cycle and the start of the next (POLL_INTERVAL)
|
||||
FirstDelay time.Duration // wait before the first cycle; 1 minute in production
|
||||
Workers int // registry lookups in flight at once; 4 in production
|
||||
}
|
||||
|
||||
// Poller runs polling cycles.
|
||||
type Poller struct {
|
||||
store Store
|
||||
jobs Jobs
|
||||
reg Registry
|
||||
pub Publisher
|
||||
cfg Config
|
||||
log *slog.Logger
|
||||
now func() time.Time
|
||||
}
|
||||
|
||||
// New returns a Poller.
|
||||
func New(st Store, j Jobs, reg Registry, pub Publisher, cfg Config, log *slog.Logger) *Poller {
|
||||
if cfg.Workers < 1 {
|
||||
cfg.Workers = 1
|
||||
}
|
||||
return &Poller{store: st, jobs: j, reg: reg, pub: pub, cfg: cfg, log: log, now: time.Now}
|
||||
}
|
||||
|
||||
// SkipReason says why svc is not polled: "follows no tag", "built from
|
||||
// source", "no registry digest", or "" when it is polled.
|
||||
func SkipReason(svc model.Service) string {
|
||||
switch {
|
||||
case jobs.FollowedRef(svc.ActualRef) == "":
|
||||
return model.ReasonNoTag
|
||||
case svc.Built:
|
||||
return "built from source"
|
||||
case svc.ActualDigest == "":
|
||||
return "no registry digest"
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// Run polls until ctx is done. The first cycle starts Config.FirstDelay after
|
||||
// the call and each following one Config.Interval after the previous cycle
|
||||
// ended, so cycles never overlap. It blocks.
|
||||
func (p *Poller) Run(ctx context.Context) {
|
||||
timer := time.NewTimer(p.cfg.FirstDelay)
|
||||
defer timer.Stop()
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return
|
||||
case <-timer.C:
|
||||
}
|
||||
p.Cycle(ctx)
|
||||
timer.Reset(p.cfg.Interval)
|
||||
}
|
||||
}
|
||||
|
||||
// lookup is the registry's answer for one followed ref.
|
||||
type lookup struct {
|
||||
ref string
|
||||
digest string
|
||||
err error
|
||||
}
|
||||
|
||||
// cycleStats is what one cycle did, for the poll_cycle log line.
|
||||
type cycleStats struct {
|
||||
refs, ok, failed, suggested, jobs, skipped int
|
||||
wrote bool
|
||||
}
|
||||
|
||||
// Cycle runs one poll over all services. It looks up every distinct followed
|
||||
// ref once, with at most Config.Workers lookups at a time, then records the
|
||||
// results. Writing results and starting jobs is not cut short by ctx ending
|
||||
// during the lookups, so a job that was marked is always started.
|
||||
func (p *Poller) Cycle(ctx context.Context) {
|
||||
began := p.now()
|
||||
svcs, err := p.store.ListServices(ctx)
|
||||
if err != nil {
|
||||
p.log.Error("poll_list_failed", "error", err)
|
||||
return
|
||||
}
|
||||
var stats cycleStats
|
||||
byRef := map[string][]model.Service{}
|
||||
var refs []string
|
||||
for _, svc := range svcs {
|
||||
if svc.RemovedAt != nil {
|
||||
continue
|
||||
}
|
||||
if SkipReason(svc) != "" {
|
||||
stats.skipped++
|
||||
continue
|
||||
}
|
||||
ref := jobs.FollowedRef(svc.ActualRef)
|
||||
if _, seen := byRef[ref]; !seen {
|
||||
refs = append(refs, ref)
|
||||
}
|
||||
byRef[ref] = append(byRef[ref], svc)
|
||||
}
|
||||
stats.refs = len(refs)
|
||||
|
||||
write := context.WithoutCancel(ctx)
|
||||
for _, l := range p.lookupAll(ctx, refs) {
|
||||
if l.err != nil && ctx.Err() != nil {
|
||||
continue // cancelled mid-lookup: not the registry's fault
|
||||
}
|
||||
p.record(write, l, byRef[l.ref], &stats)
|
||||
}
|
||||
if stats.wrote {
|
||||
p.pub.Publish(events.Services)
|
||||
}
|
||||
p.log.Info("poll_cycle", "refs", stats.refs, "ok", stats.ok, "failed", stats.failed,
|
||||
"suggested", stats.suggested, "jobs", stats.jobs, "skipped", stats.skipped,
|
||||
"duration_ms", p.now().Sub(began).Milliseconds())
|
||||
}
|
||||
|
||||
// lookupAll asks the registry for every ref, Config.Workers at a time. It
|
||||
// returns the answers in ref order and stops starting new lookups once ctx
|
||||
// is done; refs never looked up are missing from the result.
|
||||
func (p *Poller) lookupAll(ctx context.Context, refs []string) []lookup {
|
||||
results := make([]*lookup, len(refs))
|
||||
next := make(chan int)
|
||||
var wg sync.WaitGroup
|
||||
for w := 0; w < p.cfg.Workers; w++ {
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
for i := range next {
|
||||
lctx, cancel := context.WithTimeout(ctx, lookupTimeout)
|
||||
d, err := p.reg.Digest(lctx, refs[i])
|
||||
cancel()
|
||||
results[i] = &lookup{ref: refs[i], digest: d, err: err}
|
||||
}
|
||||
}()
|
||||
}
|
||||
feed:
|
||||
for i := range refs {
|
||||
select {
|
||||
case next <- i:
|
||||
case <-ctx.Done():
|
||||
break feed
|
||||
}
|
||||
}
|
||||
close(next)
|
||||
wg.Wait()
|
||||
var out []lookup
|
||||
for _, r := range results {
|
||||
if r != nil {
|
||||
out = append(out, *r)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// record stores one lookup result for the services that follow l.ref.
|
||||
func (p *Poller) record(ctx context.Context, l lookup, svcs []model.Service, stats *cycleStats) {
|
||||
if l.err != nil {
|
||||
stats.failed++
|
||||
msg := truncate(l.err.Error())
|
||||
p.log.Warn("poll_failed", "ref", l.ref, "error", msg)
|
||||
p.setPollError(ctx, svcs, msg, stats, func(s model.Service) bool { return s.LastPollError != msg })
|
||||
return
|
||||
}
|
||||
stats.ok++
|
||||
p.setPollError(ctx, svcs, "", stats, func(s model.Service) bool { return s.LastPollError != "" })
|
||||
for _, svc := range svcs {
|
||||
if !p.suggest(ctx, svc, l, stats) {
|
||||
continue
|
||||
}
|
||||
if autoWanted(svc, l.ref, l.digest) {
|
||||
p.startAuto(ctx, svc.ID, l.ref, l.digest, stats)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// suggest marks l.digest as the available version of svc unless the service
|
||||
// already runs it or already has exactly that suggestion. A service that
|
||||
// runs l.digest also gets it as last_tag_digest. It returns false only when
|
||||
// writing the suggestion failed.
|
||||
func (p *Poller) suggest(ctx context.Context, svc model.Service, l lookup, stats *cycleStats) bool {
|
||||
if svc.ActualDigest == l.digest && svc.LastTagDigest != l.digest {
|
||||
// Seed last_tag_digest for a service that was not updated by a tag job
|
||||
// (it predates the column or was updated by hand), so that a later
|
||||
// rollback is not undone.
|
||||
if err := p.store.SetLastTagDigest(ctx, svc.ID, l.digest); err != nil {
|
||||
p.log.Error("poll_set_last_tag_digest_failed", "service_id", svc.ID, "error", err)
|
||||
}
|
||||
}
|
||||
if svc.ActualDigest == l.digest || (svc.AvailableRef == l.ref && svc.AvailableDigest == l.digest) {
|
||||
return true
|
||||
}
|
||||
err := p.store.SetAvailable(ctx, svc.ID, model.Available{Ref: l.ref, Digest: l.digest, Source: model.SourcePoll, At: p.now()})
|
||||
if err != nil {
|
||||
p.log.Error("poll_set_available_failed", "service_id", svc.ID, "ref", l.ref, "error", err)
|
||||
return false
|
||||
}
|
||||
stats.wrote = true
|
||||
stats.suggested++
|
||||
return true
|
||||
}
|
||||
|
||||
// autoWanted reports whether an update of svc to ref at digest should be
|
||||
// started automatically: the service is in auto mode, not removed, does not
|
||||
// already run that digest, was not already updated automatically to it
|
||||
// (otherwise a rollback to an older version would be undone at the next
|
||||
// cycle), and its last job did not already deploy it (desired_ref holds the
|
||||
// digest until the agent reports the new inventory).
|
||||
func autoWanted(svc model.Service, ref, digest string) bool {
|
||||
return svc.RemovedAt == nil &&
|
||||
svc.UpdateMode == model.ModeAuto &&
|
||||
svc.ActualDigest != digest &&
|
||||
svc.LastTagDigest != digest &&
|
||||
svc.DesiredRef != ref+"@"+digest
|
||||
}
|
||||
|
||||
// startAuto starts the update job of an auto service to ref and remembers
|
||||
// digest as services.last_tag_digest, so the same digest is not started
|
||||
// again, for instance after the user rolled back. It re-reads the service
|
||||
// first, because a cycle can run for a long time and the user may have
|
||||
// switched the service to manual meanwhile. A service that already has a
|
||||
// job or cannot be updated is not an error for the cycle, and last_tag_digest
|
||||
// is left alone so the next cycle tries again.
|
||||
func (p *Poller) startAuto(ctx context.Context, id int64, ref, digest string, stats *cycleStats) {
|
||||
svc, err := p.store.GetService(ctx, id)
|
||||
if err != nil {
|
||||
p.log.Warn("poll_get_service_failed", "service_id", id, "error", err)
|
||||
return
|
||||
}
|
||||
if !autoWanted(svc, ref, digest) {
|
||||
return
|
||||
}
|
||||
_, err = p.jobs.Start(ctx, svc, jobs.StartRequest{Trigger: model.TriggerPoll, Ref: ref})
|
||||
var notUpdatable *model.NotUpdatableError
|
||||
switch {
|
||||
case err == nil:
|
||||
stats.jobs++
|
||||
if err := p.store.SetLastTagDigest(ctx, id, digest); err != nil {
|
||||
p.log.Error("poll_set_last_tag_digest_failed", "service_id", id, "error", err)
|
||||
}
|
||||
case errors.Is(err, model.ErrJobActive), errors.As(err, ¬Updatable):
|
||||
p.log.Debug("poll_job_not_started", "service_id", id, "ref", ref, "reason", err.Error())
|
||||
default:
|
||||
p.log.Warn("poll_job_failed", "service_id", id, "ref", ref, "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
// setPollError sets msg as last_poll_error on the services for which
|
||||
// changed returns true; with none, it writes nothing.
|
||||
func (p *Poller) setPollError(ctx context.Context, svcs []model.Service, msg string, stats *cycleStats, changed func(model.Service) bool) {
|
||||
var ids []int64
|
||||
for _, svc := range svcs {
|
||||
if changed(svc) {
|
||||
ids = append(ids, svc.ID)
|
||||
}
|
||||
}
|
||||
if len(ids) == 0 {
|
||||
return
|
||||
}
|
||||
if err := p.store.SetPollError(ctx, ids, msg); err != nil {
|
||||
p.log.Error("poll_set_error_failed", "error", err)
|
||||
return
|
||||
}
|
||||
stats.wrote = true
|
||||
}
|
||||
|
||||
// truncate cuts msg to maxErrorBytes without leaving a broken UTF-8
|
||||
// sequence, and drops NUL bytes, which Postgres text cannot hold.
|
||||
func truncate(msg string) string {
|
||||
msg = strings.ReplaceAll(msg, "\x00", "")
|
||||
if len(msg) > maxErrorBytes {
|
||||
msg = strings.ToValidUTF8(msg[:maxErrorBytes], "")
|
||||
}
|
||||
return msg
|
||||
}
|
||||
@@ -0,0 +1,651 @@
|
||||
package poller
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log/slog"
|
||||
"sort"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/events"
|
||||
"github.com/shcizo/package-updater/internal/master/jobs"
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
)
|
||||
|
||||
type availableCall struct {
|
||||
id int64
|
||||
a model.Available
|
||||
}
|
||||
|
||||
type pollErrorCall struct {
|
||||
ids []int64
|
||||
msg string
|
||||
}
|
||||
|
||||
type lastTagCall struct {
|
||||
id int64
|
||||
digest string
|
||||
}
|
||||
|
||||
type fakeStore struct {
|
||||
mu sync.Mutex
|
||||
services []model.Service
|
||||
fresh map[int64]model.Service // what GetService returns instead of the listed row
|
||||
lastTag []lastTagCall
|
||||
listErr error
|
||||
available []availableCall
|
||||
pollErrors []pollErrorCall
|
||||
ctxErrs []error // ctx.Err() seen by every write
|
||||
}
|
||||
|
||||
func (f *fakeStore) ListServices(context.Context) ([]model.Service, error) {
|
||||
return f.services, f.listErr
|
||||
}
|
||||
|
||||
func (f *fakeStore) GetService(_ context.Context, id int64) (model.Service, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
if s, ok := f.fresh[id]; ok {
|
||||
return s, nil
|
||||
}
|
||||
for _, s := range f.services {
|
||||
if s.ID == id {
|
||||
return s, nil
|
||||
}
|
||||
}
|
||||
return model.Service{}, model.ErrNotFound
|
||||
}
|
||||
|
||||
// SetLastTagDigest records the call and, like the database, changes the
|
||||
// row the next cycle lists.
|
||||
func (f *fakeStore) SetLastTagDigest(_ context.Context, id int64, digest string) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.lastTag = append(f.lastTag, lastTagCall{id, digest})
|
||||
for i := range f.services {
|
||||
if f.services[i].ID == id {
|
||||
f.services[i].LastTagDigest = digest
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeStore) SetAvailable(ctx context.Context, id int64, a model.Available) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.ctxErrs = append(f.ctxErrs, ctx.Err())
|
||||
f.available = append(f.available, availableCall{id, a})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeStore) SetPollError(ctx context.Context, ids []int64, msg string) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.ctxErrs = append(f.ctxErrs, ctx.Err())
|
||||
f.pollErrors = append(f.pollErrors, pollErrorCall{ids, msg})
|
||||
return nil
|
||||
}
|
||||
|
||||
type startCall struct {
|
||||
svcID int64
|
||||
req jobs.StartRequest
|
||||
}
|
||||
|
||||
type fakeJobs struct {
|
||||
mu sync.Mutex
|
||||
starts []startCall
|
||||
errFor map[int64]error // by service ID
|
||||
ctxErrs []error
|
||||
}
|
||||
|
||||
func (f *fakeJobs) Start(ctx context.Context, svc model.Service, req jobs.StartRequest) (model.Job, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.ctxErrs = append(f.ctxErrs, ctx.Err())
|
||||
f.starts = append(f.starts, startCall{svc.ID, req})
|
||||
return model.Job{ID: int64(len(f.starts))}, f.errFor[svc.ID]
|
||||
}
|
||||
|
||||
type fakeRegistry struct {
|
||||
mu sync.Mutex
|
||||
digests map[string]string // ref -> digest
|
||||
errs map[string]error // ref -> error
|
||||
calls []string
|
||||
inFlight int
|
||||
maxSeen int
|
||||
delay time.Duration
|
||||
started chan struct{} // receives a value whenever a lookup starts, if set
|
||||
release chan struct{} // lookups wait for it to be closed, if set
|
||||
onResult func() // called after a lookup computed its answer
|
||||
}
|
||||
|
||||
func (f *fakeRegistry) Digest(ctx context.Context, ref string) (string, error) {
|
||||
f.mu.Lock()
|
||||
f.calls = append(f.calls, ref)
|
||||
f.inFlight++
|
||||
if f.inFlight > f.maxSeen {
|
||||
f.maxSeen = f.inFlight
|
||||
}
|
||||
f.mu.Unlock()
|
||||
defer func() {
|
||||
f.mu.Lock()
|
||||
f.inFlight--
|
||||
f.mu.Unlock()
|
||||
}()
|
||||
|
||||
if f.started != nil {
|
||||
f.started <- struct{}{}
|
||||
}
|
||||
if f.release != nil {
|
||||
select {
|
||||
case <-f.release:
|
||||
case <-ctx.Done():
|
||||
return "", ctx.Err()
|
||||
}
|
||||
}
|
||||
if f.delay > 0 {
|
||||
time.Sleep(f.delay)
|
||||
}
|
||||
if f.onResult != nil {
|
||||
f.onResult()
|
||||
}
|
||||
if err := f.errs[ref]; err != nil {
|
||||
return "", err
|
||||
}
|
||||
return f.digests[ref], nil
|
||||
}
|
||||
|
||||
func (f *fakeRegistry) sortedCalls() []string {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
out := append([]string(nil), f.calls...)
|
||||
sort.Strings(out)
|
||||
return out
|
||||
}
|
||||
|
||||
type fakePub struct {
|
||||
mu sync.Mutex
|
||||
topics []events.Topic
|
||||
}
|
||||
|
||||
func (p *fakePub) Publish(t events.Topic) {
|
||||
p.mu.Lock()
|
||||
defer p.mu.Unlock()
|
||||
p.topics = append(p.topics, t)
|
||||
}
|
||||
|
||||
const (
|
||||
repoA = "gitea.shcizo.se/shcizo/slusk"
|
||||
repoB = "gitea/gitea"
|
||||
)
|
||||
|
||||
// svc builds a polled service whose running version has digest sha256:old.
|
||||
func svc(id int64, actualRef string) model.Service {
|
||||
return model.Service{ID: id, Kind: "compose", ActualRef: actualRef, ActualDigest: "sha256:old", UpdateMode: model.ModeManual}
|
||||
}
|
||||
|
||||
func newPoller(st *fakeStore, j *fakeJobs, reg *fakeRegistry, cfg Config) (*Poller, *fakePub) {
|
||||
pub := &fakePub{}
|
||||
if cfg.Workers == 0 {
|
||||
cfg.Workers = 4
|
||||
}
|
||||
p := New(st, j, reg, pub, cfg, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
||||
p.now = func() time.Time { return time.Date(2026, 10, 13, 12, 0, 0, 0, time.UTC) }
|
||||
return p, pub
|
||||
}
|
||||
|
||||
func TestSkipReason(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
svc model.Service
|
||||
want string
|
||||
}{
|
||||
{"tag and digest", model.Service{ActualRef: "r:1", ActualDigest: "sha256:a"}, ""},
|
||||
{"bare image follows latest", model.Service{ActualRef: "r", ActualDigest: "sha256:a"}, ""},
|
||||
{"digest only follows no tag", model.Service{ActualRef: "r@sha256:a", ActualDigest: "sha256:a"}, model.ReasonNoTag},
|
||||
{"built", model.Service{ActualRef: "r:1", ActualDigest: "sha256:a", Built: true}, "built from source"},
|
||||
{"no digest", model.Service{ActualRef: "r:1"}, "no registry digest"},
|
||||
{"self and container are polled", model.Service{ActualRef: "r:1", ActualDigest: "sha256:a", Self: true, Kind: "container"}, ""},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
assert.Equal(t, tt.want, SkipReason(tt.svc))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestOneHeadPerDistinctRef(t *testing.T) {
|
||||
st := &fakeStore{services: []model.Service{
|
||||
svc(1, repoA+":1.4"),
|
||||
svc(2, repoA+":1.4@sha256:old"),
|
||||
svc(3, repoB),
|
||||
svc(4, repoB+":latest"),
|
||||
svc(5, repoB+":1.27"),
|
||||
}}
|
||||
reg := &fakeRegistry{digests: map[string]string{}}
|
||||
p, _ := newPoller(st, &fakeJobs{}, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Equal(t, []string{repoA + ":1.4", repoB + ":1.27", repoB + ":latest"}, reg.sortedCalls())
|
||||
}
|
||||
|
||||
func TestSkipped(t *testing.T) {
|
||||
removed := svc(4, "r:1")
|
||||
removed.RemovedAt = ptr(time.Now())
|
||||
st := &fakeStore{services: []model.Service{
|
||||
{ID: 1, ActualRef: "r@sha256:a", ActualDigest: "sha256:a"},
|
||||
{ID: 2, ActualRef: "r:1", ActualDigest: "sha256:a", Built: true},
|
||||
{ID: 3, ActualRef: "r:1"},
|
||||
removed,
|
||||
}}
|
||||
reg := &fakeRegistry{}
|
||||
j := &fakeJobs{}
|
||||
p, pub := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Empty(t, reg.calls, "no lookups")
|
||||
assert.Empty(t, st.available)
|
||||
assert.Empty(t, st.pollErrors)
|
||||
assert.Empty(t, j.starts)
|
||||
assert.Empty(t, pub.topics)
|
||||
}
|
||||
|
||||
func TestNewDigest(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
tests := []struct {
|
||||
name string
|
||||
mode string
|
||||
wantStart bool
|
||||
}{
|
||||
{"auto gets one poll job to repo:tag", model.ModeAuto, true},
|
||||
{"manual is only marked", model.ModeManual, false},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
s := svc(1, ref+"@sha256:old")
|
||||
s.UpdateMode = tt.mode
|
||||
st := &fakeStore{services: []model.Service{s}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{}
|
||||
p, pub := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
require.Len(t, st.available, 1)
|
||||
assert.Equal(t, int64(1), st.available[0].id)
|
||||
assert.Equal(t, model.Available{Ref: ref, Digest: "sha256:new", Source: model.SourcePoll,
|
||||
At: time.Date(2026, 10, 13, 12, 0, 0, 0, time.UTC)}, st.available[0].a)
|
||||
if tt.wantStart {
|
||||
assert.Equal(t, []startCall{{1, jobs.StartRequest{Trigger: model.TriggerPoll, Ref: ref}}}, j.starts)
|
||||
assert.Equal(t, []lastTagCall{{1, "sha256:new"}}, st.lastTag)
|
||||
} else {
|
||||
assert.Empty(t, j.starts)
|
||||
assert.Empty(t, st.lastTag)
|
||||
}
|
||||
assert.Equal(t, []events.Topic{events.Services}, pub.topics)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSameSuggestionIsIdempotent(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
running := svc(1, ref+"@sha256:old")
|
||||
running.UpdateMode = model.ModeAuto
|
||||
running.ActualDigest = "sha256:new" // already on the registry's digest
|
||||
suggested := svc(2, ref)
|
||||
suggested.UpdateMode = model.ModeAuto
|
||||
suggested.AvailableRef, suggested.AvailableDigest = ref, "sha256:new"
|
||||
suggested.LastTagDigest = "sha256:new" // its job was started in an earlier cycle
|
||||
staleSuggestion := svc(3, ref)
|
||||
staleSuggestion.AvailableRef, staleSuggestion.AvailableDigest = ref, "sha256:older"
|
||||
st := &fakeStore{services: []model.Service{running, suggested, staleSuggestion}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
require.Len(t, st.available, 1, "only the service with an older suggestion is updated")
|
||||
assert.Equal(t, int64(3), st.available[0].id)
|
||||
assert.Empty(t, j.starts, "no new job for an already suggested digest")
|
||||
}
|
||||
|
||||
func TestStartErrorsDoNotAbortCycle(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
var svcs []model.Service
|
||||
for id := int64(1); id <= 3; id++ {
|
||||
s := svc(id, ref)
|
||||
s.UpdateMode = model.ModeAuto
|
||||
svcs = append(svcs, s)
|
||||
}
|
||||
st := &fakeStore{services: svcs}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{errFor: map[int64]error{
|
||||
1: model.ErrJobActive,
|
||||
2: &model.NotUpdatableError{Reason: model.ReasonSelf},
|
||||
3: errors.New("database down"),
|
||||
}}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Len(t, st.available, 3)
|
||||
assert.Len(t, j.starts, 3)
|
||||
assert.Empty(t, st.lastTag, "a job that was not created is retried next cycle")
|
||||
}
|
||||
|
||||
func TestRollbackOfAutoServiceIsNotUndone(t *testing.T) {
|
||||
ref := repoA + ":main"
|
||||
// Updated to sha256:new automatically, then rolled back to sha256:old by hand.
|
||||
s := svc(1, ref+"@sha256:old")
|
||||
s.UpdateMode = model.ModeAuto
|
||||
s.LastTagDigest = "sha256:new"
|
||||
s.DesiredRef = ref + "@sha256:old"
|
||||
st := &fakeStore{services: []model.Service{s}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Empty(t, j.starts, "same registry digest: the rollback stays")
|
||||
assert.Equal(t, "sha256:new", st.available[0].a.Digest, "the newer version is still offered")
|
||||
|
||||
reg.digests[ref] = "sha256:newer"
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Equal(t, []startCall{{1, jobs.StartRequest{Trigger: model.TriggerPoll, Ref: ref}}}, j.starts, "a new digest moves it again")
|
||||
assert.Equal(t, []lastTagCall{{1, "sha256:newer"}}, st.lastTag)
|
||||
}
|
||||
|
||||
func TestActiveJobIsRetriedNextCycle(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
s := svc(1, ref)
|
||||
s.UpdateMode = model.ModeAuto
|
||||
st := &fakeStore{services: []model.Service{s}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{errFor: map[int64]error{1: model.ErrJobActive}}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
require.Len(t, j.starts, 1)
|
||||
assert.Empty(t, st.lastTag)
|
||||
|
||||
j.errFor = nil
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Len(t, j.starts, 2)
|
||||
assert.Equal(t, []lastTagCall{{1, "sha256:new"}}, st.lastTag)
|
||||
|
||||
p.Cycle(context.Background())
|
||||
assert.Len(t, j.starts, 2, "started once the job exists")
|
||||
}
|
||||
|
||||
func TestJobThatAlreadyDeployedTheDigestIsNotStartedAgain(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
// FinishJob set desired_ref; the agent has not reported the new digest yet.
|
||||
s := svc(1, ref+"@sha256:old")
|
||||
s.UpdateMode = model.ModeAuto
|
||||
s.DesiredRef = ref + "@sha256:new"
|
||||
st := &fakeStore{services: []model.Service{s}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Empty(t, j.starts)
|
||||
}
|
||||
|
||||
func TestServiceSwitchedToManualDuringTheCycleIsNotStarted(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
s := svc(1, ref)
|
||||
s.UpdateMode = model.ModeAuto
|
||||
manual := s
|
||||
manual.UpdateMode = model.ModeManual
|
||||
st := &fakeStore{services: []model.Service{s}, fresh: map[int64]model.Service{1: manual}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Len(t, st.available, 1, "still suggested")
|
||||
assert.Empty(t, j.starts)
|
||||
assert.Empty(t, st.lastTag)
|
||||
}
|
||||
|
||||
func TestErrorIsPerRef(t *testing.T) {
|
||||
bad, good := repoA+":1.4", repoB+":1.27"
|
||||
badOld := svc(1, bad)
|
||||
badSame := svc(2, bad)
|
||||
badSame.LastPollError = "head: 401 unauthorized"
|
||||
goodSvc := svc(3, good)
|
||||
st := &fakeStore{services: []model.Service{badOld, badSame, goodSvc}}
|
||||
reg := &fakeRegistry{
|
||||
errs: map[string]error{bad: errors.New("head: 401 unauthorized")},
|
||||
digests: map[string]string{good: "sha256:new"},
|
||||
}
|
||||
p, pub := newPoller(st, &fakeJobs{}, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Equal(t, []pollErrorCall{{[]int64{1}, "head: 401 unauthorized"}}, st.pollErrors,
|
||||
"only the service whose stored error differs is written")
|
||||
require.Len(t, st.available, 1, "the other ref is still processed")
|
||||
assert.Equal(t, int64(3), st.available[0].id)
|
||||
assert.Equal(t, []events.Topic{events.Services}, pub.topics)
|
||||
}
|
||||
|
||||
func TestErrorTextIsTruncated(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
st := &fakeStore{services: []model.Service{svc(1, ref)}}
|
||||
reg := &fakeRegistry{errs: map[string]error{ref: errors.New(strings.Repeat("é", 400) + "\x00")}}
|
||||
p, _ := newPoller(st, &fakeJobs{}, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
require.Len(t, st.pollErrors, 1)
|
||||
msg := st.pollErrors[0].msg
|
||||
assert.LessOrEqual(t, len(msg), maxErrorBytes)
|
||||
assert.Equal(t, strings.Repeat("é", 250), msg, "cut on a character boundary, NUL removed")
|
||||
}
|
||||
|
||||
func TestErrorClearedOnSuccess(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
failing := svc(1, ref)
|
||||
failing.LastPollError = "head: boom"
|
||||
fine := svc(2, ref)
|
||||
failing.ActualDigest, fine.ActualDigest = "sha256:new", "sha256:new"
|
||||
st := &fakeStore{services: []model.Service{failing, fine}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
p, pub := newPoller(st, &fakeJobs{}, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Equal(t, []pollErrorCall{{[]int64{1}, ""}}, st.pollErrors)
|
||||
assert.Empty(t, st.available)
|
||||
assert.Equal(t, []events.Topic{events.Services}, pub.topics)
|
||||
}
|
||||
|
||||
func TestNothingWrittenNothingPublished(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
s := svc(1, ref)
|
||||
s.ActualDigest = "sha256:new"
|
||||
st := &fakeStore{services: []model.Service{s}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
p, pub := newPoller(st, &fakeJobs{}, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Empty(t, st.pollErrors)
|
||||
assert.Empty(t, st.available)
|
||||
assert.Empty(t, pub.topics)
|
||||
}
|
||||
|
||||
func TestListErrorEndsTheCycle(t *testing.T) {
|
||||
st := &fakeStore{listErr: errors.New("db down")}
|
||||
reg := &fakeRegistry{}
|
||||
p, _ := newPoller(st, &fakeJobs{}, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Empty(t, reg.calls)
|
||||
}
|
||||
|
||||
func TestConcurrencyLimit(t *testing.T) {
|
||||
const workers = 3
|
||||
var svcs []model.Service
|
||||
for i := 0; i < 8; i++ {
|
||||
svcs = append(svcs, svc(int64(i+1), fmt.Sprintf("%s%d:1", repoA, i)))
|
||||
}
|
||||
st := &fakeStore{services: svcs}
|
||||
reg := &fakeRegistry{release: make(chan struct{}), started: make(chan struct{}, 8)}
|
||||
p, _ := newPoller(st, &fakeJobs{}, reg, Config{Workers: workers})
|
||||
done := make(chan struct{})
|
||||
go func() { p.Cycle(context.Background()); close(done) }()
|
||||
|
||||
for i := 0; i < workers; i++ {
|
||||
select {
|
||||
case <-reg.started:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatalf("only %d lookups started, want %d", i, workers)
|
||||
}
|
||||
}
|
||||
select {
|
||||
case <-reg.started:
|
||||
t.Fatal("more lookups in flight than Workers")
|
||||
case <-time.After(100 * time.Millisecond):
|
||||
}
|
||||
close(reg.release)
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("Cycle did not finish")
|
||||
}
|
||||
assert.Len(t, reg.calls, 8)
|
||||
}
|
||||
|
||||
func TestCycleStopsOnCancel(t *testing.T) {
|
||||
var svcs []model.Service
|
||||
for i := 0; i < 6; i++ {
|
||||
svcs = append(svcs, svc(int64(i+1), fmt.Sprintf("%s%d:1", repoA, i)))
|
||||
}
|
||||
st := &fakeStore{services: svcs}
|
||||
reg := &fakeRegistry{release: make(chan struct{}), started: make(chan struct{}, 6)}
|
||||
p, pub := newPoller(st, &fakeJobs{}, reg, Config{Workers: 2})
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() { p.Cycle(ctx); close(done) }()
|
||||
<-reg.started
|
||||
<-reg.started
|
||||
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("Cycle did not return after cancel")
|
||||
}
|
||||
assert.Len(t, reg.calls, 2, "no new lookups after cancel")
|
||||
assert.Empty(t, st.pollErrors, "cancelled lookups are not recorded as registry errors")
|
||||
assert.Empty(t, st.available)
|
||||
assert.Empty(t, pub.topics)
|
||||
}
|
||||
|
||||
func TestMarkedJobsAreStartedEvenIfCancelledDuringTheCycle(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
s := svc(1, ref)
|
||||
s.UpdateMode = model.ModeAuto
|
||||
st := &fakeStore{services: []model.Service{s}}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}, onResult: cancel}
|
||||
j := &fakeJobs{}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(ctx)
|
||||
|
||||
require.Len(t, st.available, 1)
|
||||
require.Len(t, j.starts, 1)
|
||||
assert.NoError(t, st.ctxErrs[0], "writes do not see the cancelled context")
|
||||
assert.NoError(t, j.ctxErrs[0])
|
||||
}
|
||||
|
||||
func TestRun(t *testing.T) {
|
||||
ref := repoA + ":1.4"
|
||||
st := &fakeStore{services: []model.Service{svc(1, ref)}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:old"}, delay: 30 * time.Millisecond}
|
||||
p, _ := newPoller(st, &fakeJobs{}, reg, Config{Interval: 5 * time.Millisecond, FirstDelay: 60 * time.Millisecond, Workers: 1})
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
began := time.Now()
|
||||
go func() { p.Run(ctx); close(done) }()
|
||||
|
||||
require.Eventually(t, func() bool {
|
||||
reg.mu.Lock()
|
||||
defer reg.mu.Unlock()
|
||||
return len(reg.calls) >= 3
|
||||
}, 5*time.Second, 5*time.Millisecond)
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("Run did not return after cancel")
|
||||
}
|
||||
assert.GreaterOrEqual(t, time.Since(began), 60*time.Millisecond+2*30*time.Millisecond, "first cycle waits FirstDelay")
|
||||
assert.Equal(t, 1, reg.maxSeen, "cycles never overlap")
|
||||
}
|
||||
|
||||
func TestRunReturnsDuringFirstDelay(t *testing.T) {
|
||||
p, _ := newPoller(&fakeStore{}, &fakeJobs{}, &fakeRegistry{}, Config{Interval: time.Hour, FirstDelay: time.Hour})
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
done := make(chan struct{})
|
||||
go func() { p.Run(ctx); close(done) }()
|
||||
|
||||
cancel()
|
||||
|
||||
select {
|
||||
case <-done:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("Run did not return after cancel")
|
||||
}
|
||||
}
|
||||
|
||||
func ptr[T any](v T) *T { return &v }
|
||||
|
||||
func TestSeedsTheTagDigestOfARunningService(t *testing.T) {
|
||||
ref := repoA + ":main"
|
||||
s := svc(1, ref+"@sha256:new")
|
||||
s.UpdateMode = model.ModeAuto
|
||||
s.ActualDigest = "sha256:new" // updated outside the updater: last_tag_digest is empty
|
||||
st := &fakeStore{services: []model.Service{s}}
|
||||
reg := &fakeRegistry{digests: map[string]string{ref: "sha256:new"}}
|
||||
j := &fakeJobs{}
|
||||
p, _ := newPoller(st, j, reg, Config{})
|
||||
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Equal(t, []lastTagCall{{1, "sha256:new"}}, st.lastTag)
|
||||
assert.Empty(t, j.starts)
|
||||
|
||||
// Rolled back by hand to the older digest.
|
||||
st.services[0].ActualRef, st.services[0].ActualDigest = ref+"@sha256:old", "sha256:old"
|
||||
st.services[0].DesiredRef = ref + "@sha256:old"
|
||||
p.Cycle(context.Background())
|
||||
|
||||
assert.Empty(t, j.starts, "the rollback stays")
|
||||
assert.Len(t, st.lastTag, 1, "nothing more to seed")
|
||||
}
|
||||
@@ -0,0 +1,114 @@
|
||||
// Package registry looks up the digest a tag points at in a container
|
||||
// registry, using HEAD requests only.
|
||||
package registry
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/google/go-containerregistry/pkg/authn"
|
||||
"github.com/google/go-containerregistry/pkg/name"
|
||||
"github.com/google/go-containerregistry/pkg/v1/remote"
|
||||
"github.com/google/go-containerregistry/pkg/v1/remote/transport"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/imageref"
|
||||
)
|
||||
|
||||
// Client looks up tag digests with HEAD requests only. Docker Hub counts a
|
||||
// GET of a manifest as a pull against the rate limit and a HEAD as nothing,
|
||||
// so Client never issues a manifest GET.
|
||||
type Client struct {
|
||||
keychain authn.Keychain
|
||||
userAgent string
|
||||
log *slog.Logger
|
||||
}
|
||||
|
||||
// New returns a Client that finds credentials the way the Docker CLI does:
|
||||
// in $DOCKER_CONFIG/config.json, else ~/.docker/config.json. Registries
|
||||
// without an entry are accessed anonymously. userAgent is added to the
|
||||
// User-Agent header of every request. log receives the full error of a
|
||||
// failed lookup, which Digest itself returns only in a sanitised form.
|
||||
func New(userAgent string, log *slog.Logger) *Client {
|
||||
return &Client{keychain: authn.DefaultKeychain, userAgent: userAgent, log: log}
|
||||
}
|
||||
|
||||
// Digest returns the digest that "repo:tag" points at, as the registry
|
||||
// reports it: for a multi-arch image that is the digest of the index, the
|
||||
// same one `docker inspect` shows in RepoDigests. A digest suffix in ref is
|
||||
// ignored. It sends HEAD /v2/<repo>/manifests/<tag> and nothing else to the
|
||||
// manifest endpoint; it does not fall back to GET when the registry omits
|
||||
// the digest header.
|
||||
func (c *Client) Digest(ctx context.Context, ref string) (string, error) {
|
||||
p := imageref.Parse(ref)
|
||||
if p.Tag == "" {
|
||||
return "", fmt.Errorf("image %q has no tag", ref)
|
||||
}
|
||||
r, err := name.ParseReference(p.Repo + ":" + p.Tag)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("parse %s: %w", ref, err)
|
||||
}
|
||||
// Credentials are resolved here, not by ggcr, so that a broken credential
|
||||
// helper keeps its own message: that text comes from the local config.
|
||||
auth, err := c.keychain.Resolve(r.Context())
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("lookup %s: %w", r, err)
|
||||
}
|
||||
desc, err := remote.Head(r,
|
||||
remote.WithContext(ctx),
|
||||
remote.WithAuth(auth),
|
||||
remote.WithUserAgent(c.userAgent))
|
||||
if err != nil {
|
||||
var terr *transport.Error
|
||||
if errors.As(err, &terr) {
|
||||
return "", fmt.Errorf("lookup %s: %s", r, describe(terr))
|
||||
}
|
||||
c.log.Warn("registry_lookup_failed", "ref", ref, "error", err)
|
||||
return "", fmt.Errorf("lookup %s: %s", r, classify(err))
|
||||
}
|
||||
return desc.Digest.String(), nil
|
||||
}
|
||||
|
||||
// classify returns a fixed text for an error that is not a registry answer.
|
||||
// ggcr copies registry-controlled text (token responses, authentication
|
||||
// challenges, redirect URLs, certificate names) into such errors, so none of
|
||||
// it is passed on.
|
||||
func classify(err error) string {
|
||||
var netErr net.Error
|
||||
var urlErr *url.Error
|
||||
switch {
|
||||
case errors.Is(err, context.DeadlineExceeded), errors.Is(err, context.Canceled):
|
||||
return "timeout"
|
||||
case errors.As(err, &netErr), errors.As(err, &urlErr):
|
||||
return "cannot reach registry"
|
||||
}
|
||||
return "lookup failed"
|
||||
}
|
||||
|
||||
// errorCodePattern matches the registry error codes of the distribution
|
||||
// spec ("MANIFEST_UNKNOWN"). Anything else is dropped from error text.
|
||||
var errorCodePattern = regexp.MustCompile(`^[A-Z_]{1,40}$`)
|
||||
|
||||
// describe returns the HTTP status and the structured error codes of a
|
||||
// registry error, without the messages, details or raw body that ggcr copies
|
||||
// into its error text. The registry host comes from an image name, so
|
||||
// whatever it answers must not end up in the UI.
|
||||
func describe(e *transport.Error) string {
|
||||
msg := fmt.Sprintf("registry answered %d %s", e.StatusCode, http.StatusText(e.StatusCode))
|
||||
var codes []string
|
||||
for _, d := range e.Errors {
|
||||
if errorCodePattern.MatchString(string(d.Code)) {
|
||||
codes = append(codes, string(d.Code))
|
||||
}
|
||||
}
|
||||
if len(codes) > 0 {
|
||||
msg += " (" + strings.Join(codes, ", ") + ")"
|
||||
}
|
||||
return msg
|
||||
}
|
||||
@@ -0,0 +1,336 @@
|
||||
package registry
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"log/slog"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/google/go-containerregistry/pkg/authn"
|
||||
"github.com/google/go-containerregistry/pkg/name"
|
||||
ggcrregistry "github.com/google/go-containerregistry/pkg/registry"
|
||||
"github.com/google/go-containerregistry/pkg/v1/random"
|
||||
"github.com/google/go-containerregistry/pkg/v1/remote"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
var discardLog = slog.New(slog.NewTextHandler(io.Discard, nil))
|
||||
|
||||
func newClient() *Client { return New("test", discardLog) }
|
||||
|
||||
// request is one request the test registry received.
|
||||
type request struct{ method, path string }
|
||||
|
||||
// testRegistry is an in-memory registry that records every request.
|
||||
type testRegistry struct {
|
||||
srv *httptest.Server
|
||||
host string // "127.0.0.1:port", the registry part of a ref
|
||||
|
||||
mu sync.Mutex
|
||||
requests []request
|
||||
}
|
||||
|
||||
// newTestRegistry starts a registry. When user is set every request needs
|
||||
// those basic-auth credentials.
|
||||
func newTestRegistry(t *testing.T, user, pass string) *testRegistry {
|
||||
t.Helper()
|
||||
backend := ggcrregistry.New(ggcrregistry.Logger(log.New(io.Discard, "", 0)))
|
||||
tr := &testRegistry{}
|
||||
tr.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
tr.mu.Lock()
|
||||
tr.requests = append(tr.requests, request{r.Method, r.URL.Path})
|
||||
tr.mu.Unlock()
|
||||
if user != "" {
|
||||
if u, p, ok := r.BasicAuth(); !ok || u != user || p != pass {
|
||||
w.Header().Set("WWW-Authenticate", `Basic realm="test"`)
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
}
|
||||
backend.ServeHTTP(w, r)
|
||||
}))
|
||||
t.Cleanup(tr.srv.Close)
|
||||
tr.host = strings.TrimPrefix(tr.srv.URL, "http://")
|
||||
return tr
|
||||
}
|
||||
|
||||
// pushIndex stores a random multi-arch index as repo:tag and returns its
|
||||
// digest. user and pass are used when the registry requires them.
|
||||
func (tr *testRegistry) pushIndex(t *testing.T, repo, tag string, opts ...remote.Option) string {
|
||||
t.Helper()
|
||||
idx, err := random.Index(64, 1, 2)
|
||||
require.NoError(t, err)
|
||||
ref, err := name.ParseReference(tr.host + "/" + repo + ":" + tag)
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, remote.WriteIndex(ref, idx, opts...))
|
||||
d, err := idx.Digest()
|
||||
require.NoError(t, err)
|
||||
return d.String()
|
||||
}
|
||||
|
||||
// manifestRequests returns the requests that touched a manifest.
|
||||
func (tr *testRegistry) manifestRequests() []request {
|
||||
tr.mu.Lock()
|
||||
defer tr.mu.Unlock()
|
||||
var out []request
|
||||
for _, r := range tr.requests {
|
||||
if strings.Contains(r.path, "/manifests/") {
|
||||
out = append(out, r)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// reset forgets the requests received so far.
|
||||
func (tr *testRegistry) reset() {
|
||||
tr.mu.Lock()
|
||||
defer tr.mu.Unlock()
|
||||
tr.requests = nil
|
||||
}
|
||||
|
||||
// dockerConfig points DOCKER_CONFIG at a fresh directory holding config.json
|
||||
// with the given content; "" leaves the directory empty.
|
||||
func dockerConfig(t *testing.T, configJSON string) {
|
||||
t.Helper()
|
||||
dir := t.TempDir()
|
||||
if configJSON != "" {
|
||||
require.NoError(t, os.WriteFile(filepath.Join(dir, "config.json"), []byte(configJSON), 0o600))
|
||||
}
|
||||
t.Setenv("DOCKER_CONFIG", dir)
|
||||
}
|
||||
|
||||
func TestDigestOfIndexIsIndexDigest(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
reg := newTestRegistry(t, "", "")
|
||||
want := reg.pushIndex(t, "team/app", "1.2")
|
||||
|
||||
got, err := newClient().Digest(context.Background(), reg.host+"/team/app:1.2")
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, want, got)
|
||||
}
|
||||
|
||||
func TestDigestIgnoresDigestSuffix(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
reg := newTestRegistry(t, "", "")
|
||||
want := reg.pushIndex(t, "team/app", "1.2")
|
||||
|
||||
got, err := newClient().Digest(context.Background(), reg.host+"/team/app:1.2@sha256:"+strings.Repeat("0", 64))
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, want, got)
|
||||
}
|
||||
|
||||
func TestDigestUsesHeadOnly(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
reg := newTestRegistry(t, "", "")
|
||||
reg.pushIndex(t, "team/app", "1.2")
|
||||
reg.reset()
|
||||
|
||||
_, err := newClient().Digest(context.Background(), reg.host+"/team/app:1.2")
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, []request{{http.MethodHead, "/v2/team/app/manifests/1.2"}}, reg.manifestRequests())
|
||||
for _, r := range reg.requests {
|
||||
if !strings.Contains(r.path, "/manifests/") {
|
||||
assert.Equal(t, request{http.MethodGet, "/v2/"}, r, "the only other request is the API ping")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDigestSendsUserAgent(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
var ua string
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
ua = r.Header.Get("User-Agent")
|
||||
w.WriteHeader(http.StatusNotFound)
|
||||
}))
|
||||
t.Cleanup(srv.Close)
|
||||
|
||||
_, _ = New("package-updater-test/1", discardLog).Digest(context.Background(), strings.TrimPrefix(srv.URL, "http://")+"/a/b:1")
|
||||
|
||||
assert.Contains(t, ua, "package-updater-test/1")
|
||||
}
|
||||
|
||||
func TestCredentialsFromDockerConfig(t *testing.T) {
|
||||
reg := newTestRegistry(t, "bot", "s3cret")
|
||||
want := reg.pushIndex(t, "team/app", "1.2", remote.WithAuth(&authn.Basic{Username: "bot", Password: "s3cret"}))
|
||||
auth := base64.StdEncoding.EncodeToString([]byte("bot:s3cret"))
|
||||
dockerConfig(t, `{"auths":{"`+reg.host+`":{"auth":"`+auth+`"}}}`)
|
||||
|
||||
got, err := newClient().Digest(context.Background(), reg.host+"/team/app:1.2")
|
||||
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, want, got)
|
||||
}
|
||||
|
||||
func TestWrongCredentialsFail(t *testing.T) {
|
||||
reg := newTestRegistry(t, "bot", "s3cret")
|
||||
reg.pushIndex(t, "team/app", "1.2", remote.WithAuth(&authn.Basic{Username: "bot", Password: "s3cret"}))
|
||||
auth := base64.StdEncoding.EncodeToString([]byte("bot:wrong"))
|
||||
dockerConfig(t, `{"auths":{"`+reg.host+`":{"auth":"`+auth+`"}}}`)
|
||||
|
||||
_, err := newClient().Digest(context.Background(), reg.host+"/team/app:1.2")
|
||||
|
||||
require.Error(t, err)
|
||||
assert.NotContains(t, err.Error(), "wrong", "credentials do not leak into errors")
|
||||
assert.NotContains(t, err.Error(), auth)
|
||||
}
|
||||
|
||||
func TestAnonymousWithoutConfig(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
open := newTestRegistry(t, "", "")
|
||||
want := open.pushIndex(t, "team/app", "1.2")
|
||||
protected := newTestRegistry(t, "bot", "s3cret")
|
||||
|
||||
got, err := newClient().Digest(context.Background(), open.host+"/team/app:1.2")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, want, got, "anonymous access works without a config file")
|
||||
|
||||
_, err = newClient().Digest(context.Background(), protected.host+"/team/app:1.2")
|
||||
assert.Error(t, err, "a registry that needs credentials fails without them")
|
||||
}
|
||||
|
||||
func TestUnknownTagIsAnError(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
reg := newTestRegistry(t, "", "")
|
||||
reg.pushIndex(t, "team/app", "1.2")
|
||||
|
||||
_, err := newClient().Digest(context.Background(), reg.host+"/team/app:nope")
|
||||
|
||||
assert.Error(t, err)
|
||||
}
|
||||
|
||||
func TestRefWithoutTagIsAnError(t *testing.T) {
|
||||
_, err := newClient().Digest(context.Background(), "team/app@sha256:"+strings.Repeat("a", 64))
|
||||
|
||||
assert.ErrorContains(t, err, "has no tag")
|
||||
}
|
||||
|
||||
// A config.json whose credsStore names a helper that is not installed makes
|
||||
// the lookup fail for every registry, including ones that would work
|
||||
// anonymously. The master container has no credential helpers, so only
|
||||
// inline "auths" entries are supported there.
|
||||
func TestCredsStoreWithoutHelperFailsTheLookup(t *testing.T) {
|
||||
reg := newTestRegistry(t, "", "")
|
||||
reg.pushIndex(t, "team/app", "1.2")
|
||||
dockerConfig(t, `{"credsStore":"no-such-helper-for-package-updater-tests"}`)
|
||||
|
||||
_, err := newClient().Digest(context.Background(), reg.host+"/team/app:1.2")
|
||||
|
||||
assert.ErrorContains(t, err, "error getting credentials")
|
||||
assert.ErrorContains(t, err, "docker-credential-no-such-helper-for-package-updater-tests")
|
||||
}
|
||||
|
||||
// A registry that leaves out Docker-Content-Digest must not make the client
|
||||
// retry with a manifest download, which Docker Hub counts as a pull.
|
||||
func TestMissingDigestHeaderDoesNotFallBackToDownload(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
var mu sync.Mutex
|
||||
var methods []string
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if !strings.Contains(r.URL.Path, "/manifests/") {
|
||||
return
|
||||
}
|
||||
mu.Lock()
|
||||
methods = append(methods, r.Method)
|
||||
mu.Unlock()
|
||||
w.Header().Set("Content-Type", "application/vnd.oci.image.index.v1+json")
|
||||
w.Header().Set("Content-Length", "10")
|
||||
}))
|
||||
t.Cleanup(srv.Close)
|
||||
|
||||
_, err := newClient().Digest(context.Background(), strings.TrimPrefix(srv.URL, "http://")+"/a/b:1")
|
||||
|
||||
assert.Error(t, err)
|
||||
assert.Equal(t, []string{http.MethodHead}, methods)
|
||||
}
|
||||
|
||||
// ggcr copies up to 64 KiB of the registry's response into its errors. The
|
||||
// registry host comes from an image name, so that text must not reach the
|
||||
// stored poll error.
|
||||
func TestRegistryErrorBodyDoesNotLeak(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
tests := []struct {
|
||||
name string
|
||||
body string
|
||||
want string
|
||||
}{
|
||||
{"raw body", "internal-secret-body", "registry answered 400 Bad Request"},
|
||||
{"structured errors", `{"errors":[{"code":"MANIFEST_UNKNOWN","message":"internal-secret-body","detail":"internal-secret-body"},{"code":"internal-secret-body"}]}`,
|
||||
"registry answered 400 Bad Request (MANIFEST_UNKNOWN)"},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
// HEAD answers carry no body, so the leak is in the GET /v2/ ping.
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
_, _ = w.Write([]byte(tt.body))
|
||||
}))
|
||||
t.Cleanup(srv.Close)
|
||||
host := strings.TrimPrefix(srv.URL, "http://")
|
||||
|
||||
_, err := newClient().Digest(context.Background(), host+"/a/b:1")
|
||||
|
||||
require.Error(t, err)
|
||||
assert.NotContains(t, err.Error(), "internal-secret-body")
|
||||
assert.Equal(t, "lookup "+host+"/a/b:1: "+tt.want, strings.Replace(err.Error(), "index.docker.io/", "", 1))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// ggcr puts the token server's answer into its error when the answer has no
|
||||
// token, and the token server is named by the registry's challenge.
|
||||
func TestNonRegistryErrorsAreFixedText(t *testing.T) {
|
||||
dockerConfig(t, "")
|
||||
tokenSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
_, _ = w.Write([]byte(`{"detail":"internal-secret-body"}`))
|
||||
}))
|
||||
t.Cleanup(tokenSrv.Close)
|
||||
reg := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("WWW-Authenticate", `Bearer realm="`+tokenSrv.URL+`/internal-secret-realm",service="internal-secret-service"`)
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
}))
|
||||
t.Cleanup(reg.Close)
|
||||
host := strings.TrimPrefix(reg.URL, "http://")
|
||||
|
||||
_, err := newClient().Digest(context.Background(), host+"/a/b:1")
|
||||
|
||||
require.Error(t, err)
|
||||
assert.NotContains(t, err.Error(), "internal-secret")
|
||||
assert.Equal(t, "lookup "+host+"/a/b:1: lookup failed", err.Error())
|
||||
}
|
||||
|
||||
func TestClassify(t *testing.T) {
|
||||
refused := &url.Error{Op: "Get", URL: "http://internal-secret-host/v2/", Err: errors.New("connection refused")}
|
||||
tests := []struct {
|
||||
name string
|
||||
err error
|
||||
want string
|
||||
}{
|
||||
{"deadline", fmt.Errorf("x: %w", context.DeadlineExceeded), "timeout"},
|
||||
{"canceled", context.Canceled, "timeout"},
|
||||
{"url error", refused, "cannot reach registry"},
|
||||
{"net error", &net.DNSError{Name: "internal-secret-host"}, "cannot reach registry"},
|
||||
{"deadline inside url error", &url.Error{Op: "Get", URL: "http://x", Err: context.DeadlineExceeded}, "timeout"},
|
||||
{"anything else", errors.New("internal-secret"), "lookup failed"},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
assert.Equal(t, tt.want, classify(tt.err))
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -13,11 +13,11 @@ import (
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
const agentColumns = `id, name, hostname, agent_version, swarm_manager, last_seen_at, revoked_at, created_at`
|
||||
const agentColumns = `id, name, hostname, agent_version, swarm_manager, swarm_cluster_id, last_seen_at, revoked_at, created_at`
|
||||
|
||||
func scanAgent(row pgx.Row) (model.Agent, error) {
|
||||
var a model.Agent
|
||||
err := row.Scan(&a.ID, &a.Name, &a.Hostname, &a.AgentVersion, &a.SwarmManager, &a.LastSeenAt, &a.RevokedAt, &a.CreatedAt)
|
||||
err := row.Scan(&a.ID, &a.Name, &a.Hostname, &a.AgentVersion, &a.SwarmManager, &a.SwarmClusterID, &a.LastSeenAt, &a.RevokedAt, &a.CreatedAt)
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return model.Agent{}, model.ErrNotFound
|
||||
}
|
||||
@@ -101,8 +101,8 @@ func (s *Store) RevokeAgent(ctx context.Context, id int64, at time.Time) ([]int6
|
||||
// RecordHello stores what the agent reported about itself on connect.
|
||||
func (s *Store) RecordHello(ctx context.Context, id int64, h protocol.Hello, at time.Time) error {
|
||||
if _, err := s.pool.Exec(ctx,
|
||||
`UPDATE agents SET hostname = $2, agent_version = $3, swarm_manager = $4, last_seen_at = $5 WHERE id = $1`,
|
||||
id, h.Hostname, h.AgentVersion, h.SwarmManager, at); err != nil {
|
||||
`UPDATE agents SET hostname = $2, agent_version = $3, swarm_manager = $4, swarm_cluster_id = $6, last_seen_at = $5 WHERE id = $1`,
|
||||
id, h.Hostname, h.AgentVersion, h.SwarmManager, at, h.SwarmClusterID); err != nil {
|
||||
return fmt.Errorf("record hello: %w", err)
|
||||
}
|
||||
return nil
|
||||
|
||||
@@ -80,6 +80,7 @@ func TestAgents_RecordHelloAndMarkSeen(t *testing.T) {
|
||||
assert.Equal(t, "swarm-mgr", agents[0].Hostname)
|
||||
assert.Equal(t, "v1", agents[0].AgentVersion)
|
||||
assert.True(t, agents[0].SwarmManager)
|
||||
assert.Equal(t, "c1", agents[0].SwarmClusterID)
|
||||
require.NotNil(t, agents[0].LastSeenAt)
|
||||
assert.True(t, agents[0].LastSeenAt.Equal(at.Add(time.Minute)))
|
||||
}
|
||||
|
||||
@@ -189,9 +189,11 @@ func (s *Store) JobProgress(ctx context.Context, agentID, jobID int64, chunk str
|
||||
// started_at (the agent's, or the existing one if the agent sent none),
|
||||
// finished_at; to_ref = f.Ref when set. On success it also sets the
|
||||
// service's desired_ref = f.Ref and clears its available ref when that is
|
||||
// the ref the job was created for (ignoring any @digest) and was reported no
|
||||
// later than the job was created (that version is now running), in the same
|
||||
// transaction. Returns false if no
|
||||
// the ref the job was created for and was reported no later than the job was
|
||||
// created (that version is now running), in the same transaction. A job
|
||||
// created for "repo:tag@digest" clears only a suggestion with that same
|
||||
// digest, so rolling back to an older digest keeps a newer suggestion (and a
|
||||
// suggestion without a digest, such as a webhook's). Returns false if no
|
||||
// such active job belongs to agentID.
|
||||
func (s *Store) FinishJob(ctx context.Context, agentID, jobID int64, f model.JobFinish) (bool, error) {
|
||||
tx, err := s.pool.Begin(ctx)
|
||||
@@ -226,13 +228,21 @@ func (s *Store) FinishJob(ctx context.Context, agentID, jobID int64, f model.Job
|
||||
return false, fmt.Errorf("finish job: %w", err)
|
||||
}
|
||||
if f.Status == model.JobSucceeded {
|
||||
requestedRef, _, _ = strings.Cut(requestedRef, "@")
|
||||
requestedRef, requestedDigest, _ := strings.Cut(requestedRef, "@")
|
||||
// A plain tag job, whoever started it, deployed the tag at the digest
|
||||
// the agent pinned; remember it. Pinned and tagless picks do not.
|
||||
tagDigest := ""
|
||||
if _, d, _ := strings.Cut(f.Ref, "@"); requestedDigest == "" && digestPattern.MatchString(d) {
|
||||
tagDigest = d
|
||||
}
|
||||
if _, err := tx.Exec(ctx, `
|
||||
UPDATE services SET desired_ref = $2,
|
||||
available_ref = CASE WHEN available_ref = $4 AND available_at <= $3 THEN '' ELSE available_ref END,
|
||||
available_source = CASE WHEN available_ref = $4 AND available_at <= $3 THEN '' ELSE available_source END,
|
||||
available_at = CASE WHEN available_ref = $4 AND available_at <= $3 THEN NULL ELSE available_at END
|
||||
WHERE id = $1`, serviceID, f.Ref, createdAt, requestedRef); err != nil {
|
||||
last_tag_digest = CASE WHEN $6 <> '' THEN $6 ELSE last_tag_digest END,
|
||||
available_ref = CASE WHEN available_ref = $4 AND available_at <= $3 AND ($5 = '' OR available_digest = $5) THEN '' ELSE available_ref END,
|
||||
available_digest = CASE WHEN available_ref = $4 AND available_at <= $3 AND ($5 = '' OR available_digest = $5) THEN '' ELSE available_digest END,
|
||||
available_source = CASE WHEN available_ref = $4 AND available_at <= $3 AND ($5 = '' OR available_digest = $5) THEN '' ELSE available_source END,
|
||||
available_at = CASE WHEN available_ref = $4 AND available_at <= $3 AND ($5 = '' OR available_digest = $5) THEN NULL ELSE available_at END
|
||||
WHERE id = $1`, serviceID, f.Ref, createdAt, requestedRef, requestedDigest, tagDigest); err != nil {
|
||||
return false, fmt.Errorf("finish job: desired ref: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
ALTER TABLE services DROP CONSTRAINT services_available_source_check;
|
||||
ALTER TABLE services ADD CONSTRAINT services_available_source_check
|
||||
CHECK (available_source IN ('', 'webhook', 'poll'));
|
||||
ALTER TABLE services ADD COLUMN available_digest text NOT NULL DEFAULT '';
|
||||
ALTER TABLE services ADD COLUMN last_poll_error text NOT NULL DEFAULT '';
|
||||
ALTER TABLE services ADD COLUMN last_tag_digest text NOT NULL DEFAULT '';
|
||||
|
||||
-- Every version the master has seen. '' means "no tag" / "digest unknown";
|
||||
-- never NULL, so the unique constraint deduplicates.
|
||||
CREATE TABLE image_versions (
|
||||
id bigserial PRIMARY KEY,
|
||||
repo text NOT NULL,
|
||||
tag text NOT NULL DEFAULT '',
|
||||
digest text NOT NULL DEFAULT '',
|
||||
source text NOT NULL CHECK (source IN ('webhook', 'poll', 'running')),
|
||||
first_seen_at timestamptz NOT NULL,
|
||||
CONSTRAINT image_versions_tag_or_digest CHECK (tag <> '' OR digest <> ''),
|
||||
CONSTRAINT image_versions_unique UNIQUE (repo, tag, digest)
|
||||
);
|
||||
CREATE INDEX image_versions_recent ON image_versions (repo, first_seen_at DESC, id DESC);
|
||||
@@ -0,0 +1 @@
|
||||
ALTER TABLE agents ADD COLUMN swarm_cluster_id text NOT NULL DEFAULT '';
|
||||
@@ -4,6 +4,7 @@ import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"time"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
@@ -56,7 +57,11 @@ ON CONFLICT (location_key) DO UPDATE SET
|
||||
updated_at = EXCLUDED.updated_at,
|
||||
removed_at = NULL`
|
||||
|
||||
// digestPattern is the form of a digest worth recording as a version.
|
||||
var digestPattern = regexp.MustCompile(`^sha256:[0-9a-f]{64}$`)
|
||||
|
||||
func upsertService(ctx context.Context, db execer, agentID int64, clusterID string, svc protocol.Service, at time.Time) error {
|
||||
image := imageref.Parse(svc.Image)
|
||||
clusterCol := ""
|
||||
if svc.Kind == protocol.KindSwarm {
|
||||
clusterCol = clusterID
|
||||
@@ -65,11 +70,34 @@ func upsertService(ctx context.Context, db execer, agentID int64, clusterID stri
|
||||
string(svc.Kind), model.LocationKey(agentID, clusterID, svc.Key()), agentID,
|
||||
svc.ComposeProject, svc.ComposeService, svc.WorkingDir, svc.ConfigFiles, svc.Built,
|
||||
clusterCol, svc.SwarmService, svc.ContainerName,
|
||||
imageref.Parse(svc.Image).Repo, svc.Image, svc.Digest,
|
||||
image.Repo, svc.Image, svc.Digest,
|
||||
svc.Status, svc.Self, at)
|
||||
if err != nil {
|
||||
return fmt.Errorf("upsert service %s: %w", svc.Key(), err)
|
||||
}
|
||||
if digestPattern.MatchString(svc.Digest) {
|
||||
// A bare image runs "latest", as jobs.FollowedRef sees it, so it
|
||||
// shares its row with the polled one. repo@digest has no tag.
|
||||
if image.Tag == "" && image.Digest == "" {
|
||||
image.Tag = "latest"
|
||||
}
|
||||
if err := insertVersion(ctx, db, image.Repo, image.Tag, svc.Digest, model.SourceRunning, at); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// insertVersion records a version in image_versions unless the same
|
||||
// (repo, tag, digest) is already there; the first sighting keeps its source
|
||||
// and first_seen_at.
|
||||
func insertVersion(ctx context.Context, db execer, repo, tag, digest, source string, at time.Time) error {
|
||||
if _, err := db.Exec(ctx, `
|
||||
INSERT INTO image_versions (repo, tag, digest, source, first_seen_at)
|
||||
VALUES ($1, $2, $3, $4, $5) ON CONFLICT DO NOTHING`,
|
||||
repo, tag, digest, source, at); err != nil {
|
||||
return fmt.Errorf("record version %s: %w", imageref.Ref{Repo: repo, Tag: tag, Digest: digest}, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -149,8 +177,8 @@ func (s *Store) RemoveService(ctx context.Context, agentID int64, clusterID, age
|
||||
const serviceColumns = `s.id, s.kind, s.location_key, s.agent_id, COALESCE(a.name, ''),
|
||||
s.compose_project, s.compose_service, s.working_dir, s.config_files, s.built, s.swarm_cluster_id,
|
||||
s.swarm_service, s.container_name, s.image_repo, s.desired_ref, s.actual_ref, s.actual_digest,
|
||||
s.status, s.self, s.update_mode, s.available_ref, s.available_source, s.available_at,
|
||||
s.first_seen_at, s.updated_at, s.removed_at`
|
||||
s.status, s.self, s.update_mode, s.available_ref, s.available_digest, s.available_source, s.available_at,
|
||||
s.last_poll_error, s.last_tag_digest, s.first_seen_at, s.updated_at, s.removed_at`
|
||||
|
||||
func scanService(row pgx.Row) (model.Service, error) {
|
||||
var m model.Service
|
||||
@@ -158,8 +186,8 @@ func scanService(row pgx.Row) (model.Service, error) {
|
||||
err := row.Scan(&m.ID, &kind, &m.LocationKey, &m.AgentID, &m.AgentName,
|
||||
&m.ComposeProject, &m.ComposeService, &m.WorkingDir, &m.ConfigFiles, &m.Built, &m.SwarmClusterID,
|
||||
&m.SwarmService, &m.ContainerName, &m.ImageRepo, &m.DesiredRef, &m.ActualRef, &m.ActualDigest,
|
||||
&m.Status, &m.Self, &m.UpdateMode, &m.AvailableRef, &m.AvailableSource, &m.AvailableAt,
|
||||
&m.FirstSeenAt, &m.UpdatedAt, &m.RemovedAt)
|
||||
&m.Status, &m.Self, &m.UpdateMode, &m.AvailableRef, &m.AvailableDigest, &m.AvailableSource, &m.AvailableAt,
|
||||
&m.LastPollError, &m.LastTagDigest, &m.FirstSeenAt, &m.UpdatedAt, &m.RemovedAt)
|
||||
m.Kind = protocol.Kind(kind)
|
||||
return m, err
|
||||
}
|
||||
@@ -198,16 +226,96 @@ func (s *Store) queryServices(ctx context.Context, what, extraWhere string, args
|
||||
}
|
||||
|
||||
// SetAvailable records a newer ref for the service, replacing any earlier
|
||||
// suggestion.
|
||||
// suggestion, and records the version in image_versions in the same
|
||||
// transaction (the tag is parsed from a.Ref).
|
||||
func (s *Store) SetAvailable(ctx context.Context, id int64, a model.Available) error {
|
||||
if _, err := s.pool.Exec(ctx, `
|
||||
UPDATE services SET available_ref = $2, available_source = $3, available_at = $4
|
||||
WHERE id = $1`, id, a.Ref, a.Source, a.At); err != nil {
|
||||
tx, err := s.pool.Begin(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("set available: begin: %w", err)
|
||||
}
|
||||
defer func() { _ = tx.Rollback(ctx) }()
|
||||
if _, err := tx.Exec(ctx, `
|
||||
UPDATE services SET available_ref = $2, available_digest = $3, available_source = $4, available_at = $5
|
||||
WHERE id = $1`, id, a.Ref, a.Digest, a.Source, a.At); err != nil {
|
||||
return fmt.Errorf("set available: %w", err)
|
||||
}
|
||||
ref := imageref.Parse(a.Ref)
|
||||
if err := insertVersion(ctx, tx, ref.Repo, ref.Tag, a.Digest, a.Source, a.At); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := tx.Commit(ctx); err != nil {
|
||||
return fmt.Errorf("set available: commit: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// SetPollError sets last_poll_error on the given services; msg "" clears it.
|
||||
func (s *Store) SetPollError(ctx context.Context, ids []int64, msg string) error {
|
||||
if len(ids) == 0 {
|
||||
return nil
|
||||
}
|
||||
if _, err := s.pool.Exec(ctx,
|
||||
`UPDATE services SET last_poll_error = $2 WHERE id = ANY($1)`, ids, msg); err != nil {
|
||||
return fmt.Errorf("set poll error: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// SetLastTagDigest sets last_tag_digest; see model.Service.LastTagDigest. The
|
||||
// poller calls it, and FinishJob sets the same column after a tag job.
|
||||
// Inventory writes never change it.
|
||||
func (s *Store) SetLastTagDigest(ctx context.Context, id int64, digest string) error {
|
||||
if _, err := s.pool.Exec(ctx,
|
||||
`UPDATE services SET last_tag_digest = $2 WHERE id = $1`, id, digest); err != nil {
|
||||
return fmt.Errorf("set last tag digest: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RecentVersions returns up to limit versions of repo, most recently first
|
||||
// seen first. A version without a digest is left out when a version with the
|
||||
// same tag and a digest was first seen at or after it.
|
||||
func (s *Store) RecentVersions(ctx context.Context, repo string, limit int) ([]model.ImageVersion, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT id, repo, tag, digest, source, first_seen_at FROM image_versions v
|
||||
WHERE v.repo = $1
|
||||
AND NOT (v.digest = '' AND EXISTS (
|
||||
SELECT 1 FROM image_versions d
|
||||
WHERE d.repo = v.repo AND d.tag = v.tag AND d.digest <> ''
|
||||
AND d.first_seen_at >= v.first_seen_at))
|
||||
ORDER BY v.first_seen_at DESC, v.id DESC
|
||||
LIMIT $2`, repo, limit)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("recent versions: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []model.ImageVersion
|
||||
for rows.Next() {
|
||||
var v model.ImageVersion
|
||||
if err := rows.Scan(&v.ID, &v.Repo, &v.Tag, &v.Digest, &v.Source, &v.FirstSeenAt); err != nil {
|
||||
return nil, fmt.Errorf("scan version: %w", err)
|
||||
}
|
||||
out = append(out, v)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// GetImageVersion returns one version. Returns model.ErrNotFound if the ID
|
||||
// does not exist.
|
||||
func (s *Store) GetImageVersion(ctx context.Context, id int64) (model.ImageVersion, error) {
|
||||
var v model.ImageVersion
|
||||
err := s.pool.QueryRow(ctx, `
|
||||
SELECT id, repo, tag, digest, source, first_seen_at FROM image_versions WHERE id = $1`, id,
|
||||
).Scan(&v.ID, &v.Repo, &v.Tag, &v.Digest, &v.Source, &v.FirstSeenAt)
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return model.ImageVersion{}, model.ErrNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return model.ImageVersion{}, fmt.Errorf("get image version: %w", err)
|
||||
}
|
||||
return v, nil
|
||||
}
|
||||
|
||||
// SetUpdateMode sets the service's update mode (model.ModeManual or
|
||||
// model.ModeAuto). Returns model.ErrNotFound if the service does not exist
|
||||
// or is marked removed.
|
||||
|
||||
@@ -17,9 +17,9 @@ import (
|
||||
|
||||
var (
|
||||
t0 = time.Date(2026, 10, 12, 12, 0, 0, 0, time.UTC)
|
||||
slusk = protocol.Service{Kind: protocol.KindCompose, ComposeProject: "slusk", ComposeService: "web", WorkingDir: "/srv/slusk", Image: "gitea.shcizo.se/shcizo/slusk:1.4.2", Digest: "sha256:d1", Status: "running"}
|
||||
slusk = protocol.Service{Kind: protocol.KindCompose, ComposeProject: "slusk", ComposeService: "web", WorkingDir: "/srv/slusk", Image: "gitea.shcizo.se/shcizo/slusk:1.4.2", Digest: digD1, Status: "running"}
|
||||
adhoc = protocol.Service{Kind: protocol.KindContainer, ContainerName: "adhoc", Image: "redis:alpine", Status: "stopped"}
|
||||
gitea = protocol.Service{Kind: protocol.KindSwarm, SwarmService: "gitea_gitea", Image: "gitea/gitea:1.27.3@sha256:87a6", Digest: "sha256:87a6", Status: "running"}
|
||||
gitea = protocol.Service{Kind: protocol.KindSwarm, SwarmService: "gitea_gitea", Image: "gitea/gitea:1.27.3@sha256:87a6", Digest: digGitea, Status: "running"}
|
||||
worker = protocol.Hello{Hostname: "node-2"}
|
||||
manager = protocol.Hello{Hostname: "swarm-mgr", SwarmManager: true, SwarmClusterID: "c1"}
|
||||
)
|
||||
@@ -53,7 +53,7 @@ func TestApplySnapshot_InsertsAsManualWithAgentName(t *testing.T) {
|
||||
assert.Equal(t, "node-2", got[0].AgentName)
|
||||
assert.Equal(t, "gitea.shcizo.se/shcizo/slusk", got[0].ImageRepo)
|
||||
assert.Equal(t, "gitea.shcizo.se/shcizo/slusk:1.4.2", got[0].ActualRef)
|
||||
assert.Equal(t, "sha256:d1", got[0].ActualDigest)
|
||||
assert.Equal(t, digD1, got[0].ActualDigest)
|
||||
assert.Equal(t, "compose|"+itoa(id)+"|slusk|web", got[0].LocationKey)
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,216 @@
|
||||
//go:build integration
|
||||
|
||||
package store
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
const sluskRepo = "gitea.shcizo.se/shcizo/slusk"
|
||||
|
||||
// Digests of the fixture services; only well-formed ones are recorded as versions.
|
||||
var (
|
||||
digD1 = "sha256:" + strings.Repeat("d", 63) + "1"
|
||||
digGitea = "sha256:" + strings.Repeat("a", 63) + "1"
|
||||
digPg = "sha256:" + strings.Repeat("b", 63) + "1"
|
||||
)
|
||||
|
||||
func versionsOf(t *testing.T, s *Store, repo string) []model.ImageVersion {
|
||||
t.Helper()
|
||||
got, err := s.RecentVersions(context.Background(), repo, 100)
|
||||
require.NoError(t, err)
|
||||
return got
|
||||
}
|
||||
|
||||
func TestSetAvailable_RecordsVersion(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
ctx := context.Background()
|
||||
_, svc := jobFixture(t, s, "a")
|
||||
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: sluskRepo + ":1.5.0", Digest: "sha256:n1", Source: model.SourcePoll, At: t0}))
|
||||
|
||||
got, err := s.GetService(ctx, svc)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, sluskRepo+":1.5.0", got.AvailableRef)
|
||||
assert.Equal(t, "sha256:n1", got.AvailableDigest)
|
||||
assert.Equal(t, model.SourcePoll, got.AvailableSource)
|
||||
vs := versionsOf(t, s, sluskRepo)
|
||||
var found model.ImageVersion
|
||||
for _, v := range vs {
|
||||
if v.Digest == "sha256:n1" {
|
||||
found = v
|
||||
}
|
||||
}
|
||||
require.NotZero(t, found.ID)
|
||||
assert.Equal(t, "1.5.0", found.Tag)
|
||||
assert.Equal(t, model.SourcePoll, found.Source)
|
||||
|
||||
// Seeing the same version again keeps the first sighting.
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: sluskRepo + ":1.5.0", Digest: "sha256:n1", Source: model.SourceWebhook, At: t0.Add(time.Hour)}))
|
||||
again, err := s.GetImageVersion(ctx, found.ID)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, model.SourcePoll, again.Source)
|
||||
assert.True(t, t0.Equal(again.FirstSeenAt))
|
||||
assert.Len(t, versionsOf(t, s, sluskRepo), len(vs))
|
||||
}
|
||||
|
||||
func TestSnapshotRecordsRunningVersions(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
ctx := context.Background()
|
||||
id := newAgent(t, s, "node-2")
|
||||
tagless := protocol.Service{Kind: protocol.KindSwarm, SwarmService: "g_g", Image: "gitea/gitea@" + digGitea, Digest: digGitea, Status: "running"}
|
||||
bare := protocol.Service{Kind: protocol.KindContainer, ContainerName: "pg", Image: "postgres", Digest: digPg, Status: "running"}
|
||||
nodigest := protocol.Service{Kind: protocol.KindContainer, ContainerName: "nd", Image: "nodigest:1", Status: "running"}
|
||||
hello := protocol.Hello{Hostname: "node-2", SwarmManager: true, SwarmClusterID: "c1"}
|
||||
svcs := []protocol.Service{slusk, tagless, bare, nodigest}
|
||||
|
||||
require.NoError(t, s.ApplySnapshot(ctx, id, hello, svcs, t0))
|
||||
require.NoError(t, s.ApplySnapshot(ctx, id, hello, svcs, t0.Add(time.Hour)))
|
||||
|
||||
got := versionsOf(t, s, sluskRepo)
|
||||
require.Len(t, got, 1)
|
||||
assert.Equal(t, "1.4.2", got[0].Tag)
|
||||
assert.Equal(t, digD1, got[0].Digest)
|
||||
assert.Equal(t, model.SourceRunning, got[0].Source)
|
||||
assert.True(t, t0.Equal(got[0].FirstSeenAt), "re-snapshot does not bump first_seen_at")
|
||||
tl := versionsOf(t, s, "gitea/gitea")
|
||||
require.Len(t, tl, 1)
|
||||
assert.Equal(t, "", tl[0].Tag)
|
||||
assert.Equal(t, digGitea, tl[0].Digest)
|
||||
b := versionsOf(t, s, "postgres")
|
||||
require.Len(t, b, 1)
|
||||
assert.Equal(t, "latest", b[0].Tag, "a bare image runs latest, like the followed ref")
|
||||
assert.Empty(t, versionsOf(t, s, "nodigest"))
|
||||
}
|
||||
|
||||
func TestSnapshotRecordsOnlyWellFormedDigests(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
id := newAgent(t, s, "node-2")
|
||||
bad := protocol.Service{Kind: protocol.KindContainer, ContainerName: "bad", Image: "bad:1", Digest: "sha256:short", Status: "running"}
|
||||
upper := protocol.Service{Kind: protocol.KindContainer, ContainerName: "up", Image: "up:1", Digest: "sha256:" + strings.Repeat("A", 64), Status: "running"}
|
||||
|
||||
require.NoError(t, s.ApplySnapshot(context.Background(), id, protocol.Hello{Hostname: "node-2"}, []protocol.Service{bad, upper}, t0))
|
||||
|
||||
assert.Empty(t, versionsOf(t, s, "bad"))
|
||||
assert.Empty(t, versionsOf(t, s, "up"))
|
||||
}
|
||||
|
||||
func TestRecentVersions(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
t.Run("order, limit and repo filter", func(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
_, svc := jobFixture(t, s, "a")
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: "other/repo:x", Digest: "sha256:ox", Source: model.SourcePoll, At: t0}))
|
||||
// 12 versions of the service's repo, one per minute.
|
||||
for i := 0; i < 12; i++ {
|
||||
tag := "t" + string(rune('a'+i))
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: sluskRepo + ":" + tag, Digest: "sha256:" + tag, Source: model.SourcePoll, At: t0.Add(time.Duration(i+1) * time.Minute)}))
|
||||
}
|
||||
|
||||
got, err := s.RecentVersions(ctx, sluskRepo, 10)
|
||||
|
||||
require.NoError(t, err)
|
||||
require.Len(t, got, 10)
|
||||
assert.Equal(t, "tl", got[0].Tag, "newest first")
|
||||
assert.Equal(t, "tc", got[9].Tag)
|
||||
for _, v := range got {
|
||||
assert.Equal(t, sluskRepo, v.Repo)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("digest-less row is hidden once its tag has a digest", func(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
_, svc := jobFixture(t, s, "a")
|
||||
add := func(tag, digest string, at time.Time) {
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: sluskRepo + ":" + tag, Digest: digest, Source: model.SourceWebhook, At: at}))
|
||||
}
|
||||
add("main", "", t0.Add(time.Minute))
|
||||
add("solo", "", t0.Add(2*time.Minute))
|
||||
require.Len(t, versionsOf(t, s, sluskRepo), 3, "running 1.4.2 plus two digest-less rows")
|
||||
|
||||
add("main", "sha256:m1", t0.Add(3*time.Minute))
|
||||
|
||||
var refs []string
|
||||
for _, v := range versionsOf(t, s, sluskRepo) {
|
||||
refs = append(refs, v.Ref())
|
||||
}
|
||||
assert.Equal(t, []string{sluskRepo + ":main@sha256:m1", sluskRepo + ":solo", sluskRepo + ":1.4.2@" + digD1}, refs)
|
||||
})
|
||||
|
||||
t.Run("digest-less row newer than the digest row of its tag is shown", func(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
_, svc := jobFixture(t, s, "a")
|
||||
add := func(tag, digest string, at time.Time) {
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: sluskRepo + ":" + tag, Digest: digest, Source: model.SourceWebhook, At: at}))
|
||||
}
|
||||
add("main", "sha256:m1", t0.Add(time.Minute))
|
||||
add("main", "", t0.Add(2*time.Minute))
|
||||
|
||||
var refs []string
|
||||
for _, v := range versionsOf(t, s, sluskRepo) {
|
||||
refs = append(refs, v.Ref())
|
||||
}
|
||||
assert.Equal(t, []string{sluskRepo + ":main", sluskRepo + ":main@sha256:m1", sluskRepo + ":1.4.2@" + digD1}, refs)
|
||||
})
|
||||
}
|
||||
|
||||
func TestGetImageVersion_NotFound(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
|
||||
_, err := s.GetImageVersion(context.Background(), 99999)
|
||||
|
||||
assert.ErrorIs(t, err, model.ErrNotFound)
|
||||
}
|
||||
|
||||
func TestSetPollError(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
ctx := context.Background()
|
||||
agent, svc := jobFixture(t, s, "a")
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: sluskRepo + ":1.5.0", Digest: "sha256:n1", Source: model.SourcePoll, At: t0}))
|
||||
|
||||
require.NoError(t, s.SetPollError(ctx, []int64{svc}, "boom"))
|
||||
require.NoError(t, s.SetPollError(ctx, nil, "ignored"))
|
||||
got, err := s.GetService(ctx, svc)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "boom", got.LastPollError)
|
||||
|
||||
require.NoError(t, s.UpsertService(ctx, agent, "", slusk, t0.Add(time.Hour)))
|
||||
got, err = s.GetService(ctx, svc)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "boom", got.LastPollError, "inventory writes do not touch the poll error")
|
||||
assert.Equal(t, "sha256:n1", got.AvailableDigest, "nor the suggestion")
|
||||
|
||||
require.NoError(t, s.SetPollError(ctx, []int64{svc}, ""))
|
||||
got, err = s.GetService(ctx, svc)
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, got.LastPollError)
|
||||
}
|
||||
|
||||
func TestSetLastTagDigest(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
ctx := context.Background()
|
||||
agent, svc := jobFixture(t, s, "a")
|
||||
got, err := s.GetService(ctx, svc)
|
||||
require.NoError(t, err)
|
||||
assert.Empty(t, got.LastTagDigest)
|
||||
|
||||
require.NoError(t, s.SetLastTagDigest(ctx, svc, "sha256:n1"))
|
||||
require.NoError(t, s.UpsertService(ctx, agent, "", slusk, t0.Add(time.Hour)))
|
||||
|
||||
got, err = s.GetService(ctx, svc)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "sha256:n1", got.LastTagDigest, "inventory writes do not touch it")
|
||||
list, err := s.ListServices(ctx)
|
||||
require.NoError(t, err)
|
||||
require.Len(t, list, 1)
|
||||
assert.Equal(t, "sha256:n1", list[0].LastTagDigest)
|
||||
}
|
||||
@@ -4,6 +4,7 @@ package store
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
@@ -91,27 +92,34 @@ func TestUpsertKeepsUpdateMode(t *testing.T) {
|
||||
func TestFinishJob_ClearsAvailableOnlyWhenThatVersionWasDeployed(t *testing.T) {
|
||||
succeed := model.JobFinish{Status: model.JobSucceeded, Ref: "r:2@sha256:d", StartedAt: t0, FinishedAt: t0}
|
||||
tests := []struct {
|
||||
name string
|
||||
availableRef string
|
||||
availableAt time.Time // job is created at t0 for r:2
|
||||
finish model.JobFinish
|
||||
wantCleared bool
|
||||
name string
|
||||
availableRef string
|
||||
availableDigest string
|
||||
availableAt time.Time // the job is created at t0
|
||||
toRef string // the job's to_ref as created
|
||||
finish model.JobFinish
|
||||
wantCleared bool
|
||||
}{
|
||||
{"same ref, suggestion before the job", "r:2", t0.Add(-time.Minute), succeed, true},
|
||||
{"same ref, suggestion at the same instant", "r:2", t0, succeed, true},
|
||||
{"same ref, suggestion after the job was created", "r:2", t0.Add(time.Minute), succeed, false},
|
||||
{"different ref keeps the suggestion", "r:3", t0.Add(-time.Minute), succeed, false},
|
||||
{"failed job keeps the suggestion", "r:2", t0.Add(-time.Minute),
|
||||
{"same ref, suggestion before the job", "r:2", "", t0.Add(-time.Minute), "r:2", succeed, true},
|
||||
{"same ref, suggestion at the same instant", "r:2", "", t0, "r:2", succeed, true},
|
||||
{"same ref, suggestion after the job was created", "r:2", "", t0.Add(time.Minute), "r:2", succeed, false},
|
||||
{"different ref keeps the suggestion", "r:3", "", t0.Add(-time.Minute), "r:2", succeed, false},
|
||||
{"failed job keeps the suggestion", "r:2", "", t0.Add(-time.Minute), "r:2",
|
||||
model.JobFinish{Status: model.JobFailed, Error: "boom", StartedAt: t0, FinishedAt: t0}, false},
|
||||
{"tag job clears a poll suggestion with a digest", "r:2", "sha256:new", t0.Add(-time.Minute), "r:2", succeed, true},
|
||||
{"pick of the suggested digest clears it", "r:2", "sha256:new", t0.Add(-time.Minute), "r:2@sha256:new", succeed, true},
|
||||
{"rollback to an older digest keeps the newer suggestion", "r:2", "sha256:new", t0.Add(-time.Minute), "r:2@sha256:old", succeed, false},
|
||||
{"digest pick keeps a suggestion without digest", "r:2", "", t0.Add(-time.Minute), "r:2@sha256:old", succeed, false},
|
||||
{"tagless pick keeps the suggestion", "r:2", "sha256:new", t0.Add(-time.Minute), "r@sha256:old", succeed, false},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
ctx := context.Background()
|
||||
agent, svc := jobFixture(t, s, "a")
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: tt.availableRef, Source: model.SourceWebhook, At: tt.availableAt}))
|
||||
require.NoError(t, s.SetAvailable(ctx, svc, model.Available{Ref: tt.availableRef, Digest: tt.availableDigest, Source: model.SourcePoll, At: tt.availableAt}))
|
||||
nj := newJob(svc, agent)
|
||||
nj.ToRef = "r:2"
|
||||
nj.ToRef = tt.toRef
|
||||
j, err := s.CreateJob(ctx, nj)
|
||||
require.NoError(t, err)
|
||||
|
||||
@@ -123,11 +131,13 @@ func TestFinishJob_ClearsAvailableOnlyWhenThatVersionWasDeployed(t *testing.T) {
|
||||
require.NoError(t, err)
|
||||
if tt.wantCleared {
|
||||
assert.Empty(t, got.AvailableRef)
|
||||
assert.Empty(t, got.AvailableDigest)
|
||||
assert.Empty(t, got.AvailableSource)
|
||||
assert.Nil(t, got.AvailableAt)
|
||||
} else {
|
||||
assert.Equal(t, tt.availableRef, got.AvailableRef)
|
||||
assert.Equal(t, model.SourceWebhook, got.AvailableSource)
|
||||
assert.Equal(t, tt.availableDigest, got.AvailableDigest)
|
||||
assert.Equal(t, model.SourcePoll, got.AvailableSource)
|
||||
assert.NotNil(t, got.AvailableAt)
|
||||
}
|
||||
})
|
||||
@@ -151,3 +161,48 @@ func TestFinishJob_WithoutAvailableLeavesItEmpty(t *testing.T) {
|
||||
assert.Nil(t, got.AvailableAt)
|
||||
assert.Equal(t, "r:1@sha256:d", got.DesiredRef)
|
||||
}
|
||||
|
||||
func TestFinishJob_RemembersTheDeployedDigestOfATagJob(t *testing.T) {
|
||||
good := "sha256:" + strings.Repeat("a", 64)
|
||||
old := "sha256:" + strings.Repeat("b", 64)
|
||||
ok := func(ref string) model.JobFinish {
|
||||
return model.JobFinish{Status: model.JobSucceeded, Ref: ref, StartedAt: t0, FinishedAt: t0}
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
trigger model.JobTrigger
|
||||
toRef string
|
||||
finish model.JobFinish
|
||||
want string
|
||||
}{
|
||||
{"webhook tag job", model.TriggerWebhook, "r:2", ok("r:2@" + good), good},
|
||||
{"manual tag job", model.TriggerManual, "r:2", ok("r:2@" + good), good},
|
||||
{"poll tag job", model.TriggerPoll, "r:2", ok("r:2@" + good), good},
|
||||
{"pinned pick leaves it", model.TriggerManual, "r:2@" + old, ok("r:2@" + old), "sha256:before"},
|
||||
{"tagless pick leaves it", model.TriggerManual, "r@" + old, ok("r@" + old), "sha256:before"},
|
||||
{"failed job leaves it", model.TriggerWebhook, "r:2",
|
||||
model.JobFinish{Status: model.JobFailed, Error: "boom", Ref: "r:2@" + good, StartedAt: t0, FinishedAt: t0}, "sha256:before"},
|
||||
{"malformed digest leaves it", model.TriggerWebhook, "r:2", ok("r:2@sha256:d"), "sha256:before"},
|
||||
{"no pinned ref leaves it", model.TriggerWebhook, "r:2", ok(""), "sha256:before"},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
s := openTestStore(t)
|
||||
ctx := context.Background()
|
||||
agent, svc := jobFixture(t, s, "a")
|
||||
require.NoError(t, s.SetLastTagDigest(ctx, svc, "sha256:before"))
|
||||
nj := newJob(svc, agent)
|
||||
nj.ToRef, nj.Trigger = tt.toRef, tt.trigger
|
||||
j, err := s.CreateJob(ctx, nj)
|
||||
require.NoError(t, err)
|
||||
|
||||
done, err := s.FinishJob(ctx, agent, j.ID, tt.finish)
|
||||
require.NoError(t, err)
|
||||
require.True(t, done)
|
||||
|
||||
got, err := s.GetService(ctx, svc)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.want, got.LastTagDigest)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
# CC0 1.0 Universal
|
||||
|
||||
## Statement of Purpose
|
||||
|
||||
The laws of most jurisdictions throughout the world automatically confer exclusive Copyright and Related Rights (defined below) upon the creator and subsequent owner(s) (each and all, an “owner”) of an original work of authorship and/or a database (each, a “Work”).
|
||||
|
||||
Certain owners wish to permanently relinquish those rights to a Work for the purpose of contributing to a commons of creative, cultural and scientific works (“Commons”) that the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others.
|
||||
|
||||
For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the “Affirmer”), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights.
|
||||
|
||||
1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights (“Copyright and Related Rights”). Copyright and Related Rights include, but are not limited to, the following:
|
||||
1. the right to reproduce, adapt, distribute, perform, display, communicate, and translate a Work;
|
||||
2. moral rights retained by the original author(s) and/or performer(s);
|
||||
3. publicity and privacy rights pertaining to a person’s image or likeness depicted in a Work;
|
||||
4. rights protecting against unfair competition in regards to a Work, subject to the limitations in paragraph 4(i), below;
|
||||
5. rights protecting the extraction, dissemination, use and reuse of data in a Work;
|
||||
6. database rights (such as those arising under Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, and under any national implementation thereof, including any amended or successor version of such directive); and
|
||||
7. other similar, equivalent or corresponding rights throughout the world based on applicable law or treaty, and any national implementations thereof.
|
||||
|
||||
2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer’s Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the “Waiver”). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer’s heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer’s express Statement of Purpose.
|
||||
|
||||
3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer’s express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer’s Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the “License”). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer’s express Statement of Purpose.
|
||||
|
||||
4. Limitations and Disclaimers.
|
||||
1. No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.
|
||||
2. Affirmer offers the Work as-is and makes no representations or warranties of any kind concerning the Work, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non infringement, or the absence of latent or other defects, accuracy, or the present or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.
|
||||
3. Affirmer disclaims responsibility for clearing rights of other persons that may apply to the Work or any use thereof, including without limitation any person’s Copyright and Related Rights in the Work. Further, Affirmer disclaims responsibility for obtaining any necessary consents, permissions or other rights required for any use of the Work.
|
||||
4. Affirmer understands and acknowledges that Creative Commons is not a party to this document and has no duty or obligation with respect to this CC0 or use of the Work.
|
||||
|
||||
For more information, please see <https://creativecommons.org/publicdomain/zero/1.0>.
|
||||
@@ -0,0 +1,128 @@
|
||||
// Command gen builds simple-icons.json.gz, the icon data the icons package
|
||||
// embeds. It downloads the pinned simple-icons npm tarball, checks its
|
||||
// sha256 and writes a gzipped JSON object {slug: svg path data}. The output
|
||||
// is deterministic. It writes into the current directory; run it with
|
||||
//
|
||||
// go generate ./internal/master/web/icons
|
||||
package main
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"bytes"
|
||||
"compress/gzip"
|
||||
"crypto/sha256"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"os"
|
||||
"path"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
const (
|
||||
tarballURL = "https://registry.npmjs.org/simple-icons/-/simple-icons-16.35.0.tgz"
|
||||
tarballSHA256 = "20ebead4f6bc93464812a5e260d19fc4d84772e5eeff69a6fbea263ca2441c5f"
|
||||
)
|
||||
|
||||
var pathData = regexp.MustCompile(`<path d="([^"]+)"`)
|
||||
|
||||
func main() {
|
||||
if err := run(); err != nil {
|
||||
fmt.Fprintln(os.Stderr, "gen:", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
func run() error {
|
||||
tgz, err := download(tarballURL)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if sum := sha256.Sum256(tgz); hex.EncodeToString(sum[:]) != tarballSHA256 {
|
||||
return fmt.Errorf("sha256 mismatch for %s: got %x, want %s", tarballURL, sum, tarballSHA256)
|
||||
}
|
||||
icons, license, err := extract(tgz)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
var js bytes.Buffer
|
||||
enc := json.NewEncoder(&js)
|
||||
enc.SetEscapeHTML(false)
|
||||
if err := enc.Encode(icons); err != nil { // map keys are written sorted
|
||||
return err
|
||||
}
|
||||
var gz bytes.Buffer
|
||||
zw, err := gzip.NewWriterLevel(&gz, gzip.BestCompression)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := zw.Write(js.Bytes()); err != nil { // the header has no name and a zero mtime
|
||||
return err
|
||||
}
|
||||
if err := zw.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.WriteFile("simple-icons.json.gz", gz.Bytes(), 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := os.WriteFile("LICENSE-simple-icons.md", license, 0o644); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Printf("wrote %d icons\n", len(icons))
|
||||
return nil
|
||||
}
|
||||
|
||||
func download(url string) ([]byte, error) {
|
||||
resp, err := http.Get(url)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("GET %s: %s", url, resp.Status)
|
||||
}
|
||||
return io.ReadAll(resp.Body)
|
||||
}
|
||||
|
||||
// extract returns the path data of every package/icons/*.svg by slug, and
|
||||
// package/LICENSE.md.
|
||||
func extract(tgz []byte) (icons map[string]string, license []byte, err error) {
|
||||
zr, err := gzip.NewReader(bytes.NewReader(tgz))
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
tr := tar.NewReader(zr)
|
||||
icons = map[string]string{}
|
||||
for {
|
||||
h, err := tr.Next()
|
||||
if err == io.EOF {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
switch {
|
||||
case h.Name == "package/LICENSE.md":
|
||||
if license, err = io.ReadAll(tr); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
case path.Dir(h.Name) == "package/icons" && strings.HasSuffix(h.Name, ".svg"):
|
||||
svg, err := io.ReadAll(tr)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
m := pathData.FindAllSubmatch(svg, -1)
|
||||
if len(m) != 1 {
|
||||
return nil, nil, fmt.Errorf("%s: want exactly one <path>, found %d", h.Name, len(m))
|
||||
}
|
||||
icons[strings.TrimSuffix(path.Base(h.Name), ".svg")] = string(m[0][1])
|
||||
}
|
||||
}
|
||||
if license == nil || len(icons) == 0 {
|
||||
return nil, nil, fmt.Errorf("tarball has no LICENSE.md or no icons")
|
||||
}
|
||||
return icons, license, nil
|
||||
}
|
||||
@@ -0,0 +1,109 @@
|
||||
// Package icons maps container image references to brand icons from the
|
||||
// Simple Icons set (CC0, see LICENSE-simple-icons.md). Only the master's UI
|
||||
// imports it, so the agent binary does not carry the data.
|
||||
package icons
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"compress/gzip"
|
||||
_ "embed"
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/imageref"
|
||||
)
|
||||
|
||||
//go:generate go run ./gen
|
||||
|
||||
//go:embed simple-icons.json.gz
|
||||
var data []byte
|
||||
|
||||
var (
|
||||
once sync.Once
|
||||
paths map[string]string
|
||||
)
|
||||
|
||||
// aliases maps a normalised image name to the Simple Icons slug that differs
|
||||
// from it.
|
||||
var aliases = map[string]string{
|
||||
"postgres": "postgresql",
|
||||
"goauthentik": "authentik",
|
||||
"traefik": "traefikproxy",
|
||||
"node": "nodedotjs",
|
||||
"mongo": "mongodb",
|
||||
}
|
||||
|
||||
// skipNamespaces are registry namespaces that name a publisher, not a product.
|
||||
var skipNamespaces = map[string]bool{"library": true, "linuxserver": true, "bitnami": true, "hotio": true}
|
||||
|
||||
// suffixes are stripped from the last path segment to find the product name
|
||||
// ("authentik-server" is authentik).
|
||||
var suffixes = []string{"-server", "-web", "-api", "-worker", "-agent"}
|
||||
|
||||
func load() {
|
||||
once.Do(func() {
|
||||
paths = map[string]string{}
|
||||
zr, err := gzip.NewReader(bytes.NewReader(data))
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
_ = json.NewDecoder(zr).Decode(&paths)
|
||||
})
|
||||
}
|
||||
|
||||
// Path returns the SVG path data (24x24 viewBox) of the icon with this Simple
|
||||
// Icons slug.
|
||||
func Path(slug string) (string, bool) {
|
||||
load()
|
||||
p, ok := paths[slug]
|
||||
return p, ok
|
||||
}
|
||||
|
||||
// Count returns how many icons are embedded.
|
||||
func Count() int {
|
||||
load()
|
||||
return len(paths)
|
||||
}
|
||||
|
||||
// ForImage returns the slug of the icon that best matches the image
|
||||
// reference, or "" when there is none. It tries the last path segment, that
|
||||
// segment without a role suffix, and the namespace, in that order.
|
||||
func ForImage(ref string) string {
|
||||
segs := strings.Split(imageref.Parse(ref).Repo, "/")
|
||||
if len(segs) > 1 && imageref.IsRegistryHost(segs[0]) {
|
||||
segs = segs[1:]
|
||||
}
|
||||
last := segs[len(segs)-1]
|
||||
candidates := []string{last}
|
||||
for _, s := range suffixes {
|
||||
if base, ok := strings.CutSuffix(last, s); ok && base != "" {
|
||||
candidates = append(candidates, base)
|
||||
break
|
||||
}
|
||||
}
|
||||
if len(segs) > 1 && !skipNamespaces[segs[len(segs)-2]] {
|
||||
candidates = append(candidates, segs[len(segs)-2])
|
||||
}
|
||||
for _, c := range candidates {
|
||||
slug := normalise(c)
|
||||
if a, ok := aliases[slug]; ok {
|
||||
slug = a
|
||||
}
|
||||
if _, ok := Path(slug); ok {
|
||||
return slug
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// normalise lowercases s and keeps only a-z and 0-9, the form of Simple Icons slugs.
|
||||
func normalise(s string) string {
|
||||
var b strings.Builder
|
||||
for _, r := range strings.ToLower(s) {
|
||||
if r >= 'a' && r <= 'z' || r >= '0' && r <= '9' {
|
||||
b.WriteRune(r)
|
||||
}
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
package icons
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
func TestForImage(t *testing.T) {
|
||||
cases := []struct {
|
||||
ref, want string
|
||||
}{
|
||||
{"gitea/gitea:1.27.3", "gitea"},
|
||||
{"ghcr.io/goauthentik/server:2026.8.2", "authentik"},
|
||||
{"postgres:17.10", "postgresql"},
|
||||
{"grafana/loki:3.4.2", "grafana"},
|
||||
{"docker.n8n.io/n8nio/n8n:1.112.4", "n8n"},
|
||||
{"lscr.io/linuxserver/prowlarr:latest", ""},
|
||||
{"localhost:5000/foo:v1", ""},
|
||||
{"gitea.shcizo.se/shcizo/slusk:v0.8.1", ""},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.ref, func(t *testing.T) {
|
||||
assert.Equal(t, c.want, ForImage(c.ref))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// safePath is a strict allowlist for what an embedded path may contain, since
|
||||
// the paths are written into the page's HTML.
|
||||
var safePath = regexp.MustCompile(`^[MmLlHhVvCcSsQqTtAaZz0-9.,\- e]+$`)
|
||||
|
||||
func TestEmbeddedSet(t *testing.T) {
|
||||
assert.Greater(t, Count(), 3000)
|
||||
for slug, p := range paths {
|
||||
if !safePath.MatchString(p) {
|
||||
t.Errorf("icon %q has unexpected characters in its path", slug)
|
||||
}
|
||||
}
|
||||
p, ok := Path("gitea")
|
||||
assert.True(t, ok)
|
||||
assert.NotEmpty(t, p)
|
||||
_, ok = Path("no-such-icon")
|
||||
assert.False(t, ok)
|
||||
}
|
||||
Binary file not shown.
@@ -0,0 +1,127 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestEvents_SendsPingWhenIdle(t *testing.T) {
|
||||
old := pingInterval
|
||||
pingInterval = 20 * time.Millisecond
|
||||
t.Cleanup(func() { pingInterval = old })
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/events", nil)
|
||||
require.NoError(t, err)
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
require.NoError(t, err)
|
||||
defer resp.Body.Close()
|
||||
|
||||
reader := bufio.NewReader(resp.Body)
|
||||
for {
|
||||
line, err := reader.ReadString('\n')
|
||||
require.NoError(t, err)
|
||||
if strings.HasPrefix(line, "event:") {
|
||||
assert.Equal(t, "event: ping\n", line, "the Live box counts a named event; a comment would not reach the browser's listeners")
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateAgent_ValidationShowsInsideTheAddPanel(t *testing.T) {
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
resp, err := http.PostForm(srv.URL+"/agents", url.Values{"name": {"node-2"}})
|
||||
require.NoError(t, err)
|
||||
defer resp.Body.Close()
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
assert.Equal(t, http.StatusConflict, resp.StatusCode)
|
||||
assert.Contains(t, string(body), `class="drawer"`)
|
||||
assert.Contains(t, string(body), `value="node-2"`, "the typed name is kept")
|
||||
assert.NotContains(t, string(body), "pua_", "no token is shown")
|
||||
}
|
||||
|
||||
func TestNavFragment(t *testing.T) {
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
cases := []struct {
|
||||
query, want, notWant string
|
||||
}{
|
||||
{"?section=agents", `<a href="/agents" class="cur" aria-current="page">Agents <span class="n">1/3</span>`, `<a href="/" class="cur"`},
|
||||
{"?section=services", `<a href="/" class="cur" aria-current="page">Services <span class="n">4</span>`, `<a href="/agents" class="cur"`},
|
||||
{"?section=bogus", `<a href="/jobs">Jobs</a>`, `class="cur"`},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.query, func(t *testing.T) {
|
||||
code, body := get(t, srv, "/fragments/nav"+c.query)
|
||||
assert.Equal(t, http.StatusOK, code)
|
||||
assert.NotContains(t, body, "<html")
|
||||
assert.Contains(t, body, c.want)
|
||||
assert.NotContains(t, body, c.notWant)
|
||||
})
|
||||
}
|
||||
_, body := get(t, srv, "/agents")
|
||||
assert.Contains(t, body, `hx-get="/fragments/nav?section=agents"`, "every page refreshes the sidebar on services and agents events")
|
||||
assert.Contains(t, body, `hx-trigger="sse:services, sse:agents"`)
|
||||
}
|
||||
|
||||
func TestAgentConnectFragment(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
path string
|
||||
online bool
|
||||
wantCode int
|
||||
want []string
|
||||
notWant []string
|
||||
}{
|
||||
{"never connected waits", "/fragments/agents/5/connect", false, http.StatusOK, []string{"Waiting for fresh", `action="/agents/5/revoke"`}, []string{"Connected", "add-steps"}},
|
||||
{"online is connected", "/fragments/agents/5/connect", true, http.StatusOK, []string{"Connected · ", `id="add-steps" hx-swap-oob="innerHTML"`}, []string{"Waiting", "revoke"}},
|
||||
{"seen before is connected", "/fragments/agents/3/connect", false, http.StatusOK, []string{"Connected · node-3.lan · v1.3.2"}, []string{"Waiting"}},
|
||||
{"unknown", "/fragments/agents/99/connect", false, http.StatusNotFound, nil, nil},
|
||||
{"revoked", "/fragments/agents/4/connect", false, http.StatusNotFound, nil, nil},
|
||||
{"bad id", "/fragments/agents/abc/connect", false, http.StatusBadRequest, nil, nil},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
srv, _, hub, _, _ := newTestEnv(t)
|
||||
hub.mu.Lock()
|
||||
hub.online[5] = c.online
|
||||
hub.mu.Unlock()
|
||||
code, body := get(t, srv, c.path)
|
||||
assert.Equal(t, c.wantCode, code)
|
||||
for _, w := range c.want {
|
||||
assert.Contains(t, body, w)
|
||||
}
|
||||
for _, w := range c.notWant {
|
||||
assert.NotContains(t, body, w)
|
||||
}
|
||||
assert.NotContains(t, body, "pua_", "the token is never sent again")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestStatic_FontsAndAppJS(t *testing.T) {
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
for _, path := range []string{
|
||||
"/static/app.js", "/static/app.css",
|
||||
"/static/schibsted-grotesk-latin-wght-normal.woff2", "/static/jetbrains-mono-latin-wght-normal.woff2",
|
||||
"/static/OFL-schibsted-grotesk.txt", "/static/OFL-jetbrains-mono.txt",
|
||||
} {
|
||||
code, _ := get(t, srv, path)
|
||||
assert.Equal(t, http.StatusOK, code, path)
|
||||
}
|
||||
_, css := get(t, srv, "/static/app.css")
|
||||
assert.NotContains(t, css, "fonts.googleapis.com", "fonts are served by the master")
|
||||
assert.Contains(t, css, "format('woff2')")
|
||||
_, page := get(t, srv, "/")
|
||||
assert.NotContains(t, page, "fonts.googleapis.com")
|
||||
assert.Contains(t, page, `src="/static/app.js"`)
|
||||
}
|
||||
+229
-34
@@ -10,6 +10,7 @@ import (
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"regexp"
|
||||
"slices"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
@@ -17,6 +18,7 @@ import (
|
||||
"github.com/shcizo/package-updater/internal/agenttoken"
|
||||
"github.com/shcizo/package-updater/internal/master/events"
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
"github.com/shcizo/package-updater/internal/master/web/icons"
|
||||
"github.com/shcizo/package-updater/internal/master/webauth"
|
||||
)
|
||||
|
||||
@@ -26,12 +28,18 @@ var assets embed.FS
|
||||
// serviceJobsLimit is how many jobs the service page lists.
|
||||
const serviceJobsLimit = 20
|
||||
|
||||
// versionsLimit is how many image versions the service page lists.
|
||||
const versionsLimit = 10
|
||||
|
||||
var agentNamePattern = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,62}$`)
|
||||
|
||||
// Store is the storage the UI reads and writes. *store.Store satisfies it.
|
||||
type Store interface {
|
||||
ListServices(ctx context.Context) ([]model.Service, error)
|
||||
GetService(ctx context.Context, id int64) (model.Service, error)
|
||||
// RecentVersions returns up to limit versions of repo the master has
|
||||
// seen, most recently first seen first.
|
||||
RecentVersions(ctx context.Context, repo string, limit int) ([]model.ImageVersion, error)
|
||||
// SetUpdateMode returns model.ErrNotFound for an unknown or removed service.
|
||||
SetUpdateMode(ctx context.Context, id int64, mode string) error
|
||||
GetJob(ctx context.Context, id int64) (model.Job, error)
|
||||
@@ -54,6 +62,9 @@ type Jobs interface {
|
||||
Updatable(svc model.Service) error
|
||||
AutoAllowed(svc model.Service) error
|
||||
Trigger(ctx context.Context, serviceID int64, requestedBy string) (model.Job, error)
|
||||
// TriggerVersion updates to exactly the image version versionID of the
|
||||
// service's repo; model.ErrNotFound for an unknown service or version.
|
||||
TriggerVersion(ctx context.Context, serviceID, versionID int64, requestedBy string) (model.Job, error)
|
||||
}
|
||||
|
||||
// Broker delivers change signals to open streams and accepts signals from
|
||||
@@ -63,11 +74,14 @@ type Broker interface {
|
||||
Publish(t events.Topic)
|
||||
}
|
||||
|
||||
// Config holds values shown in the "add agent" snippet.
|
||||
// Config holds values shown in the "add agent" snippet, on the agents page and
|
||||
// on the service page.
|
||||
type Config struct {
|
||||
AgentURL string // what agents dial, e.g. wss://10.0.0.5:8090/agent
|
||||
MasterKey string // the master's fingerprint
|
||||
AgentImage string
|
||||
AgentURL string // what agents dial, e.g. wss://10.0.0.5:8090/agent
|
||||
MasterKey string // the master's fingerprint
|
||||
AgentImage string
|
||||
PollInterval time.Duration // shown as "every <interval>" on the service page
|
||||
Version string // the master's build version; agents on another version are marked old
|
||||
}
|
||||
|
||||
// Server renders the UI.
|
||||
@@ -85,9 +99,9 @@ type Server struct {
|
||||
// New parses the templates. Each page is its own template set so every page
|
||||
// can define its own "content" block.
|
||||
func New(store Store, hub Hub, jobs Jobs, broker Broker, cfg Config, log *slog.Logger) (*Server, error) {
|
||||
funcs := template.FuncMap{"shortRef": shortRef, "duration": jobDuration}
|
||||
funcs := template.FuncMap{"shortRef": shortRef, "duration": jobDuration, "followsNoTag": followsNoTag, "middle": middle}
|
||||
pages := map[string]*template.Template{}
|
||||
for _, page := range []string{"overview.html", "agents.html", "agent_created.html", "service.html", "jobs.html", "job.html"} {
|
||||
for _, page := range []string{"overview.html", "agents.html", "service.html", "jobs.html", "job.html"} {
|
||||
t, err := template.New(page).Funcs(funcs).ParseFS(assets, "templates/layout.html", "templates/"+page)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse %s: %w", page, err)
|
||||
@@ -114,24 +128,64 @@ func (s *Server) Register(mux *http.ServeMux, protect func(http.Handler) http.Ha
|
||||
route("GET /fragments/jobs/{id}", s.jobFragment)
|
||||
route("GET /agents", s.agents)
|
||||
route("GET /fragments/agents", s.agentsFragment)
|
||||
route("GET /fragments/agents/{id}/connect", s.agentConnectFragment)
|
||||
route("GET /fragments/nav", s.navFragment)
|
||||
route("POST /agents", s.createAgent)
|
||||
route("POST /agents/{id}/revoke", s.revokeAgent)
|
||||
route("GET /events", s.events)
|
||||
}
|
||||
|
||||
// navData is what the sidebar shows on every page.
|
||||
type navData struct {
|
||||
Section string // services, jobs or agents; "" for none
|
||||
Services int
|
||||
AgentsOnline int
|
||||
AgentsTotal int // agents that are not revoked
|
||||
}
|
||||
|
||||
// spriteIcon is one icon of the sprite the services fragment carries.
|
||||
type spriteIcon struct {
|
||||
Slug string
|
||||
Path string
|
||||
}
|
||||
|
||||
// sections maps a page to the sidebar entry that is current on it.
|
||||
var sections = map[string]string{
|
||||
"overview.html": "services", "service.html": "services",
|
||||
"jobs.html": "jobs", "job.html": "jobs",
|
||||
"agents.html": "agents",
|
||||
}
|
||||
|
||||
type pageData struct {
|
||||
Title string
|
||||
CSRF string
|
||||
Groups []serviceGroup
|
||||
Title string
|
||||
CSRF string
|
||||
Nav navData
|
||||
Groups []serviceGroup
|
||||
// ServiceCount is how many services the groups hold.
|
||||
ServiceCount int
|
||||
// Sprite holds the icons the groups use, so the page carries only those.
|
||||
Sprite []spriteIcon
|
||||
Agents []agentRow
|
||||
Error string
|
||||
Created model.Agent
|
||||
Snippet string
|
||||
|
||||
// AddStep is the step of the "add agent" panel: 0 closed, 1 name,
|
||||
// 2 deploy (Created, Token, MasterKey and Snippet are set).
|
||||
AddStep int
|
||||
FormName string // what was typed in step 1
|
||||
Token string
|
||||
MasterKey string
|
||||
Connected bool // the agent Created has connected
|
||||
MasterVersion string // the master's build version; "" if unknown
|
||||
|
||||
Service model.Service
|
||||
ConfigFiles []string
|
||||
Reason string // why Service cannot be updated; "" when it can
|
||||
AutoBlocked string // why Service cannot be set to auto; "" when it can
|
||||
Versions []versionRow
|
||||
Polling string // what the service page says about registry polling
|
||||
PollFailed bool // Polling is the last registry error
|
||||
Jobs []model.Job
|
||||
Job model.Job
|
||||
}
|
||||
@@ -141,6 +195,58 @@ func (s *Server) base(r *http.Request, title string) pageData {
|
||||
return pageData{Title: title, CSRF: sess.CSRFToken}
|
||||
}
|
||||
|
||||
// page renders a full page: the sidebar numbers are looked up and put in data.
|
||||
func (s *Server) page(w http.ResponseWriter, r *http.Request, status int, page string, data pageData) {
|
||||
nav, err := s.navData(r.Context(), sections[page])
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
data.Nav = nav
|
||||
s.render(w, status, page, "layout", data)
|
||||
}
|
||||
|
||||
// navData counts what the sidebar shows next to its entries.
|
||||
func (s *Server) navData(ctx context.Context, section string) (navData, error) {
|
||||
nav := navData{Section: section}
|
||||
services, err := s.store.ListServices(ctx)
|
||||
if err != nil {
|
||||
return nav, err
|
||||
}
|
||||
nav.Services = len(services)
|
||||
agents, err := s.store.ListAgents(ctx)
|
||||
if err != nil {
|
||||
return nav, err
|
||||
}
|
||||
for _, a := range agents {
|
||||
if a.RevokedAt != nil {
|
||||
continue
|
||||
}
|
||||
nav.AgentsTotal++
|
||||
if s.hub.Online(a.ID) {
|
||||
nav.AgentsOnline++
|
||||
}
|
||||
}
|
||||
return nav, nil
|
||||
}
|
||||
|
||||
// navFragment renders the sidebar entries. The page asks for it with its own
|
||||
// section so the current entry stays marked.
|
||||
func (s *Server) navFragment(w http.ResponseWriter, r *http.Request) {
|
||||
section := r.URL.Query().Get("section")
|
||||
if section != "services" && section != "jobs" && section != "agents" {
|
||||
section = ""
|
||||
}
|
||||
nav, err := s.navData(r.Context(), section)
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
data := s.base(r, "")
|
||||
data.Nav = nav
|
||||
s.render(w, http.StatusOK, "overview.html", "nav", data)
|
||||
}
|
||||
|
||||
func (s *Server) render(w http.ResponseWriter, status int, page, block string, data pageData) {
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
w.WriteHeader(status)
|
||||
@@ -155,17 +261,41 @@ func (s *Server) serviceData(r *http.Request) (pageData, error) {
|
||||
if err != nil {
|
||||
return data, err
|
||||
}
|
||||
data.Groups = groupServices(services, s.autoBlocked)
|
||||
agents, err := s.store.ListAgents(r.Context())
|
||||
if err != nil {
|
||||
return data, err
|
||||
}
|
||||
data.Groups = groupServices(services, agents, s.hub.Online, s.autoBlocked)
|
||||
data.ServiceCount = len(services)
|
||||
data.Sprite = spriteFor(data.Groups)
|
||||
return data, nil
|
||||
}
|
||||
|
||||
// spriteFor collects the icons the groups' rows use, each once.
|
||||
func spriteFor(groups []serviceGroup) []spriteIcon {
|
||||
var sprite []spriteIcon
|
||||
seen := map[string]bool{}
|
||||
for _, g := range groups {
|
||||
for _, row := range g.Services {
|
||||
if row.Icon == "" || seen[row.Icon] {
|
||||
continue
|
||||
}
|
||||
seen[row.Icon] = true
|
||||
if path, ok := icons.Path(row.Icon); ok {
|
||||
sprite = append(sprite, spriteIcon{Slug: row.Icon, Path: path})
|
||||
}
|
||||
}
|
||||
}
|
||||
return sprite
|
||||
}
|
||||
|
||||
func (s *Server) overview(w http.ResponseWriter, r *http.Request) {
|
||||
data, err := s.serviceData(r)
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
s.render(w, http.StatusOK, "overview.html", "layout", data)
|
||||
s.page(w, r, http.StatusOK, "overview.html", data)
|
||||
}
|
||||
|
||||
func (s *Server) servicesFragment(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -174,7 +304,7 @@ func (s *Server) servicesFragment(w http.ResponseWriter, r *http.Request) {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
s.render(w, http.StatusOK, "overview.html", "services", data)
|
||||
s.render(w, http.StatusOK, "overview.html", "services-fragment", data)
|
||||
}
|
||||
|
||||
// autoBlocked returns the reason svc cannot be set to auto mode, or "".
|
||||
@@ -222,6 +352,12 @@ func (s *Server) serviceDetail(r *http.Request, id int64) (pageData, error) {
|
||||
return data, err
|
||||
}
|
||||
data.AutoBlocked = s.autoBlocked(svc)
|
||||
versions, err := s.store.RecentVersions(r.Context(), svc.ImageRepo, versionsLimit)
|
||||
if err != nil {
|
||||
return data, err
|
||||
}
|
||||
data.Versions = versionRows(versions, svc.ActualDigest)
|
||||
data.Polling, data.PollFailed = pollingStatus(svc, s.cfg.PollInterval)
|
||||
data.Jobs, err = s.store.ListJobs(r.Context(), model.JobFilter{ServiceID: id, Limit: serviceJobsLimit})
|
||||
return data, err
|
||||
}
|
||||
@@ -236,7 +372,7 @@ func (s *Server) servicePage(w http.ResponseWriter, r *http.Request) {
|
||||
s.failLookup(w, err)
|
||||
return
|
||||
}
|
||||
s.render(w, http.StatusOK, "service.html", "layout", data)
|
||||
s.page(w, r, http.StatusOK, "service.html", data)
|
||||
}
|
||||
|
||||
func (s *Server) serviceJobsFragment(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -260,7 +396,18 @@ func (s *Server) updateService(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
sess, _ := webauth.SessionFrom(r.Context())
|
||||
job, err := s.jobs.Trigger(r.Context(), id, sess.Subject)
|
||||
var job model.Job
|
||||
var err error
|
||||
if v := r.PostFormValue("version"); v == "" {
|
||||
job, err = s.jobs.Trigger(r.Context(), id, sess.Subject)
|
||||
} else {
|
||||
versionID, perr := strconv.ParseInt(v, 10, 64)
|
||||
if perr != nil {
|
||||
http.Error(w, "invalid version", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
job, err = s.jobs.TriggerVersion(r.Context(), id, versionID, sess.Subject)
|
||||
}
|
||||
var nu *model.NotUpdatableError
|
||||
switch {
|
||||
case err == nil || errors.Is(err, model.ErrJobActive):
|
||||
@@ -272,7 +419,7 @@ func (s *Server) updateService(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
data.Error = "Cannot update: " + nu.Reason + "."
|
||||
s.render(w, http.StatusConflict, "service.html", "layout", data)
|
||||
s.page(w, r, http.StatusConflict, "service.html", data)
|
||||
default:
|
||||
s.failLookup(w, err)
|
||||
}
|
||||
@@ -307,7 +454,7 @@ func (s *Server) setMode(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
data.Error = "Cannot enable auto: " + nu.Reason + "."
|
||||
s.render(w, http.StatusConflict, "service.html", "layout", data)
|
||||
s.page(w, r, http.StatusConflict, "service.html", data)
|
||||
return
|
||||
} else if err != nil {
|
||||
s.fail(w, err)
|
||||
@@ -339,7 +486,7 @@ func (s *Server) jobsPage(w http.ResponseWriter, r *http.Request) {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
s.render(w, http.StatusOK, "jobs.html", "layout", data)
|
||||
s.page(w, r, http.StatusOK, "jobs.html", data)
|
||||
}
|
||||
|
||||
func (s *Server) jobsFragment(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -370,7 +517,7 @@ func (s *Server) jobData(w http.ResponseWriter, r *http.Request) (pageData, bool
|
||||
|
||||
func (s *Server) jobPage(w http.ResponseWriter, r *http.Request) {
|
||||
if data, ok := s.jobData(w, r); ok {
|
||||
s.render(w, http.StatusOK, "job.html", "layout", data)
|
||||
s.page(w, r, http.StatusOK, "job.html", data)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -382,23 +529,28 @@ func (s *Server) jobFragment(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
func (s *Server) agentData(r *http.Request) (pageData, error) {
|
||||
data := s.base(r, "Agents")
|
||||
data.MasterVersion = s.cfg.Version
|
||||
agents, err := s.store.ListAgents(r.Context())
|
||||
if err != nil {
|
||||
return data, err
|
||||
}
|
||||
for _, a := range agents {
|
||||
data.Agents = append(data.Agents, agentRow{Agent: a, Online: s.hub.Online(a.ID)})
|
||||
data.Agents = append(data.Agents, newAgentRow(a, s.hub.Online(a.ID), s.cfg.Version))
|
||||
}
|
||||
return data, nil
|
||||
}
|
||||
|
||||
// agents shows the agent list; with ?add=1 the "add agent" panel is open.
|
||||
func (s *Server) agents(w http.ResponseWriter, r *http.Request) {
|
||||
data, err := s.agentData(r)
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
s.render(w, http.StatusOK, "agents.html", "layout", data)
|
||||
if r.URL.Query().Get("add") == "1" {
|
||||
data.AddStep = 1
|
||||
}
|
||||
s.page(w, r, http.StatusOK, "agents.html", data)
|
||||
}
|
||||
|
||||
func (s *Server) agentsFragment(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -407,13 +559,41 @@ func (s *Server) agentsFragment(w http.ResponseWriter, r *http.Request) {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
s.render(w, http.StatusOK, "agents.html", "agents", data)
|
||||
if data.Nav, err = s.navData(r.Context(), "agents"); err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
s.render(w, http.StatusOK, "agents.html", "agents-fragment", data)
|
||||
}
|
||||
|
||||
// agentConnectFragment is the last step of the "add agent" panel: it says
|
||||
// whether the agent that was just added has connected. It never repeats the
|
||||
// token.
|
||||
func (s *Server) agentConnectFragment(w http.ResponseWriter, r *http.Request) {
|
||||
id, ok := pathID(w, r)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
agents, err := s.store.ListAgents(r.Context())
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
i := slices.IndexFunc(agents, func(a model.Agent) bool { return a.ID == id && a.RevokedAt == nil })
|
||||
if i < 0 {
|
||||
http.Error(w, "not found", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
data := s.base(r, "Agents")
|
||||
data.Created = agents[i]
|
||||
data.Connected = s.hub.Online(id) || agents[i].LastSeenAt != nil
|
||||
s.render(w, http.StatusOK, "agents.html", "connect", data)
|
||||
}
|
||||
|
||||
func (s *Server) createAgent(w http.ResponseWriter, r *http.Request) {
|
||||
name := strings.TrimSpace(r.FormValue("name"))
|
||||
if !agentNamePattern.MatchString(name) {
|
||||
s.agentsWithError(w, r, http.StatusBadRequest, "Agent names use lowercase letters, digits and dashes.")
|
||||
s.agentsWithError(w, r, http.StatusBadRequest, name, "Agent names use lowercase letters, digits and dashes.")
|
||||
return
|
||||
}
|
||||
token, err := agenttoken.Generate()
|
||||
@@ -423,28 +603,39 @@ func (s *Server) createAgent(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
agent, err := s.store.CreateAgent(r.Context(), name, agenttoken.Hash(token))
|
||||
if errors.Is(err, model.ErrConflict) {
|
||||
s.agentsWithError(w, r, http.StatusConflict, fmt.Sprintf("An agent named %q already exists.", name))
|
||||
s.agentsWithError(w, r, http.StatusConflict, name, fmt.Sprintf("An agent named %q already exists.", name))
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
data := s.base(r, "Agent created")
|
||||
data.Created = agent
|
||||
data.Snippet = agentSnippet(s.cfg, token)
|
||||
w.Header().Set("Cache-Control", "no-store") // the page shows the one-time token
|
||||
s.render(w, http.StatusOK, "agent_created.html", "layout", data)
|
||||
}
|
||||
|
||||
func (s *Server) agentsWithError(w http.ResponseWriter, r *http.Request, status int, msg string) {
|
||||
data, err := s.agentData(r)
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
data.AddStep = 2
|
||||
data.Created = agent
|
||||
data.Token = token
|
||||
data.MasterKey = s.cfg.MasterKey
|
||||
data.Snippet = agentSnippet(s.cfg, token)
|
||||
w.Header().Set("Cache-Control", "no-store") // the page shows the one-time token
|
||||
s.page(w, r, http.StatusOK, "agents.html", data)
|
||||
}
|
||||
|
||||
// agentsWithError shows the agent list with the "add agent" panel open at
|
||||
// its first step, name kept and msg under the field.
|
||||
func (s *Server) agentsWithError(w http.ResponseWriter, r *http.Request, status int, name, msg string) {
|
||||
data, err := s.agentData(r)
|
||||
if err != nil {
|
||||
s.fail(w, err)
|
||||
return
|
||||
}
|
||||
data.AddStep = 1
|
||||
data.FormName = name
|
||||
data.Error = msg
|
||||
s.render(w, status, "agents.html", "layout", data)
|
||||
s.page(w, r, status, "agents.html", data)
|
||||
}
|
||||
|
||||
func (s *Server) revokeAgent(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -459,6 +650,7 @@ func (s *Server) revokeAgent(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
s.hub.Disconnect(id)
|
||||
s.broker.Publish(events.Agents) // the agent list and the sidebar change
|
||||
s.broker.Publish(events.Services) // the agent's services were marked removed
|
||||
s.broker.Publish(events.Jobs) // the agent's active jobs were failed
|
||||
for _, jobID := range failedJobs {
|
||||
@@ -467,6 +659,9 @@ func (s *Server) revokeAgent(w http.ResponseWriter, r *http.Request) {
|
||||
http.Redirect(w, r, "/agents", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// pingInterval is how often an idle event stream sends "event: ping".
|
||||
var pingInterval = 25 * time.Second
|
||||
|
||||
// events streams change signals as Server-Sent Events. htmx's SSE extension
|
||||
// turns "event: services" into a refetch of the services fragment. The event
|
||||
// carries no state, so a dropped signal is recovered by the next one.
|
||||
@@ -486,7 +681,7 @@ func (s *Server) events(w http.ResponseWriter, r *http.Request) {
|
||||
s.log.Error("sse_flush_unsupported", "error", err)
|
||||
return
|
||||
}
|
||||
keepalive := time.NewTicker(25 * time.Second)
|
||||
keepalive := time.NewTicker(pingInterval)
|
||||
defer keepalive.Stop()
|
||||
for {
|
||||
var msg string
|
||||
@@ -496,7 +691,7 @@ func (s *Server) events(w http.ResponseWriter, r *http.Request) {
|
||||
case t := <-ch:
|
||||
msg = fmt.Sprintf("event: %s\ndata: changed\n\n", t)
|
||||
case <-keepalive.C:
|
||||
msg = ": keepalive\n\n"
|
||||
msg = "event: ping\ndata: ok\n\n" // keeps proxies open; the Live box in the sidebar counts it
|
||||
}
|
||||
if _, err := fmt.Fprint(w, msg); err != nil {
|
||||
return
|
||||
|
||||
@@ -34,6 +34,17 @@ type fakeStore struct {
|
||||
created map[string]string // name → token hash
|
||||
revokedID int64
|
||||
revokeFailed []int64 // job IDs RevokeAgent reports as failed
|
||||
versions []model.ImageVersion
|
||||
}
|
||||
|
||||
func (f *fakeStore) RecentVersions(_ context.Context, repo string, limit int) ([]model.ImageVersion, error) {
|
||||
var out []model.ImageVersion
|
||||
for _, v := range f.versions {
|
||||
if v.Repo == repo && len(out) < limit {
|
||||
out = append(out, v)
|
||||
}
|
||||
}
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (f *fakeStore) ListServices(context.Context) ([]model.Service, error) { return f.services, nil }
|
||||
@@ -128,6 +139,9 @@ type fakeJobs struct {
|
||||
|
||||
mu sync.Mutex
|
||||
requestedBy string
|
||||
triggered []int64 // version IDs passed to TriggerVersion
|
||||
triggerSvc []int64 // service IDs passed to TriggerVersion
|
||||
plainCalls int // Trigger calls
|
||||
}
|
||||
|
||||
func (f *fakeJobs) Updatable(model.Service) error { return f.updatable }
|
||||
@@ -138,6 +152,16 @@ func (f *fakeJobs) Trigger(_ context.Context, _ int64, by string) (model.Job, er
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.requestedBy = by
|
||||
f.plainCalls++
|
||||
return f.job, f.err
|
||||
}
|
||||
|
||||
func (f *fakeJobs) TriggerVersion(_ context.Context, serviceID, versionID int64, by string) (model.Job, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.requestedBy = by
|
||||
f.triggerSvc = append(f.triggerSvc, serviceID)
|
||||
f.triggered = append(f.triggered, versionID)
|
||||
return f.job, f.err
|
||||
}
|
||||
|
||||
@@ -177,31 +201,56 @@ func newTestServer(t *testing.T) (*httptest.Server, *fakeStore, *fakeHub, *event
|
||||
return srv, store, hub, broker
|
||||
}
|
||||
|
||||
// newTestEnv starts the UI on fake storage, with polling off.
|
||||
func newTestEnv(t *testing.T) (*httptest.Server, *fakeStore, *fakeHub, *events.Broker, *fakeJobs) {
|
||||
t.Helper()
|
||||
agentID := int64(2)
|
||||
return newTestEnvPolling(t, 0)
|
||||
}
|
||||
|
||||
// newTestEnvPolling is newTestEnv with pollInterval as the polling interval
|
||||
// the service page shows.
|
||||
func newTestEnvPolling(t *testing.T, pollInterval time.Duration) (*httptest.Server, *fakeStore, *fakeHub, *events.Broker, *fakeJobs) {
|
||||
t.Helper()
|
||||
return newTestEnvConfig(t, func(c *Config) { c.PollInterval = pollInterval })
|
||||
}
|
||||
|
||||
// newTestEnvVersion is newTestEnv with version as the master's build version.
|
||||
func newTestEnvVersion(t *testing.T, version string) (*httptest.Server, *fakeStore, *fakeHub, *events.Broker, *fakeJobs) {
|
||||
t.Helper()
|
||||
return newTestEnvConfig(t, func(c *Config) { c.Version = version })
|
||||
}
|
||||
|
||||
// newTestEnvConfig is newTestEnv with edit applied to the UI's Config.
|
||||
func newTestEnvConfig(t *testing.T, edit func(*Config)) (*httptest.Server, *fakeStore, *fakeHub, *events.Broker, *fakeJobs) {
|
||||
t.Helper()
|
||||
agentID, offlineAgentID := int64(2), int64(3)
|
||||
store := &fakeStore{
|
||||
created: map[string]string{"node-2": "x"},
|
||||
services: []model.Service{
|
||||
{ID: 1, Kind: protocol.KindCompose, ComposeProject: "slusk", ComposeService: "web", AgentID: &agentID, AgentName: "node-2",
|
||||
ActualRef: "gitea.shcizo.se/shcizo/slusk:1.4.2", Status: "running", UpdateMode: "manual"},
|
||||
{ID: 2, Kind: protocol.KindSwarm, SwarmService: "jellyfin_jellyfin",
|
||||
{ID: 2, Kind: protocol.KindSwarm, SwarmService: "jellyfin_jellyfin", SwarmClusterID: "c1abcdefgh",
|
||||
ActualRef: "lscr.io/linuxserver/jellyfin@sha256:0f42497a69fa0441bfd5f9d6bba8694f2a656ec984e571d0ac04c6dd91250039", Status: "degraded", UpdateMode: "manual"},
|
||||
{ID: 3, Kind: protocol.KindContainer, ContainerName: "updater-agent", AgentID: &agentID, AgentName: "node-2",
|
||||
ActualRef: "pu:1", Status: "running", UpdateMode: "manual", Self: true},
|
||||
{ID: 4, Kind: protocol.KindCompose, ComposeProject: "media", ComposeService: "radarr", AgentID: &offlineAgentID, AgentName: "node-3",
|
||||
ActualRef: "lscr.io/linuxserver/radarr:latest", Status: "running", UpdateMode: "manual"},
|
||||
},
|
||||
agents: []model.Agent{
|
||||
{ID: 2, Name: "node-2", Hostname: "node-2"},
|
||||
{ID: 3, Name: "node-3"},
|
||||
{ID: 2, Name: "node-2", Hostname: "node-2.lan", AgentVersion: "v1.4.0", SwarmManager: true, SwarmClusterID: "c1abcdefgh", LastSeenAt: ptr(time.Now().UTC())},
|
||||
{ID: 3, Name: "node-3", Hostname: "node-3.lan", AgentVersion: "v1.3.2", LastSeenAt: ptr(time.Date(2026, 10, 12, 13, 51, 0, 0, time.UTC))},
|
||||
{ID: 4, Name: "old", RevokedAt: ptr(time.Now())},
|
||||
{ID: 5, Name: "fresh"},
|
||||
},
|
||||
}
|
||||
hub := &fakeHub{online: map[int64]bool{2: true}}
|
||||
broker := events.NewBroker()
|
||||
jobs := &fakeJobs{}
|
||||
s, err := New(store, hub, jobs, broker, Config{
|
||||
cfg := Config{
|
||||
AgentURL: "wss://10.0.0.5:8090/agent", MasterKey: "sha256:abc", AgentImage: "gitea.shcizo.se/shcizo/package-updater:latest",
|
||||
}, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
||||
}
|
||||
edit(&cfg)
|
||||
s, err := New(store, hub, jobs, broker, cfg, slog.New(slog.NewTextHandler(io.Discard, nil)))
|
||||
require.NoError(t, err)
|
||||
mux := http.NewServeMux()
|
||||
s.Register(mux, func(h http.Handler) http.Handler {
|
||||
@@ -236,13 +285,44 @@ func TestOverview_GroupsServicesPerMachineAndSwarm(t *testing.T) {
|
||||
code, body := get(t, srv, "/")
|
||||
assert.Equal(t, http.StatusOK, code)
|
||||
assert.Contains(t, body, "<html")
|
||||
assert.Contains(t, body, "node-2")
|
||||
assert.Contains(t, body, "Swarm")
|
||||
assert.Contains(t, body, "slusk/web")
|
||||
assert.Contains(t, body, "jellyfin_jellyfin")
|
||||
assert.Contains(t, body, ">Swarm</h2>", "one cluster is just called Swarm")
|
||||
assert.Contains(t, body, `title="c1abcdefgh"`, "the full cluster id is the hover text")
|
||||
assert.Contains(t, body, "managers node-2")
|
||||
assert.Contains(t, body, ">node-2</h2>")
|
||||
assert.Contains(t, body, `<span class="nmt">web</span>`)
|
||||
assert.Contains(t, body, `<span class="stk">slusk</span>`)
|
||||
assert.Contains(t, body, "jellyfin_jellyfin", "Swarm service names are shown as they are")
|
||||
assert.Contains(t, body, "sha256:0f42497a69fa…", "digests are shortened")
|
||||
assert.Contains(t, body, "managed outside")
|
||||
assert.Less(t, strings.Index(body, "node-2"), strings.Index(body, "Swarm"), "machines before Swarm")
|
||||
assert.Contains(t, body, "Managed outside")
|
||||
assert.Less(t, strings.Index(body, ">Swarm</h2>"), strings.Index(body, ">node-2</h2>"), "a cluster is followed by its managers' machines")
|
||||
assert.Contains(t, body, `class="sub" data-machine="agent-2"`, "the machine filter lists the manager under the cluster")
|
||||
}
|
||||
|
||||
func TestOverview_OfflineGroupShowsSince(t *testing.T) {
|
||||
srv, store, hub, _, _ := newTestEnv(t)
|
||||
_, body := get(t, srv, "/")
|
||||
assert.Regexp(t, `Agent offline since <time datetime="2026-10-12T13:51:00Z">13:51</time> · showing last known state`, body)
|
||||
assert.NotContains(t, body, "No manager online", "the cluster has a connected manager")
|
||||
|
||||
hub.mu.Lock()
|
||||
hub.online[2] = false
|
||||
hub.mu.Unlock()
|
||||
_, body = get(t, srv, "/")
|
||||
since := store.agents[0].LastSeenAt.Format("2006-01-02T15:04:05Z07:00")
|
||||
assert.Contains(t, body, `No manager online since <time datetime="`+since+`">`)
|
||||
assert.Contains(t, body, ` · showing last known state`)
|
||||
}
|
||||
|
||||
func TestOverview_IconOrLetter(t *testing.T) {
|
||||
srv, store, _, _, _ := newTestEnv(t)
|
||||
store.services[0].ActualRef = "gitea/gitea:1.27.3"
|
||||
for _, path := range []string{"/", "/fragments/services"} {
|
||||
_, body := get(t, srv, path)
|
||||
assert.Contains(t, body, `<symbol id="si-gitea"`, path)
|
||||
assert.Equal(t, 1, strings.Count(body, `<symbol id="si-gitea"`), "the sprite holds each icon once: "+path)
|
||||
assert.Contains(t, body, `href="#si-gitea"`, path)
|
||||
assert.Contains(t, body, `class="ltr lc-`, "services without an icon get a letter: "+path)
|
||||
}
|
||||
}
|
||||
|
||||
func TestServicesFragment_IsNotAFullPage(t *testing.T) {
|
||||
@@ -250,15 +330,64 @@ func TestServicesFragment_IsNotAFullPage(t *testing.T) {
|
||||
code, body := get(t, srv, "/fragments/services")
|
||||
assert.Equal(t, http.StatusOK, code)
|
||||
assert.NotContains(t, body, "<html")
|
||||
assert.Contains(t, body, "slusk/web")
|
||||
assert.Contains(t, body, `title="slusk/web"`)
|
||||
assert.Contains(t, body, `id="machines" hx-swap-oob`, "the machine filter in the sidebar is refreshed with the rows")
|
||||
}
|
||||
|
||||
func TestAgentsPage_ShowsConnectionState(t *testing.T) {
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
_, body := get(t, srv, "/agents")
|
||||
assert.Regexp(t, regexp.MustCompile(`node-2[\s\S]*online`), body)
|
||||
assert.Regexp(t, regexp.MustCompile(`node-3[\s\S]*offline`), body)
|
||||
assert.Regexp(t, regexp.MustCompile(`old[\s\S]*revoked`), body)
|
||||
assert.Regexp(t, regexp.MustCompile(`node-2[\s\S]*Online`), body)
|
||||
assert.Regexp(t, regexp.MustCompile(`node-3[\s\S]*Offline`), body)
|
||||
assert.Regexp(t, regexp.MustCompile(`old[\s\S]*Revoked`), body)
|
||||
assert.Regexp(t, regexp.MustCompile(`fresh[\s\S]*Never connected`), body)
|
||||
assert.Contains(t, body, "Manager")
|
||||
assert.Contains(t, body, "3 machines", "revoked agents are not counted")
|
||||
assert.NotContains(t, body, `class="drawer"`, "the add panel is closed by default")
|
||||
}
|
||||
|
||||
func TestAgentsFragment_RefreshesHeaderCount(t *testing.T) {
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
code, body := get(t, srv, "/fragments/agents")
|
||||
assert.Equal(t, http.StatusOK, code)
|
||||
assert.Contains(t, body, `id="agents-sub" hx-swap-oob="true">3 machines`)
|
||||
}
|
||||
|
||||
func TestAgentsPage_RevokeUsesPopover(t *testing.T) {
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
_, body := get(t, srv, "/agents")
|
||||
assert.Contains(t, body, `<details class="rv" data-id="2">`)
|
||||
assert.Contains(t, body, `action="/agents/2/revoke"`)
|
||||
assert.NotContains(t, body, "confirm(")
|
||||
assert.NotContains(t, body, `action="/agents/4/revoke"`, "a revoked agent cannot be revoked again")
|
||||
}
|
||||
|
||||
func TestAgentsPage_MasterVersionAndOldAgent(t *testing.T) {
|
||||
cases := []struct {
|
||||
name, version string
|
||||
wantOld bool
|
||||
}{
|
||||
{"other version is old", "v1.4.0", true},
|
||||
{"dev master marks nothing", "dev", false},
|
||||
{"unknown master version marks nothing", "", false},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
srv, _, _, _, _ := newTestEnvVersion(t, c.version)
|
||||
_, body := get(t, srv, "/agents")
|
||||
assert.Equal(t, c.version != "", strings.Contains(body, "master "+c.version))
|
||||
assert.Equal(t, c.wantOld, strings.Contains(body, `<div class="ver old">`+"<span class=\"k\">Agent</span>v1.3.2"), "node-3 runs v1.3.2")
|
||||
assert.NotContains(t, body, `<div class="ver old"><span class="k">Agent</span>v1.4.0`, "node-2 is current")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAgentsPage_AddPanelOpensWithQuery(t *testing.T) {
|
||||
srv, _, _, _ := newTestServer(t)
|
||||
_, body := get(t, srv, "/agents?add=1")
|
||||
assert.Contains(t, body, `class="drawer"`)
|
||||
assert.Contains(t, body, `<form method="post" action="/agents"`)
|
||||
assert.Contains(t, body, `name="csrf_token" value="csrf"`)
|
||||
}
|
||||
|
||||
func TestCreateAgent_ShowsSnippetOnceAndStoresHash(t *testing.T) {
|
||||
@@ -276,6 +405,10 @@ func TestCreateAgent_ShowsSnippetOnceAndStoresHash(t *testing.T) {
|
||||
assert.Contains(t, string(body), "MASTER_KEY: sha256:abc")
|
||||
assert.Contains(t, string(body), "MASTER_URL: wss://10.0.0.5:8090/agent")
|
||||
assert.Contains(t, string(body), "shown only once")
|
||||
assert.Contains(t, string(body), `<pre id="snippet">`)
|
||||
assert.Contains(t, string(body), `data-copy="`+token+`"`)
|
||||
assert.Contains(t, string(body), `hx-get="/fragments/agents/9/connect"`, "step 3 waits for the agent")
|
||||
assert.Contains(t, string(body), ">node-3</b>", "the agent list is still on the page")
|
||||
}
|
||||
|
||||
func TestCreateAgent_Validation(t *testing.T) {
|
||||
@@ -315,16 +448,16 @@ func TestRevokeAgent_RevokesAndDisconnects(t *testing.T) {
|
||||
assert.Equal(t, int64(2), store.revoked())
|
||||
assert.Equal(t, int64(2), hub.lastDisconnected(), "a revoked agent must be cut off immediately")
|
||||
var got []events.Topic
|
||||
for len(got) < 4 {
|
||||
for len(got) < 5 {
|
||||
select {
|
||||
case topic := <-ch:
|
||||
got = append(got, topic)
|
||||
default:
|
||||
t.Fatalf("revoke published %v, want services, jobs and one topic per failed job", got)
|
||||
t.Fatalf("revoke published %v, want agents, services, jobs and one topic per failed job", got)
|
||||
}
|
||||
}
|
||||
assert.ElementsMatch(t, []events.Topic{events.Services, events.Jobs, events.JobTopic(5), events.JobTopic(6)}, got,
|
||||
"the overview drops the agent's services; job lists and open job pages show the failures")
|
||||
assert.ElementsMatch(t, []events.Topic{events.Agents, events.Services, events.Jobs, events.JobTopic(5), events.JobTopic(6)}, got,
|
||||
"the agent list and sidebar change; the overview drops the agent's services; job lists and open job pages show the failures")
|
||||
}
|
||||
|
||||
func TestRevokeAgent_BadID(t *testing.T) {
|
||||
@@ -607,16 +740,19 @@ func TestOverview_ShowsModeToggleAndAvailableBadge(t *testing.T) {
|
||||
srv, store, _, _, jobs := newTestEnv(t)
|
||||
store.services[0].AvailableRef = "gitea.shcizo.se/shcizo/slusk:1.5.0"
|
||||
store.services[1].UpdateMode = "auto"
|
||||
jobs.autoErr = &model.NotUpdatableError{Reason: model.ReasonSelf}
|
||||
jobs.autoErr = &model.NotUpdatableError{Reason: model.ReasonBuilt}
|
||||
|
||||
for _, path := range []string{"/", "/fragments/services"} {
|
||||
_, body := get(t, srv, path)
|
||||
assert.Contains(t, body, `action="/services/1/mode"`, path)
|
||||
assert.Contains(t, body, `name="csrf_token" value="csrf"`, path)
|
||||
assert.Contains(t, body, `name="return" value="overview"`, path)
|
||||
assert.Contains(t, body, `class="badge badge-update" title="gitea.shcizo.se/shcizo/slusk:1.5.0"`, path)
|
||||
assert.Contains(t, body, `<input type="hidden" name="mode" value="manual">`, "auto services toggle to manual: "+path)
|
||||
assert.Contains(t, body, `disabled>Make auto</button> <span class="muted">`+model.ReasonSelf+`</span>`, "blocked manual services get a disabled button: "+path)
|
||||
assert.Contains(t, body, `class="tag f-up" title="gitea.shcizo.se/shcizo/slusk:1.5.0">Update available<em>1.5.0</em>`, path)
|
||||
assert.Contains(t, body, `<input type="hidden" name="mode" value="manual">`+"\n"+` <button type="submit" class="sw" role="switch" aria-checked="true">`, "auto services toggle to manual: "+path)
|
||||
assert.Contains(t, body, `<input type="hidden" name="mode" value="auto">`, "manual services toggle to auto: "+path)
|
||||
assert.Contains(t, body, `aria-checked="false" disabled title="`+model.ReasonBuilt+`">`, "blocked manual services get a disabled switch: "+path)
|
||||
assert.Contains(t, body, `<span class="na">`+model.ReasonBuilt+`</span>`, "and say why: "+path)
|
||||
assert.Contains(t, body, `<span class="na">n/a</span>`, "services managed outside have no switch: "+path)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono) JetBrainsMono-Italic[wght].ttf: Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)
|
||||
|
||||
This Font Software is licensed under the SIL Open Font License, Version 1.1.
|
||||
This license is copied below, and is also available with a FAQ at:
|
||||
http://scripts.sil.org/OFL
|
||||
|
||||
|
||||
-----------------------------------------------------------
|
||||
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
|
||||
-----------------------------------------------------------
|
||||
|
||||
PREAMBLE
|
||||
The goals of the Open Font License (OFL) are to stimulate worldwide
|
||||
development of collaborative font projects, to support the font creation
|
||||
efforts of academic and linguistic communities, and to provide a free and
|
||||
open framework in which fonts may be shared and improved in partnership
|
||||
with others.
|
||||
|
||||
The OFL allows the licensed fonts to be used, studied, modified and
|
||||
redistributed freely as long as they are not sold by themselves. The
|
||||
fonts, including any derivative works, can be bundled, embedded,
|
||||
redistributed and/or sold with any software provided that any reserved
|
||||
names are not used by derivative works. The fonts and derivatives,
|
||||
however, cannot be released under any other type of license. The
|
||||
requirement for fonts to remain under this license does not apply
|
||||
to any document created using the fonts or their derivatives.
|
||||
|
||||
DEFINITIONS
|
||||
"Font Software" refers to the set of files released by the Copyright
|
||||
Holder(s) under this license and clearly marked as such. This may
|
||||
include source files, build scripts and documentation.
|
||||
|
||||
"Reserved Font Name" refers to any names specified as such after the
|
||||
copyright statement(s).
|
||||
|
||||
"Original Version" refers to the collection of Font Software components as
|
||||
distributed by the Copyright Holder(s).
|
||||
|
||||
"Modified Version" refers to any derivative made by adding to, deleting,
|
||||
or substituting -- in part or in whole -- any of the components of the
|
||||
Original Version, by changing formats or by porting the Font Software to a
|
||||
new environment.
|
||||
|
||||
"Author" refers to any designer, engineer, programmer, technical
|
||||
writer or other person who contributed to the Font Software.
|
||||
|
||||
PERMISSION & CONDITIONS
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of the Font Software, to use, study, copy, merge, embed, modify,
|
||||
redistribute, and sell modified and unmodified copies of the Font
|
||||
Software, subject to the following conditions:
|
||||
|
||||
1) Neither the Font Software nor any of its individual components,
|
||||
in Original or Modified Versions, may be sold by itself.
|
||||
|
||||
2) Original or Modified Versions of the Font Software may be bundled,
|
||||
redistributed and/or sold with any software, provided that each copy
|
||||
contains the above copyright notice and this license. These can be
|
||||
included either as stand-alone text files, human-readable headers or
|
||||
in the appropriate machine-readable metadata fields within text or
|
||||
binary files as long as those fields can be easily viewed by the user.
|
||||
|
||||
3) No Modified Version of the Font Software may use the Reserved Font
|
||||
Name(s) unless explicit written permission is granted by the corresponding
|
||||
Copyright Holder. This restriction only applies to the primary font name as
|
||||
presented to the users.
|
||||
|
||||
4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
|
||||
Software shall not be used to promote, endorse or advertise any
|
||||
Modified Version, except to acknowledge the contribution(s) of the
|
||||
Copyright Holder(s) and the Author(s) or with their explicit written
|
||||
permission.
|
||||
|
||||
5) The Font Software, modified or unmodified, in part or in whole,
|
||||
must be distributed entirely under this license, and must not be
|
||||
distributed under any other license. The requirement for fonts to
|
||||
remain under this license does not apply to any document created
|
||||
using the Font Software.
|
||||
|
||||
TERMINATION
|
||||
This license becomes null and void if any of the above conditions are
|
||||
not met.
|
||||
|
||||
DISCLAIMER
|
||||
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
|
||||
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
|
||||
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
|
||||
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
||||
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
|
||||
OTHER DEALINGS IN THE FONT SOFTWARE.
|
||||
@@ -0,0 +1,93 @@
|
||||
Copyright 2023 The Schibsted-Grotesk Project Authors (https://github.com/schibsted/schibsted-grotesk) SchibstedGrotesk-Italic[wght].ttf: Copyright 2023 The Schibsted-Grotesk Project Authors (https://github.com/schibsted/schibsted-grotesk)
|
||||
|
||||
This Font Software is licensed under the SIL Open Font License, Version 1.1.
|
||||
This license is copied below, and is also available with a FAQ at:
|
||||
http://scripts.sil.org/OFL
|
||||
|
||||
|
||||
-----------------------------------------------------------
|
||||
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
|
||||
-----------------------------------------------------------
|
||||
|
||||
PREAMBLE
|
||||
The goals of the Open Font License (OFL) are to stimulate worldwide
|
||||
development of collaborative font projects, to support the font creation
|
||||
efforts of academic and linguistic communities, and to provide a free and
|
||||
open framework in which fonts may be shared and improved in partnership
|
||||
with others.
|
||||
|
||||
The OFL allows the licensed fonts to be used, studied, modified and
|
||||
redistributed freely as long as they are not sold by themselves. The
|
||||
fonts, including any derivative works, can be bundled, embedded,
|
||||
redistributed and/or sold with any software provided that any reserved
|
||||
names are not used by derivative works. The fonts and derivatives,
|
||||
however, cannot be released under any other type of license. The
|
||||
requirement for fonts to remain under this license does not apply
|
||||
to any document created using the fonts or their derivatives.
|
||||
|
||||
DEFINITIONS
|
||||
"Font Software" refers to the set of files released by the Copyright
|
||||
Holder(s) under this license and clearly marked as such. This may
|
||||
include source files, build scripts and documentation.
|
||||
|
||||
"Reserved Font Name" refers to any names specified as such after the
|
||||
copyright statement(s).
|
||||
|
||||
"Original Version" refers to the collection of Font Software components as
|
||||
distributed by the Copyright Holder(s).
|
||||
|
||||
"Modified Version" refers to any derivative made by adding to, deleting,
|
||||
or substituting -- in part or in whole -- any of the components of the
|
||||
Original Version, by changing formats or by porting the Font Software to a
|
||||
new environment.
|
||||
|
||||
"Author" refers to any designer, engineer, programmer, technical
|
||||
writer or other person who contributed to the Font Software.
|
||||
|
||||
PERMISSION & CONDITIONS
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of the Font Software, to use, study, copy, merge, embed, modify,
|
||||
redistribute, and sell modified and unmodified copies of the Font
|
||||
Software, subject to the following conditions:
|
||||
|
||||
1) Neither the Font Software nor any of its individual components,
|
||||
in Original or Modified Versions, may be sold by itself.
|
||||
|
||||
2) Original or Modified Versions of the Font Software may be bundled,
|
||||
redistributed and/or sold with any software, provided that each copy
|
||||
contains the above copyright notice and this license. These can be
|
||||
included either as stand-alone text files, human-readable headers or
|
||||
in the appropriate machine-readable metadata fields within text or
|
||||
binary files as long as those fields can be easily viewed by the user.
|
||||
|
||||
3) No Modified Version of the Font Software may use the Reserved Font
|
||||
Name(s) unless explicit written permission is granted by the corresponding
|
||||
Copyright Holder. This restriction only applies to the primary font name as
|
||||
presented to the users.
|
||||
|
||||
4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
|
||||
Software shall not be used to promote, endorse or advertise any
|
||||
Modified Version, except to acknowledge the contribution(s) of the
|
||||
Copyright Holder(s) and the Author(s) or with their explicit written
|
||||
permission.
|
||||
|
||||
5) The Font Software, modified or unmodified, in part or in whole,
|
||||
must be distributed entirely under this license, and must not be
|
||||
distributed under any other license. The requirement for fonts to
|
||||
remain under this license does not apply to any document created
|
||||
using the Font Software.
|
||||
|
||||
TERMINATION
|
||||
This license becomes null and void if any of the above conditions are
|
||||
not met.
|
||||
|
||||
DISCLAIMER
|
||||
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
|
||||
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
|
||||
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
|
||||
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
||||
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
|
||||
OTHER DEALINGS IN THE FONT SOFTWARE.
|
||||
@@ -1,33 +1,220 @@
|
||||
:root { --bg: #111418; --fg: #e6e8eb; --muted: #8a929c; --line: #262b31; --ok: #3fb950; --warn: #d29922; --bad: #f85149; --accent: #58a6ff; }
|
||||
@media (prefers-color-scheme: light) {
|
||||
:root { --bg: #ffffff; --fg: #1f2328; --muted: #59636e; --line: #d1d9e0; --ok: #1a7f37; --warn: #9a6700; --bad: #cf222e; --accent: #0969da; }
|
||||
@font-face{font-family:'Schibsted Grotesk';font-style:normal;font-weight:400 900;font-display:swap;src:url(/static/schibsted-grotesk-latin-wght-normal.woff2) format('woff2')}
|
||||
@font-face{font-family:'JetBrains Mono';font-style:normal;font-weight:100 800;font-display:swap;src:url(/static/jetbrains-mono-latin-wght-normal.woff2) format('woff2')}
|
||||
|
||||
/* Ledger. Tokens live on <html class="app">; a script in <head> adds t-light before first paint. */
|
||||
.app{color-scheme:dark;--bg:#0f1218;--side:#0b0d12;--card:#151a23;--hover:#171c26;--line:#232a37;--line2:#323a4a;--fg:#e7eaf1;--mut:#a0a9bb;--dim:#828ba0;--blue:#74a8ff;--bluebg:rgba(116,168,255,.12);--orange:#ffa262;--orangebg:rgba(255,162,98,.12);--green:#62d4a0;--red:#ff7d88;--redbg:rgba(255,125,136,.10);--violet:#c5a9ff;--violetbg:rgba(197,169,255,.12);--l0:#74a8ff;--l1:#c5a9ff;--l2:#5fd0e0;--l3:#f29bd0;--onblue:#06142e;--term:#080a0e;--shadow:0 12px 32px rgba(0,0,0,.5);--sans:'Schibsted Grotesk',system-ui,-apple-system,sans-serif;--mono:'JetBrains Mono',ui-monospace,Menlo,monospace;min-height:100vh;background:var(--bg);color:var(--fg);font:14px/1.45 var(--sans)}
|
||||
.app.t-light{color-scheme:light;--bg:#f7f8fa;--side:#eceff4;--card:#ffffff;--hover:#f0f2f6;--line:#dde1e8;--line2:#c6ccd7;--fg:#121620;--mut:#4b5468;--dim:#5c6579;--blue:#2156c8;--bluebg:rgba(33,86,200,.08);--orange:#a84b0b;--orangebg:rgba(200,96,20,.09);--green:#177649;--red:#b32a3b;--redbg:rgba(179,42,59,.07);--violet:#6943c1;--violetbg:rgba(105,67,193,.08);--l0:#2156c8;--l1:#6943c1;--l2:#0b7285;--l3:#a8306f;--onblue:#ffffff;--term:#121620;--shadow:0 12px 32px rgba(20,30,50,.16)}
|
||||
*{box-sizing:border-box}
|
||||
body{margin:0}
|
||||
[hidden]{display:none !important}
|
||||
a{color:var(--blue)}a:hover{color:var(--fg)}
|
||||
button,input{font-family:inherit}
|
||||
:focus-visible{outline:2px solid var(--blue);outline-offset:2px}
|
||||
|
||||
/* Shell */
|
||||
.shell{display:flex;flex-wrap:wrap;min-height:100vh}
|
||||
.side{flex:0 0 232px;background:var(--side);border-right:1px solid var(--line);display:flex;flex-direction:column;gap:28px;padding:20px 14px}
|
||||
.brand{display:flex;align-items:center;gap:10px;font:700 15px var(--sans);letter-spacing:-.01em;padding:0 8px;color:var(--fg);text-decoration:none}
|
||||
.brand svg{color:var(--blue)}
|
||||
.snav{display:flex;flex-direction:column;gap:2px}
|
||||
.snav a,.mlist a{display:flex;align-items:center;gap:10px;padding:7px 8px;border-radius:6px;color:var(--mut);text-decoration:none;font-weight:500}
|
||||
.snav a:hover,.mlist a:hover{background:var(--hover);color:var(--fg)}
|
||||
.snav a.cur,.mlist a.cur{background:var(--card);color:var(--fg);box-shadow:inset 0 0 0 1px var(--line)}
|
||||
.snav .n,.mlist .n{margin-left:auto;font:12px var(--mono);color:var(--dim)}
|
||||
.slabel{font:600 11px var(--sans);text-transform:uppercase;letter-spacing:.08em;color:var(--dim);padding:0 8px 6px}
|
||||
.mlist{display:flex;flex-direction:column;gap:2px}
|
||||
.mlist .sub{padding-left:22px;font-size:13px}
|
||||
.mdot{width:7px;height:7px;border-radius:50%;background:var(--green);flex:none}
|
||||
.mdot.off{background:transparent;box-shadow:inset 0 0 0 1.5px var(--red)}
|
||||
.sw-icon{width:7px;height:7px;flex:none;border-radius:2px;box-shadow:inset 0 0 0 1.5px var(--blue)}
|
||||
.livebox{margin-top:auto;padding:10px 8px;border-top:1px solid var(--line);font-size:12px;color:var(--mut);display:flex;flex-direction:column;gap:2px}
|
||||
.livebox b{display:flex;align-items:center;gap:8px;color:var(--fg);font-weight:600}
|
||||
.pulse{width:8px;height:8px;border-radius:50%;background:var(--green);animation:breathe 2.4s ease-in-out infinite}
|
||||
.livebox.down .pulse{background:var(--red);animation:none}
|
||||
@keyframes breathe{0%{box-shadow:0 0 0 0 rgba(98,212,160,.45)}50%{box-shadow:0 0 0 5px rgba(98,212,160,0)}}
|
||||
.sfoot{display:flex;flex-wrap:wrap;align-items:center;gap:4px 8px}
|
||||
.sfoot form{margin:0}
|
||||
.work{flex:999 1 640px;min-width:0;display:flex;flex-wrap:wrap}
|
||||
.main{flex:999 1 520px;min-width:0;padding:28px 36px 48px;container-type:inline-size}
|
||||
.sprite{position:absolute;width:0;height:0;overflow:hidden}
|
||||
|
||||
/* Page header, buttons */
|
||||
.hdr{display:flex;flex-wrap:wrap;align-items:flex-end;gap:12px 24px;margin-bottom:18px}
|
||||
.hdr h1{margin:0;font:700 34px/1 var(--sans);letter-spacing:-.025em}
|
||||
.hdr .sub{font-size:14px;color:var(--mut)}
|
||||
.hdr .end{margin-left:auto}
|
||||
.btn,button:not([class]){height:32px;padding:0 14px;border-radius:6px;border:1px solid var(--line2);background:var(--card);color:var(--fg);font:600 13px var(--sans);cursor:pointer;display:inline-flex;align-items:center;gap:8px;white-space:nowrap;text-decoration:none}
|
||||
.btn:hover,button:not([class]):hover{border-color:var(--dim);color:var(--fg)}
|
||||
button:not([class]):disabled{opacity:.5;cursor:not-allowed}
|
||||
.btn.pri,.btn.pri:hover{background:var(--blue);border-color:var(--blue);color:var(--onblue)}
|
||||
.btn.sm{height:28px;padding:0 10px;font-size:12.5px}
|
||||
.btn.quiet{border-color:transparent;background:transparent;color:var(--mut)}
|
||||
.btn.quiet:hover{color:var(--fg)}
|
||||
.btn.red{color:var(--red);border-color:var(--line2);background:transparent}
|
||||
.btn.redfill,.btn.redfill:hover{background:var(--red);border-color:var(--red);color:#1d0408}
|
||||
summary.btn{list-style:none}
|
||||
summary.btn::-webkit-details-marker{display:none}
|
||||
|
||||
/* Overview */
|
||||
.tools{display:flex;flex-wrap:wrap;align-items:center;gap:10px 18px;padding:12px 0;border-top:1px solid var(--line);border-bottom:1px solid var(--line);margin-bottom:8px}
|
||||
.search{flex:0 1 340px;min-width:220px;display:flex;align-items:center;gap:8px;height:34px;padding:0 12px;border-radius:6px;background:var(--card);border:1px solid var(--line2);color:var(--dim)}
|
||||
.search input{flex:1;min-width:0;border:0;outline:0;background:transparent;color:var(--fg);font-size:14px}
|
||||
.search input::placeholder{color:var(--dim)}
|
||||
.tools .end{margin-left:auto;display:flex;align-items:center;gap:10px}
|
||||
.tools .lbl{font-size:12.5px;color:var(--dim)}
|
||||
.seg{display:inline-flex;padding:2px;border-radius:7px;background:var(--card);box-shadow:inset 0 0 0 1px var(--line2)}
|
||||
.seg button{display:inline-flex;align-items:center;gap:6px;height:28px;padding:0 10px;border:0;border-radius:5px;background:transparent;color:var(--mut);font:500 12.5px var(--sans);cursor:pointer}
|
||||
.seg button:hover{color:var(--fg)}
|
||||
.seg button[aria-pressed=true]{background:var(--hover);color:var(--fg);box-shadow:inset 0 0 0 1px var(--line2)}
|
||||
.grp{margin-top:28px}
|
||||
.gh{display:flex;flex-wrap:wrap;align-items:baseline;gap:4px 12px;padding-bottom:8px;border-bottom:2px solid var(--fg)}
|
||||
.gh h2{margin:0;font:700 20px var(--sans);letter-spacing:-.015em}
|
||||
.gh .kind{font:600 11px var(--sans);text-transform:uppercase;letter-spacing:.08em;color:var(--mut)}
|
||||
.gh .meta{font-size:13px;color:var(--dim)}
|
||||
.gh .warn{font-size:13px;color:var(--red);font-weight:500}
|
||||
.gh .count{margin-left:auto;font:12px var(--mono);color:var(--dim)}
|
||||
.grp.offline .gh{border-bottom-color:var(--line2)}
|
||||
.grp.offline .row{color:var(--dim)}
|
||||
.row{position:relative;display:grid;grid-template-columns:minmax(200px,1.4fr) minmax(200px,2fr) 130px minmax(160px,1.5fr) minmax(104px,150px);align-items:center;column-gap:18px;min-height:42px;padding:0 6px;border-bottom:1px solid var(--line)}
|
||||
.row:hover{background:var(--hover)}
|
||||
.nm{display:flex;align-items:center;gap:8px;min-width:0}
|
||||
.nm a{display:inline-flex;align-items:center;gap:10px;min-width:0;color:var(--fg);font-weight:600;text-decoration:none;white-space:nowrap}
|
||||
.nm a:hover .nmt{text-decoration:underline;text-underline-offset:3px}
|
||||
.nm .nmt{overflow:hidden;text-overflow:ellipsis}
|
||||
.nm .stk{font-size:12.5px;color:var(--dim);white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
|
||||
.ico{flex:none;display:grid;place-items:center;width:26px;height:26px;border-radius:7px;background:var(--card);box-shadow:inset 0 0 0 1px var(--line2);color:var(--fg)}
|
||||
.ico svg{fill:currentColor}
|
||||
.ltr{flex:none;display:grid;place-items:center;width:26px;height:26px;border-radius:50%;font:700 12.5px var(--sans)}
|
||||
.lc-0{color:var(--l0);background:color-mix(in srgb,var(--l0) 18%,transparent)}
|
||||
.lc-1{color:var(--l1);background:color-mix(in srgb,var(--l1) 18%,transparent)}
|
||||
.lc-2{color:var(--l2);background:color-mix(in srgb,var(--l2) 18%,transparent)}
|
||||
.lc-3{color:var(--l3);background:color-mix(in srgb,var(--l3) 18%,transparent)}
|
||||
.grp.offline .ico,.grp.offline .ltr{opacity:.65}
|
||||
.d-icon .nmt,.d-icon .stk{display:none}
|
||||
.d-text .ico,.d-text .ltr{display:none}
|
||||
.ver{display:flex;min-width:0;font:12.5px var(--mono);color:var(--dim);white-space:nowrap}
|
||||
.ver .r{overflow:hidden;text-overflow:ellipsis;min-width:0}
|
||||
.ver .t{flex:none}
|
||||
.ver b{color:var(--fg);font-weight:500}
|
||||
.st{display:inline-flex;align-items:center;gap:8px;font-size:13px;font-weight:500;white-space:nowrap}
|
||||
.st svg{flex:none}
|
||||
.st circle{fill:currentColor}
|
||||
.s-running{color:var(--green)}.s-degraded{color:var(--orange)}.s-stopped{color:var(--dim)}.s-unknown{color:var(--dim)}
|
||||
.s-stopped circle,.s-unknown circle{fill:none}
|
||||
.flags{display:flex;flex-wrap:wrap;gap:6px}
|
||||
.tag{font:500 12px/20px var(--sans);padding:0 8px;border-radius:999px;white-space:nowrap}
|
||||
.tag em{font:500 11.5px var(--mono);font-style:normal;margin-left:6px}
|
||||
.tag em:empty{display:none}
|
||||
.f-up{color:var(--orange);background:var(--orangebg)}
|
||||
.f-err{color:var(--red);background:var(--redbg)}
|
||||
.f-notag{color:var(--mut);box-shadow:inset 0 0 0 1px var(--line2)}
|
||||
.f-out{color:var(--dim);box-shadow:inset 0 0 0 1px var(--line)}
|
||||
.mode{display:flex;flex-direction:column;align-items:flex-start;gap:2px}
|
||||
.mode form{margin:0;display:flex;flex-direction:column;align-items:flex-start;gap:2px}
|
||||
.sw{display:inline-flex;align-items:center;gap:8px;padding:0;border:0;background:none;font:inherit;font-size:13px;color:var(--mut);cursor:pointer}
|
||||
.sw i{flex:none;width:30px;height:18px;border-radius:999px;background:var(--line2);position:relative;transition:background .15s}
|
||||
.sw i::after{content:"";position:absolute;top:2px;left:2px;width:14px;height:14px;border-radius:50%;background:var(--fg);transition:transform .15s}
|
||||
.sw[aria-checked=true] i{background:var(--blue)}
|
||||
.sw[aria-checked=true] i::after{transform:translateX(12px);background:var(--onblue)}
|
||||
.sw[aria-checked=true]{color:var(--blue);font-weight:600}
|
||||
.sw:disabled{opacity:.55;cursor:not-allowed}
|
||||
.na{font-size:12.5px;color:var(--dim)}
|
||||
.nomatch{padding:24px 6px;color:var(--dim)}
|
||||
|
||||
/* Agents */
|
||||
.hdr.ruled{padding-bottom:16px;border-bottom:2px solid var(--fg);margin-bottom:0}
|
||||
.agent{position:relative;display:grid;grid-template-columns:minmax(150px,1fr) 130px 90px 110px 120px 84px;grid-template-areas:"id st ver mgr last act";align-items:center;column-gap:18px;padding:16px 6px;border-bottom:1px solid var(--line)}
|
||||
.agent .id{grid-area:id}
|
||||
.agent .id b{display:block;font:700 16px var(--sans)}
|
||||
.agent .id span{font:12.5px var(--mono);color:var(--dim)}
|
||||
.agent .stc{grid-area:st}.agent .ver{grid-area:ver;display:block;font:13px var(--mono);color:var(--mut)}.agent .mgr{grid-area:mgr;font-size:13px;color:var(--mut)}.agent .last{grid-area:last;font-size:13px;color:var(--mut)}.agent .act{grid-area:act;display:flex;justify-content:flex-end}
|
||||
.agent .k{display:block;font:600 10.5px var(--sans);text-transform:uppercase;letter-spacing:.08em;color:var(--dim);margin-bottom:2px}
|
||||
.agent .ver.old{color:var(--orange)}
|
||||
.agent .st{font-size:13.5px;font-weight:600}
|
||||
.agent .st i{width:8px;height:8px;border-radius:50%;background:currentColor}
|
||||
.a-on{color:var(--green)}.a-off{color:var(--red)}.a-never,.a-revoked{color:var(--dim)}
|
||||
.a-off i,.a-never i{background:transparent !important;box-shadow:inset 0 0 0 1.5px currentColor}
|
||||
/* After the .agent rules: a container query adds no specificity, so it must come later to win. */
|
||||
@container (max-width:760px){
|
||||
.agent{grid-template-columns:1fr auto;grid-template-areas:"id st" "ver mgr" "last act";row-gap:10px}
|
||||
}
|
||||
.pop{position:absolute;right:6px;top:calc(100% - 8px);z-index:5;width:360px;padding:14px 16px;border-radius:8px;background:var(--card);border:1px solid var(--line2);box-shadow:var(--shadow);font-size:13px;color:var(--mut)}
|
||||
.pop::before{content:"";position:absolute;top:-6px;right:30px;width:10px;height:10px;background:var(--card);border-left:1px solid var(--line2);border-top:1px solid var(--line2);transform:rotate(45deg)}
|
||||
.pop h4{margin:0 0 4px;font:700 14px var(--sans);color:var(--fg)}
|
||||
.pop p{margin:0 0 12px}
|
||||
.pop .acts{display:flex;gap:8px;justify-content:flex-end;margin:0}
|
||||
.drawer{flex:1 1 440px;min-width:0;max-width:520px;border-left:1px solid var(--line2);background:var(--card);padding:28px 28px 40px;display:flex;flex-direction:column;gap:18px}
|
||||
.dh{display:flex;align-items:center;gap:12px}
|
||||
.dh h2{margin:0;font:700 20px var(--sans);letter-spacing:-.015em}
|
||||
.dh .x{margin-left:auto}
|
||||
.steps{display:flex;gap:8px;font-size:12.5px;color:var(--dim)}
|
||||
.steps span{display:flex;align-items:center;gap:6px}
|
||||
.steps b{display:inline-grid;place-items:center;width:20px;height:20px;border-radius:50%;font:600 11px var(--mono);box-shadow:inset 0 0 0 1px var(--line2)}
|
||||
.steps .done{color:var(--green)}.steps .done b{box-shadow:none;background:var(--green);color:var(--bg)}
|
||||
.steps .now{color:var(--fg)}.steps .now b{box-shadow:none;background:var(--blue);color:var(--onblue)}
|
||||
.steps .sep{width:16px;height:1px;background:var(--line2)}
|
||||
.dform{display:flex;flex-direction:column;gap:18px;margin:0}
|
||||
.field{display:flex;flex-direction:column;gap:6px;font-size:13.5px;color:var(--mut)}
|
||||
.field input{height:36px;padding:0 12px;border-radius:6px;border:1px solid var(--line2);background:var(--bg);color:var(--fg);font:500 14px var(--mono)}
|
||||
.field small{color:var(--dim);font-size:12.5px}
|
||||
.namebox{display:flex;align-items:center;justify-content:space-between;padding:10px 12px;border-radius:6px;background:var(--bg);font-size:13.5px}
|
||||
.namebox code{font:500 14px var(--mono);color:var(--fg)}
|
||||
.notice{display:flex;gap:10px;padding:12px 14px;border-radius:6px;background:var(--orangebg);color:var(--fg);font-size:13.5px}
|
||||
.notice svg{flex:none;color:var(--orange);margin-top:1px}
|
||||
.code{border-radius:6px;background:var(--term);overflow:hidden}
|
||||
.code-h{display:flex;align-items:center;justify-content:space-between;padding:6px 8px 6px 12px;border-bottom:1px solid #1d2230;font:12px var(--mono);color:#8d96a8}
|
||||
.code pre{margin:0;padding:12px;border:0;color:#cdd3df;font:12px/1.6 var(--mono);overflow-x:auto}
|
||||
.secret{display:grid;grid-template-columns:auto 1fr auto;align-items:center;gap:8px 12px;font-size:13px;color:var(--mut)}
|
||||
.secret code{font:12.5px var(--mono);color:var(--fg);overflow-wrap:anywhere}
|
||||
.df{display:flex;gap:8px;justify-content:flex-end;align-items:center;margin-top:auto}
|
||||
.df form{margin:0}
|
||||
.df > span{margin-right:auto;font-size:13px;color:var(--mut);display:flex;align-items:center;gap:8px}
|
||||
.df .ok{color:var(--green)}
|
||||
.spin{width:12px;height:12px;border-radius:50%;box-shadow:inset 0 0 0 2px var(--line2);border-top:2px solid var(--blue);box-sizing:border-box;animation:spin 1s linear infinite}
|
||||
@keyframes spin{to{transform:rotate(360deg)}}
|
||||
|
||||
/* Pages that keep the plain markup: service, jobs, job */
|
||||
h1{font:700 34px/1.1 var(--sans);letter-spacing:-.025em;margin:0 0 18px}
|
||||
h2{font:700 20px var(--sans);letter-spacing:-.015em;margin:28px 0 8px}
|
||||
table{width:100%;border-collapse:collapse;margin-bottom:24px}
|
||||
th,td{text-align:left;padding:6px 8px;border-bottom:1px solid var(--line)}
|
||||
th{color:var(--mut);font-weight:500}
|
||||
code,pre{font:13px var(--mono)}
|
||||
pre{padding:12px;border:1px solid var(--line);border-radius:6px;overflow-x:auto}
|
||||
.badge{font-size:12px;color:var(--mut);border:1px solid var(--line);padding:0 6px;border-radius:8px}
|
||||
.status-running{color:var(--green)}
|
||||
.status-degraded,.status-unknown{color:var(--orange)}
|
||||
.status-stopped{color:var(--red)}
|
||||
.error{color:var(--red)}
|
||||
.warning{color:var(--orange)}
|
||||
.muted{color:var(--dim)}
|
||||
.status-job-succeeded{color:var(--green)}
|
||||
.status-job-queued,.status-job-running{color:var(--orange)}
|
||||
.status-job-failed{color:var(--red)}
|
||||
table.details{width:auto}
|
||||
table.details th{padding-right:24px}
|
||||
pre.log{white-space:pre-wrap}
|
||||
|
||||
@media (max-width:760px){
|
||||
.side{flex:1 1 100%;flex-direction:row;flex-wrap:wrap;align-items:center;gap:8px 16px;padding:12px 16px;border-right:0;border-bottom:1px solid var(--line)}
|
||||
#snav{order:3;width:100%}
|
||||
.snav{flex-direction:row;overflow-x:auto}
|
||||
.snav a{padding:10px 12px}
|
||||
.snav .n{margin-left:4px}
|
||||
.mblock{display:none}
|
||||
.livebox{margin:0 0 0 auto;border:0;padding:0}
|
||||
.livebox #live-age{display:none}
|
||||
.main{padding:20px 16px 40px}
|
||||
.hdr h1{font-size:28px}
|
||||
.hdr .end,.tools .end{margin-left:0}
|
||||
.search{flex:1 1 100%}
|
||||
.btn,button:not([class]){height:44px}
|
||||
.btn.sm{height:36px}
|
||||
.row{grid-template-columns:1fr auto;grid-template-areas:"nm st" "ver ver" "fl fl" "mode mode";row-gap:8px;padding:12px 4px}
|
||||
.nm{grid-area:nm}.stc{grid-area:st}.row .ver{grid-area:ver}.flags{grid-area:fl}.mode{grid-area:mode}
|
||||
.flags:empty{display:none}
|
||||
.agent{grid-template-columns:1fr auto;grid-template-areas:"id st" "ver mgr" "last act";row-gap:10px}
|
||||
.drawer{order:-1;max-width:none;border-left:0;border-bottom:1px solid var(--line2);padding:20px 16px}
|
||||
.pop{left:0;right:0;width:auto}
|
||||
table{display:block;overflow-x:auto}
|
||||
}
|
||||
* { box-sizing: border-box; }
|
||||
body { margin: 0; background: var(--bg); color: var(--fg); font: 14px/1.5 system-ui, sans-serif; }
|
||||
nav { display: flex; gap: 16px; align-items: center; padding: 12px 16px; border-bottom: 1px solid var(--line); }
|
||||
nav form { margin-left: auto; }
|
||||
main { padding: 16px; max-width: 1200px; margin: 0 auto; }
|
||||
a { color: var(--accent); }
|
||||
table { width: 100%; border-collapse: collapse; margin-bottom: 24px; }
|
||||
th, td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--line); }
|
||||
th { color: var(--muted); font-weight: 500; }
|
||||
code, pre { font: 13px ui-monospace, monospace; }
|
||||
pre { padding: 12px; border: 1px solid var(--line); overflow-x: auto; }
|
||||
.badge { font-size: 12px; color: var(--muted); border: 1px solid var(--line); padding: 0 6px; border-radius: 8px; }
|
||||
.status-running { color: var(--ok); }
|
||||
.status-degraded, .status-unknown { color: var(--warn); }
|
||||
.status-stopped { color: var(--bad); }
|
||||
.error { color: var(--bad); }
|
||||
.warning { color: var(--warn); }
|
||||
form.inline { display: flex; gap: 8px; margin-bottom: 16px; }
|
||||
@media (max-width: 600px) { table { display: block; overflow-x: auto; } }
|
||||
.muted { color: var(--muted); }
|
||||
.status-job-succeeded { color: var(--ok); }
|
||||
.status-job-queued, .status-job-running { color: var(--warn); }
|
||||
.status-job-failed { color: var(--bad); }
|
||||
table.details { width: auto; }
|
||||
table.details th { padding-right: 24px; }
|
||||
pre.log { white-space: pre-wrap; }
|
||||
.badge-update { color: var(--warn); border-color: var(--warn); }
|
||||
form.mode { display: inline; margin-left: 8px; }
|
||||
form.mode button { font-size: 12px; padding: 0 6px; }
|
||||
|
||||
@@ -0,0 +1,226 @@
|
||||
// Behaviour the server-rendered pages need in the browser: theme, display
|
||||
// mode, search and machine filter, the Live box, local times, copy buttons and
|
||||
// the revoke popovers. The pages work without it; htmx and the SSE extension
|
||||
// do the live updates. Everything stored in the browser is wrapped in
|
||||
// try/catch because storage can be blocked.
|
||||
(function () {
|
||||
'use strict';
|
||||
var root = document.documentElement;
|
||||
|
||||
function load(area, key) {
|
||||
try { return window[area].getItem(key); } catch (e) { return null; }
|
||||
}
|
||||
function save(area, key, value) {
|
||||
try { window[area].setItem(key, value); } catch (e) { /* storage is blocked */ }
|
||||
}
|
||||
function each(selector, fn) {
|
||||
Array.prototype.forEach.call(document.querySelectorAll(selector), fn);
|
||||
}
|
||||
|
||||
// Theme: the head script set the initial class; the toggle overrides it.
|
||||
var colorScheme = window.matchMedia ? window.matchMedia('(prefers-color-scheme: light)') : null;
|
||||
var themeButton = document.getElementById('theme-toggle');
|
||||
if (themeButton) {
|
||||
themeButton.addEventListener('click', function () {
|
||||
var light = !root.classList.contains('t-light');
|
||||
root.classList.toggle('t-light', light);
|
||||
themeButton.setAttribute('aria-pressed', String(light));
|
||||
save('localStorage', 'pu-theme', light ? 'light' : 'dark');
|
||||
});
|
||||
themeButton.setAttribute('aria-pressed', String(root.classList.contains('t-light')));
|
||||
}
|
||||
if (colorScheme && colorScheme.addEventListener) {
|
||||
colorScheme.addEventListener('change', function (e) {
|
||||
if (!load('localStorage', 'pu-theme')) root.classList.toggle('t-light', e.matches);
|
||||
});
|
||||
}
|
||||
|
||||
// Display mode: icon, icon + text, or text.
|
||||
function setDisplay(mode) {
|
||||
['icon', 'both', 'text'].forEach(function (m) { root.classList.toggle('d-' + m, m === mode); });
|
||||
each('[data-display]', function (b) { b.setAttribute('aria-pressed', String(b.dataset.display === mode)); });
|
||||
}
|
||||
setDisplay(root.classList.contains('d-icon') ? 'icon' : root.classList.contains('d-text') ? 'text' : 'both');
|
||||
|
||||
// Search and machine filter. The rows are all in the page; this hides them.
|
||||
var filter = { q: '', machine: '' };
|
||||
try {
|
||||
var saved = JSON.parse(load('sessionStorage', 'pu-filter') || '{}');
|
||||
if (typeof saved.q === 'string') filter.q = saved.q;
|
||||
if (typeof saved.machine === 'string') filter.machine = saved.machine;
|
||||
} catch (e) { /* ignore a broken saved filter */ }
|
||||
var search = document.getElementById('q');
|
||||
if (search) search.value = filter.q;
|
||||
|
||||
// The machine list is hidden on narrow screens; a filter that cannot be
|
||||
// seen or cleared there is ignored. Search still applies.
|
||||
var narrow = window.matchMedia ? window.matchMedia('(max-width:760px)') : null;
|
||||
|
||||
function applyFilter() {
|
||||
var box = document.getElementById('services');
|
||||
if (!box) return;
|
||||
var groups = box.querySelectorAll('.grp');
|
||||
var known = Array.prototype.some.call(groups, function (g) { return g.dataset.key === filter.machine; });
|
||||
if (filter.machine && !known) filter.machine = '';
|
||||
var machine = narrow && narrow.matches ? '' : filter.machine;
|
||||
var q = filter.q.trim().toLowerCase();
|
||||
var any = false;
|
||||
Array.prototype.forEach.call(groups, function (g) {
|
||||
var inMachine = !machine || g.dataset.key === machine;
|
||||
var shown = 0;
|
||||
Array.prototype.forEach.call(g.querySelectorAll('.row'), function (row) {
|
||||
var match = inMachine && (!q || (row.dataset.search || '').indexOf(q) !== -1);
|
||||
row.hidden = !match;
|
||||
if (match) shown++;
|
||||
});
|
||||
g.hidden = shown === 0;
|
||||
if (shown > 0) any = true;
|
||||
});
|
||||
var none = document.getElementById('nomatch');
|
||||
if (none) none.hidden = any || groups.length === 0;
|
||||
each('#machines a', function (a) {
|
||||
var cur = a.dataset.machine === filter.machine;
|
||||
a.classList.toggle('cur', cur);
|
||||
if (cur) a.setAttribute('aria-current', 'true'); else a.removeAttribute('aria-current');
|
||||
});
|
||||
}
|
||||
if (narrow && narrow.addEventListener) narrow.addEventListener('change', function () { applyFilter(); });
|
||||
function saveFilter() { save('sessionStorage', 'pu-filter', JSON.stringify(filter)); }
|
||||
|
||||
if (search) {
|
||||
search.addEventListener('input', function () { filter.q = search.value; saveFilter(); applyFilter(); });
|
||||
}
|
||||
|
||||
// Live box: counts any event on the stream, including the server's ping.
|
||||
var live = document.getElementById('live');
|
||||
var liveAge = document.getElementById('live-age');
|
||||
var lastEvent = null;
|
||||
var down = false;
|
||||
var wired = typeof WeakSet === 'function' ? new WeakSet() : null;
|
||||
function touch() { lastEvent = Date.now(); }
|
||||
document.addEventListener('htmx:sseOpen', function (e) {
|
||||
var source = e.detail && e.detail.source;
|
||||
touch();
|
||||
down = false;
|
||||
if (source && wired && !wired.has(source)) {
|
||||
wired.add(source);
|
||||
['ping', 'services', 'agents', 'jobs'].forEach(function (name) { source.addEventListener(name, touch); });
|
||||
}
|
||||
});
|
||||
document.addEventListener('htmx:sseError', function () { down = true; });
|
||||
function renderLive() {
|
||||
if (!live || !liveAge) return;
|
||||
live.classList.toggle('down', down);
|
||||
if (down) { liveAge.textContent = 'Reconnecting…'; return; }
|
||||
if (lastEvent === null) { liveAge.textContent = 'connecting…'; return; }
|
||||
var s = Math.max(0, Math.round((Date.now() - lastEvent) / 1000));
|
||||
liveAge.textContent = 'last event ' + (s < 60 ? s + ' s ago' : Math.floor(s / 60) + ' min ago');
|
||||
}
|
||||
|
||||
// Times: the server writes <time datetime="..."> with its own clock as
|
||||
// fallback text; show them in the browser's time zone.
|
||||
var months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
|
||||
function pad(n) { return (n < 10 ? '0' : '') + n; }
|
||||
function localiseTimes() {
|
||||
each('time[datetime]', function (t) {
|
||||
var d = new Date(t.getAttribute('datetime'));
|
||||
if (isNaN(d.getTime())) return;
|
||||
var text;
|
||||
if (t.hasAttribute('data-rel')) {
|
||||
var min = Math.floor((Date.now() - d.getTime()) / 60000);
|
||||
text = min < 1 ? 'just now' : min < 60 ? min + ' min ago' : min < 1440 ? Math.floor(min / 60) + ' h ago' : Math.floor(min / 1440) + ' d ago';
|
||||
t.title = d.toLocaleString();
|
||||
} else {
|
||||
var clock = pad(d.getHours()) + ':' + pad(d.getMinutes());
|
||||
text = d.toDateString() === new Date().toDateString() ? clock : months[d.getMonth()] + ' ' + d.getDate() + ' ' + clock;
|
||||
}
|
||||
if (t.textContent !== text) t.textContent = text;
|
||||
});
|
||||
}
|
||||
|
||||
// Copy buttons: data-copy holds the text, data-copy-target the id of the element to copy.
|
||||
function flash(button, text) {
|
||||
if (!button.dataset.label) button.dataset.label = button.textContent;
|
||||
button.textContent = text;
|
||||
setTimeout(function () { button.textContent = button.dataset.label; }, 2000);
|
||||
}
|
||||
function copyFallback(button, text) {
|
||||
var target = button.dataset.copyTarget ? document.getElementById(button.dataset.copyTarget) : null;
|
||||
if (target) {
|
||||
var range = document.createRange();
|
||||
range.selectNodeContents(target);
|
||||
var selection = window.getSelection();
|
||||
selection.removeAllRanges();
|
||||
selection.addRange(range);
|
||||
flash(button, 'Press Ctrl+C');
|
||||
return;
|
||||
}
|
||||
var area = document.createElement('textarea');
|
||||
area.value = text;
|
||||
area.setAttribute('readonly', '');
|
||||
area.style.position = 'fixed';
|
||||
area.style.opacity = '0';
|
||||
document.body.appendChild(area);
|
||||
area.select();
|
||||
var ok = false;
|
||||
try { ok = document.execCommand('copy'); } catch (e) { /* not allowed */ }
|
||||
document.body.removeChild(area);
|
||||
flash(button, ok ? 'Copied' : 'Copy failed');
|
||||
}
|
||||
|
||||
// Revoke popovers are <details>. A swap of the agent list would close them, so reopen those that were open.
|
||||
var openRevokes = [];
|
||||
|
||||
document.addEventListener('click', function (e) {
|
||||
var display = e.target.closest('[data-display]');
|
||||
if (display) {
|
||||
setDisplay(display.dataset.display);
|
||||
save('localStorage', 'pu-display', display.dataset.display);
|
||||
return;
|
||||
}
|
||||
var machine = e.target.closest('#machines a');
|
||||
if (machine) {
|
||||
e.preventDefault();
|
||||
filter.machine = filter.machine === machine.dataset.machine ? '' : machine.dataset.machine;
|
||||
saveFilter();
|
||||
applyFilter();
|
||||
return;
|
||||
}
|
||||
var close = e.target.closest('[data-close]');
|
||||
if (close) {
|
||||
var details = close.closest('details');
|
||||
if (details) details.open = false;
|
||||
return;
|
||||
}
|
||||
var copy = e.target.closest('[data-copy], [data-copy-target]');
|
||||
if (copy) {
|
||||
var text = copy.dataset.copy;
|
||||
if (text === undefined) {
|
||||
var el = document.getElementById(copy.dataset.copyTarget);
|
||||
text = el ? el.textContent : '';
|
||||
}
|
||||
if (navigator.clipboard && navigator.clipboard.writeText) {
|
||||
navigator.clipboard.writeText(text).then(function () { flash(copy, 'Copied'); }, function () { copyFallback(copy, text); });
|
||||
} else {
|
||||
copyFallback(copy, text);
|
||||
}
|
||||
}
|
||||
});
|
||||
document.addEventListener('keydown', function (e) {
|
||||
if (e.key === 'Escape') each('details.rv[open]', function (d) { d.open = false; });
|
||||
});
|
||||
document.addEventListener('htmx:beforeSwap', function () {
|
||||
openRevokes = [];
|
||||
each('details.rv[open]', function (d) { openRevokes.push(d.dataset.id); });
|
||||
});
|
||||
document.addEventListener('htmx:afterSwap', function () {
|
||||
each('details.rv', function (d) { if (openRevokes.indexOf(d.dataset.id) !== -1) d.open = true; });
|
||||
});
|
||||
document.addEventListener('htmx:afterSettle', function () { applyFilter(); localiseTimes(); });
|
||||
|
||||
applyFilter();
|
||||
localiseTimes();
|
||||
renderLive();
|
||||
setInterval(renderLive, 1000);
|
||||
setInterval(localiseTimes, 15000);
|
||||
})();
|
||||
Binary file not shown.
Binary file not shown.
@@ -1,6 +0,0 @@
|
||||
{{define "content"}}
|
||||
<h1>Agent "{{.Created.Name}}" created</h1>
|
||||
<p class="warning">The token is shown only once. Save this as <code>docker-compose.yml</code> on the machine and run <code>docker compose up -d</code>.</p>
|
||||
<pre>{{.Snippet}}</pre>
|
||||
<p><a href="/agents">Back to agents</a></p>
|
||||
{{end}}
|
||||
@@ -1,38 +1,108 @@
|
||||
{{define "content"}}
|
||||
<h1>Agents</h1>
|
||||
<form method="post" action="/agents" class="inline">
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRF}}">
|
||||
<label>Name <input name="name" required placeholder="node-2"></label>
|
||||
<button type="submit">Add agent</button>
|
||||
</form>
|
||||
{{if .Error}}<p class="error">{{.Error}}</p>{{end}}
|
||||
<div class="hdr ruled">
|
||||
<h1>Agents</h1>
|
||||
<span class="sub" id="agents-sub">{{template "agents-sub" .}}</span>
|
||||
<div class="end"><a class="btn pri" href="/agents?add=1">Add agent</a></div>
|
||||
</div>
|
||||
<div id="agents" hx-get="/fragments/agents" hx-trigger="sse:agents" hx-swap="innerHTML">
|
||||
{{template "agents" .}}
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "agents"}}
|
||||
<table>
|
||||
<thead><tr><th>Name</th><th>Hostname</th><th>State</th><th>Version</th><th>Swarm manager</th><th>Last seen</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
{{range .Agents}}
|
||||
<tr>
|
||||
<td>{{.Name}}</td>
|
||||
<td>{{.Hostname}}</td>
|
||||
<td>{{if .RevokedAt}}<span class="status status-stopped">revoked</span>{{else if .Online}}<span class="status status-running">online</span>{{else}}<span class="status status-degraded">offline</span>{{end}}</td>
|
||||
<td>{{.AgentVersion}}</td>
|
||||
<td>{{if .SwarmManager}}yes{{end}}</td>
|
||||
<td>{{with .LastSeenAt}}{{.Format "2006-01-02 15:04"}}{{end}}</td>
|
||||
<td>{{if not .RevokedAt}}
|
||||
<form method="post" action="/agents/{{.ID}}/revoke" onsubmit="return confirm('Revoke {{.Name}}? It is disconnected immediately and must be added again to come back.')">
|
||||
<input type="hidden" name="csrf_token" value="{{$.CSRF}}">
|
||||
<button type="submit">Revoke</button>
|
||||
</form>
|
||||
{{end}}</td>
|
||||
</tr>
|
||||
{{else}}
|
||||
<tr><td colspan="7">No agents yet.</td></tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
{{define "agents-sub"}}{{.Nav.AgentsTotal}} {{if eq .Nav.AgentsTotal 1}}machine{{else}}machines{{end}}{{if .MasterVersion}} · master {{.MasterVersion}}{{end}}{{end}}
|
||||
|
||||
{{/* What /fragments/agents returns: the list, and the header count swapped in out of band. */}}
|
||||
{{define "agents-fragment"}}
|
||||
{{template "agents" .}}
|
||||
<span class="sub" id="agents-sub" hx-swap-oob="true">{{template "agents-sub" .}}</span>
|
||||
{{end}}
|
||||
|
||||
{{define "agents"}}
|
||||
{{range .Agents}}
|
||||
<div class="agent">
|
||||
<div class="id"><b>{{.Name}}</b><span>{{.Hostname}}</span></div>
|
||||
<div class="stc"><span class="st {{.StatusClass}}"><i></i>{{.Status}}</span></div>
|
||||
<div class="ver{{if .VersionOld}} old{{end}}"><span class="k">Agent</span>{{.AgentVersion}}</div>
|
||||
<div class="mgr"><span class="k">Swarm</span>{{.Role}}</div>
|
||||
<div class="last"><span class="k">Last seen</span>{{if .Online}}now{{else}}{{with .LastSeenAt}}<time datetime="{{.Format "2006-01-02T15:04:05Z07:00"}}" data-rel>{{.Format "2006-01-02 15:04"}}</time>{{else}}—{{end}}{{end}}</div>
|
||||
<div class="act">{{if not .RevokedAt}}
|
||||
<details class="rv" data-id="{{.ID}}">
|
||||
<summary class="btn sm red">Revoke</summary>
|
||||
<div class="pop" role="dialog" aria-label="Confirm revoke">
|
||||
<h4>Revoke {{.Name}}?</h4>
|
||||
<p>Its token stops working immediately. Services on {{.Name}} keep running, but drop out of package-updater.</p>
|
||||
<form method="post" action="/agents/{{.ID}}/revoke" class="acts">
|
||||
<input type="hidden" name="csrf_token" value="{{$.CSRF}}">
|
||||
<button type="button" class="btn sm quiet" data-close>Cancel</button>
|
||||
<button type="submit" class="btn sm redfill">Revoke</button>
|
||||
</form>
|
||||
</div>
|
||||
</details>
|
||||
{{end}}</div>
|
||||
</div>
|
||||
{{else}}
|
||||
<p class="nomatch">No agents yet.</p>
|
||||
{{end}}
|
||||
{{end}}
|
||||
|
||||
{{/* The "add agent" panel beside the list. Step 1 asks for a name, step 2 shows the one-time token, step 3 waits for the agent to connect. */}}
|
||||
{{define "drawer"}}
|
||||
{{if .AddStep}}
|
||||
<section class="drawer" aria-label="Add agent">
|
||||
<div class="dh">
|
||||
<h2>Add agent</h2>
|
||||
<a class="btn sm quiet x" href="/agents" aria-label="Close">
|
||||
<svg width="14" height="14" viewBox="0 0 14 14" fill="none" stroke="currentColor" stroke-width="1.6" aria-hidden="true"><path d="M3 3l8 8M11 3l-8 8"></path></svg>
|
||||
</a>
|
||||
</div>
|
||||
{{if eq .AddStep 1}}
|
||||
<div class="steps" id="add-steps">{{template "steps" 1}}</div>
|
||||
<form method="post" action="/agents" class="dform">
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRF}}">
|
||||
<label class="field">Name
|
||||
<input name="name" required autofocus autocomplete="off" placeholder="node-2" value="{{.FormName}}">
|
||||
<small>Lowercase letters, digits and dashes. Use the machine's name.</small>
|
||||
</label>
|
||||
{{if .Error}}<p class="error" role="alert">{{.Error}}</p>{{end}}
|
||||
<div class="df">
|
||||
<a class="btn quiet" href="/agents">Cancel</a>
|
||||
<button type="submit" class="btn pri">Create agent</button>
|
||||
</div>
|
||||
</form>
|
||||
{{else}}
|
||||
<div class="steps" id="add-steps">{{template "steps" 2}}</div>
|
||||
<div class="namebox"><span>Name</span><code>{{.Created.Name}}</code></div>
|
||||
<div class="notice" role="note">
|
||||
<svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true"><path d="M8 1.8L15 14H1L8 1.8z"></path><path d="M8 6.5v3.5M8 12v.01"></path></svg>
|
||||
<span><b>This token is shown only once.</b> Save the snippet as <code>docker-compose.yml</code> on the machine and run <code>docker compose up -d</code>.</span>
|
||||
</div>
|
||||
<div class="code">
|
||||
<div class="code-h"><span>docker-compose.yml</span><button type="button" class="btn sm" data-copy-target="snippet">Copy</button></div>
|
||||
<pre id="snippet">{{.Snippet}}</pre>
|
||||
</div>
|
||||
<div class="secret">
|
||||
<span>Token</span><code>{{middle .Token}}</code><button type="button" class="btn sm" data-copy="{{.Token}}">Copy</button>
|
||||
<span>Master key</span><code>{{middle .MasterKey}}</code><button type="button" class="btn sm" data-copy="{{.MasterKey}}">Copy</button>
|
||||
</div>
|
||||
<div class="df" id="connect" hx-get="/fragments/agents/{{.Created.ID}}/connect" hx-trigger="load, sse:agents" hx-swap="innerHTML">
|
||||
{{template "connect" .}}
|
||||
</div>
|
||||
{{end}}
|
||||
</section>
|
||||
{{end}}
|
||||
{{end}}
|
||||
|
||||
{{/* step is the one in progress (1 to 3); 4 marks all three as done. */}}
|
||||
{{define "steps"}}<span class="{{if gt . 1}}done{{else}}now{{end}}"><b>1</b>Name</span><span class="sep"></span><span class="{{if gt . 2}}done{{else if eq . 2}}now{{end}}"><b>2</b>Deploy</span><span class="sep"></span><span class="{{if gt . 3}}done{{else if eq . 3}}now{{end}}"><b>3</b>Connect</span>{{end}}
|
||||
|
||||
{{/* Step 3. Until the agent has connected, Cancel revokes the token that was just created. */}}
|
||||
{{define "connect"}}{{if .Connected}}<span class="ok">Connected · {{.Created.Hostname}} · {{.Created.AgentVersion}}</span>
|
||||
<a class="btn pri" href="/agents">Done</a>
|
||||
<div id="add-steps" hx-swap-oob="innerHTML">{{template "steps" 4}}</div>
|
||||
{{else}}<span><span class="spin" aria-hidden="true"></span>Waiting for {{.Created.Name}}…</span>
|
||||
<form method="post" action="/agents/{{.Created.ID}}/revoke">
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRF}}">
|
||||
<button type="submit" class="btn quiet">Cancel</button>
|
||||
</form>
|
||||
<a class="btn pri" href="/agents">Done</a>
|
||||
{{end}}{{end}}
|
||||
|
||||
@@ -1,23 +1,62 @@
|
||||
{{define "layout"}}<!doctype html>
|
||||
<html lang="en">
|
||||
<html lang="en" class="app">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="color-scheme" content="dark light">
|
||||
<title>{{.Title}} · package-updater</title>
|
||||
<script>
|
||||
// Sets the theme and the display mode before first paint. app.js changes them later.
|
||||
(function () {
|
||||
var root = document.documentElement, theme = null, display = null;
|
||||
try { theme = localStorage.getItem('pu-theme'); display = localStorage.getItem('pu-display'); } catch (e) {}
|
||||
if (theme !== 'light' && theme !== 'dark') {
|
||||
theme = window.matchMedia && window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark';
|
||||
}
|
||||
if (theme === 'light') root.classList.add('t-light');
|
||||
root.classList.add(display === 'icon' || display === 'text' ? 'd-' + display : 'd-both');
|
||||
})();
|
||||
</script>
|
||||
<link rel="preload" href="/static/schibsted-grotesk-latin-wght-normal.woff2" as="font" type="font/woff2" crossorigin>
|
||||
<link rel="stylesheet" href="/static/app.css">
|
||||
<script src="/static/htmx.min.js"></script>
|
||||
<script src="/static/htmx-ext-sse.js"></script>
|
||||
<script src="/static/app.js" defer></script>
|
||||
</head>
|
||||
<body hx-headers='{"X-CSRF-Token": "{{.CSRF}}"}' hx-ext="sse" sse-connect="/events">
|
||||
<nav>
|
||||
<a href="/">Services</a>
|
||||
<a href="/jobs">Jobs</a>
|
||||
<a href="/agents">Agents</a>
|
||||
<form method="post" action="/auth/logout">
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRF}}">
|
||||
<button type="submit">Log out</button>
|
||||
</form>
|
||||
</nav>
|
||||
<main>{{template "content" .}}</main>
|
||||
<div class="shell">
|
||||
<aside class="side">
|
||||
<div class="brand">
|
||||
<svg width="20" height="20" viewBox="0 0 20 20" fill="none" stroke="currentColor" stroke-width="1.7" aria-hidden="true"><path d="M3 6h14M3 10h9M3 14h6"></path><path d="M15 16V10m-2.5 2.5L15 10l2.5 2.5"></path></svg>
|
||||
package-updater
|
||||
</div>
|
||||
<div id="snav" hx-get="/fragments/nav?section={{.Nav.Section}}" hx-trigger="sse:services, sse:agents" hx-swap="innerHTML">{{template "nav" .}}</div>
|
||||
{{block "machines" .}}{{end}}
|
||||
<div class="livebox" id="live">
|
||||
<b><span class="pulse" aria-hidden="true"></span>Live</b>
|
||||
<span id="live-age">connecting…</span>
|
||||
</div>
|
||||
<div class="sfoot">
|
||||
<button type="button" class="btn sm quiet" id="theme-toggle">
|
||||
<svg width="14" height="14" viewBox="0 0 14 14" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true"><circle cx="7" cy="7" r="5"></circle><path d="M7 2v10" ></path></svg>
|
||||
Theme
|
||||
</button>
|
||||
<form method="post" action="/auth/logout">
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRF}}">
|
||||
<button type="submit" class="btn sm quiet">Log out</button>
|
||||
</form>
|
||||
</div>
|
||||
</aside>
|
||||
<div class="work">
|
||||
<main class="main">{{template "content" .}}</main>
|
||||
{{block "drawer" .}}{{end}}
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>{{end}}
|
||||
|
||||
{{define "nav"}}<nav class="snav" aria-label="Main">
|
||||
<a href="/"{{if eq .Nav.Section "services"}} class="cur" aria-current="page"{{end}}>Services <span class="n">{{.Nav.Services}}</span></a>
|
||||
<a href="/jobs"{{if eq .Nav.Section "jobs"}} class="cur" aria-current="page"{{end}}>Jobs</a>
|
||||
<a href="/agents"{{if eq .Nav.Section "agents"}} class="cur" aria-current="page"{{end}}>Agents <span class="n">{{.Nav.AgentsOnline}}/{{.Nav.AgentsTotal}}</span></a>
|
||||
</nav>{{end}}
|
||||
|
||||
@@ -1,38 +1,103 @@
|
||||
{{define "content"}}
|
||||
<h1>Services</h1>
|
||||
<div id="services" hx-get="/fragments/services" hx-trigger="sse:services" hx-swap="innerHTML">
|
||||
<div class="hdr">
|
||||
<h1>Services</h1>
|
||||
</div>
|
||||
<div class="tools">
|
||||
<label class="search">
|
||||
<svg width="15" height="15" viewBox="0 0 15 15" fill="none" stroke="currentColor" stroke-width="1.6" aria-hidden="true"><circle cx="6.5" cy="6.5" r="5"></circle><path d="M10.3 10.3L14 14"></path></svg>
|
||||
<input type="search" id="q" placeholder="Search services" aria-label="Search services" autocomplete="off">
|
||||
</label>
|
||||
<div class="end">
|
||||
<span class="lbl" id="showlbl">Show</span>
|
||||
<div class="seg" role="group" aria-labelledby="showlbl">
|
||||
<button type="button" data-display="icon" aria-pressed="false">
|
||||
<svg width="14" height="14" viewBox="0 0 14 14" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true"><rect x="2" y="2" width="10" height="10" rx="2.5"></rect></svg>
|
||||
Icon
|
||||
</button>
|
||||
<button type="button" data-display="both" aria-pressed="true">
|
||||
<svg width="18" height="14" viewBox="0 0 18 14" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true"><rect x="1" y="3" width="8" height="8" rx="2"></rect><path d="M12 7h5"></path></svg>
|
||||
Icon + text
|
||||
</button>
|
||||
<button type="button" data-display="text" aria-pressed="false">
|
||||
<svg width="14" height="14" viewBox="0 0 14 14" fill="none" stroke="currentColor" stroke-width="1.5" aria-hidden="true"><path d="M2 4.5h10M2 9.5h7"></path></svg>
|
||||
Text
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id="services" hx-get="/fragments/services" hx-trigger="sse:services, sse:agents" hx-swap="innerHTML">
|
||||
{{template "services" .}}
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "services"}}
|
||||
{{/* The machine filter in the sidebar. The page defines it; the services fragment replaces its links out of band. */}}
|
||||
{{define "machines"}}
|
||||
<div class="mblock">
|
||||
<div class="slabel">Machines</div>
|
||||
<nav class="mlist" id="machines" aria-label="Filter by machine">{{template "machine-links" .}}</nav>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "machine-links"}}
|
||||
<a class="cur" href="/" aria-current="true" data-machine="">All <span class="n">{{.ServiceCount}}</span></a>
|
||||
{{range .Groups}}
|
||||
<section>
|
||||
<h2>{{.Title}}</h2>
|
||||
<table>
|
||||
<thead><tr><th>Service</th><th>Image</th><th>Status</th><th>Mode</th></tr></thead>
|
||||
<tbody>
|
||||
{{range .Services}}
|
||||
<tr>
|
||||
<td><a href="/services/{{.ID}}">{{.DisplayName}}</a>{{if .Self}} <span class="badge">managed outside</span>{{end}}{{if .AvailableRef}} <span class="badge badge-update" title="{{.AvailableRef}}">update available</span>{{end}}</td>
|
||||
<td><code>{{shortRef .ActualRef}}</code></td>
|
||||
<td class="status status-{{.Status}}">{{.Status}}</td>
|
||||
<td>{{.UpdateMode}}
|
||||
<form method="post" action="/services/{{.ID}}/mode" class="mode">
|
||||
<input type="hidden" name="csrf_token" value="{{$.CSRF}}">
|
||||
<input type="hidden" name="return" value="overview">
|
||||
{{if eq .UpdateMode "auto"}}<input type="hidden" name="mode" value="manual">
|
||||
<button type="submit">Make manual</button>
|
||||
{{else}}<input type="hidden" name="mode" value="auto">
|
||||
<button type="submit"{{if .AutoBlocked}} disabled{{end}}>Make auto</button>{{if .AutoBlocked}} <span class="muted">{{.AutoBlocked}}</span>{{end}}{{end}}
|
||||
</form>
|
||||
</td>
|
||||
</tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
<a href="/"{{if .Sub}} class="sub"{{end}} data-machine="{{.Key}}">{{if .Cluster}}<span class="sw-icon" aria-hidden="true"></span>{{else}}<span class="mdot{{if .Offline}} off{{end}}" aria-hidden="true"></span>{{end}}{{.Title}} <span class="n">{{len .Services}}</span></a>
|
||||
{{end}}
|
||||
{{end}}
|
||||
|
||||
{{/* What /fragments/services returns: the groups, and the machine filter swapped in out of band. */}}
|
||||
{{define "services-fragment"}}
|
||||
{{template "services" .}}
|
||||
<div id="machines" hx-swap-oob="innerHTML">{{template "machine-links" .}}</div>
|
||||
{{end}}
|
||||
|
||||
{{define "services"}}
|
||||
{{if .Sprite}}<svg class="sprite" aria-hidden="true">{{range .Sprite}}<symbol id="si-{{.Slug}}" viewBox="0 0 24 24"><path fill="currentColor" d="{{.Path}}"/></symbol>{{end}}</svg>{{end}}
|
||||
{{range .Groups}}
|
||||
<section class="grp{{if .Offline}} offline{{end}}" data-key="{{.Key}}" aria-label="{{.Title}}">
|
||||
<div class="gh">
|
||||
<h2{{if .TitleHint}} title="{{.TitleHint}}"{{end}}>{{.Title}}</h2>
|
||||
<span class="kind">{{.Kind}}</span>
|
||||
{{if .Meta}}<span class="meta">{{.Meta}}</span>{{end}}
|
||||
{{if .Offline}}<span class="warn">{{.OfflineLabel}}{{with .OfflineSince}} since <time datetime="{{.Format "2006-01-02T15:04:05Z07:00"}}">{{.Format "15:04"}}</time>{{end}} · showing last known state</span>{{end}}
|
||||
<span class="count">{{len .Services}}</span>
|
||||
</div>
|
||||
{{range .Services}}
|
||||
<div class="row" data-search="{{.Search}}">
|
||||
<div class="nm">
|
||||
<a href="/services/{{.ID}}" title="{{.DisplayName}}" aria-label="{{.DisplayName}}">
|
||||
{{if .Icon}}<span class="ico" aria-hidden="true"><svg width="15" height="15" viewBox="0 0 24 24"><use href="#si-{{.Icon}}"></use></svg></span>{{else}}<span class="ltr {{.LetterClass}}" aria-hidden="true">{{.Letter}}</span>{{end}}
|
||||
<span class="nmt">{{.Name}}</span>
|
||||
</a>
|
||||
{{if .Stack}}<span class="stk">{{.Stack}}</span>{{end}}
|
||||
</div>
|
||||
<div class="ver" title="{{.ActualRef}}"><span class="r">{{.Repo}}</span><span class="t"><b>{{.Tag}}</b>{{.Digest}}</span></div>
|
||||
<div class="stc">
|
||||
<span class="st {{.StatusClass}}"><svg width="10" height="10" viewBox="0 0 10 10" aria-hidden="true"><circle cx="5" cy="5" r="4" stroke="currentColor" stroke-width="1.5"></circle></svg>{{.StatusLabel}}</span>
|
||||
</div>
|
||||
<div class="flags">
|
||||
{{if .AvailableRef}}<span class="tag f-up" title="{{.AvailableRef}}">Update available<em>{{.AvailableTag}}</em></span>{{end}}
|
||||
{{if followsNoTag .Service}}<span class="tag f-notag">Follows no tag</span>{{end}}
|
||||
{{if .LastPollError}}<span class="tag f-err" title="{{.LastPollError}}">Poll failed</span>{{end}}
|
||||
{{if .Self}}<span class="tag f-out">Managed outside</span>{{end}}
|
||||
</div>
|
||||
<div class="mode">
|
||||
{{if .Self}}<span class="na">n/a</span>
|
||||
{{else}}<form method="post" action="/services/{{.ID}}/mode">
|
||||
<input type="hidden" name="csrf_token" value="{{$.CSRF}}">
|
||||
<input type="hidden" name="return" value="overview">
|
||||
{{if eq .UpdateMode "auto"}}<input type="hidden" name="mode" value="manual">
|
||||
<button type="submit" class="sw" role="switch" aria-checked="true"><i></i>Auto</button>
|
||||
{{else}}<input type="hidden" name="mode" value="auto">
|
||||
<button type="submit" class="sw" role="switch" aria-checked="false"{{if .AutoBlocked}} disabled title="{{.AutoBlocked}}"{{end}}><i></i>Manual</button>
|
||||
{{if .AutoBlocked}}<span class="na">{{.AutoBlocked}}</span>{{end}}{{end}}
|
||||
</form>{{end}}
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
</section>
|
||||
{{else}}
|
||||
<p>No services reported yet. <a href="/agents">Add an agent</a> to get started.</p>
|
||||
<p>No services reported yet. <a href="/agents?add=1">Add an agent</a> to get started.</p>
|
||||
{{end}}
|
||||
<p class="nomatch" id="nomatch" hidden>No services match.</p>
|
||||
{{end}}
|
||||
|
||||
@@ -10,6 +10,7 @@
|
||||
{{if .Service.DesiredRef}}<tr><th>Desired image</th><td><code>{{shortRef .Service.DesiredRef}}</code></td></tr>{{end}}
|
||||
{{if .Service.AvailableRef}}<tr><th>Available</th><td><code>{{.Service.AvailableRef}}</code> <span class="muted">via {{.Service.AvailableSource}}{{with .Service.AvailableAt}}, {{.Format "2006-01-02 15:04"}}{{end}}</span></td></tr>{{end}}
|
||||
<tr><th>Mode</th><td>{{.Service.UpdateMode}}</td></tr>
|
||||
<tr><th>Polling</th><td{{if .PollFailed}} class="error"{{end}}>{{.Polling}}</td></tr>
|
||||
{{if .ConfigFiles}}<tr><th>Config files</th><td>{{range .ConfigFiles}}<code>{{.}}</code><br>{{end}}</td></tr>{{end}}
|
||||
</table>
|
||||
{{if .Reason}}
|
||||
@@ -31,6 +32,29 @@
|
||||
<p class="muted">{{if .AutoBlocked}}Auto unavailable: {{.AutoBlocked}}.{{else}}The webhook will update this service as soon as CI pushes a new image.{{end}}</p>
|
||||
{{end}}
|
||||
</form>
|
||||
<h2>Versions</h2>
|
||||
{{if eq .Service.UpdateMode "auto"}}<p class="warning">This service is in auto mode: a version picked here is replaced again when a newer version is announced or found by polling.</p>{{end}}
|
||||
<table>
|
||||
<thead><tr><th>Version</th><th>Seen via</th><th>First seen</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
{{range .Versions}}
|
||||
<tr>
|
||||
<td><code title="{{.Ref}}">{{shortRef .Ref}}</code>{{if .Running}} <span class="badge">running</span>{{end}}{{if not .Tag}} <span class="muted">the service will follow no tag afterwards</span>{{end}}</td>
|
||||
<td>{{.Source}}</td>
|
||||
<td>{{.FirstSeenAt.Format "2006-01-02 15:04"}}</td>
|
||||
{{/* AutoBlocked is the same check that decides whether the service can be updated with an explicit ref, which is what a pick is. */}}
|
||||
<td>{{if not $.AutoBlocked}}
|
||||
<form method="post" action="/services/{{$.Service.ID}}/update">
|
||||
<input type="hidden" name="csrf_token" value="{{$.CSRF}}">
|
||||
<input type="hidden" name="version" value="{{.ID}}">
|
||||
<button type="submit">Deploy</button>
|
||||
</form>{{end}}</td>
|
||||
</tr>
|
||||
{{else}}
|
||||
<tr><td colspan="4">No versions seen yet.</td></tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
<h2>Update history</h2>
|
||||
<div id="history" hx-get="/fragments/services/{{.Service.ID}}/jobs" hx-trigger="sse:jobs" hx-swap="innerHTML">
|
||||
{{template "history" .}}
|
||||
|
||||
@@ -0,0 +1,221 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
)
|
||||
|
||||
const sluskRepo = "gitea.shcizo.se/shcizo/slusk"
|
||||
|
||||
func TestServicePage_VersionPicker(t *testing.T) {
|
||||
srv, store, _, _, _ := newTestEnv(t)
|
||||
store.services[0].ImageRepo = sluskRepo
|
||||
store.services[0].ActualDigest = "sha256:cur"
|
||||
first := time.Date(2026, 10, 12, 9, 5, 0, 0, time.UTC)
|
||||
store.versions = []model.ImageVersion{
|
||||
{ID: 31, Repo: sluskRepo, Tag: "1.5.0", Digest: "sha256:" + strings.Repeat("a", 40), Source: "poll", FirstSeenAt: first},
|
||||
{ID: 32, Repo: sluskRepo, Tag: "1.4.2", Digest: "sha256:cur", Source: "running", FirstSeenAt: first},
|
||||
{ID: 33, Repo: sluskRepo, Digest: "sha256:" + strings.Repeat("b", 40), Source: "running", FirstSeenAt: first},
|
||||
{ID: 34, Repo: sluskRepo, Tag: "main", Source: "webhook", FirstSeenAt: first},
|
||||
{ID: 40, Repo: "other/repo", Tag: "x", Source: "poll", FirstSeenAt: first},
|
||||
}
|
||||
|
||||
_, body := get(t, srv, "/services/1")
|
||||
|
||||
for _, id := range []string{"31", "32", "33", "34"} {
|
||||
assert.Contains(t, body, `<input type="hidden" name="version" value="`+id+`">`, id)
|
||||
}
|
||||
assert.NotContains(t, body, `name="version" value="40"`, "versions of other repos are not listed")
|
||||
assert.Equal(t, 4, strings.Count(body, `name="version"`))
|
||||
assert.Contains(t, body, `name="csrf_token" value="csrf"`)
|
||||
assert.Contains(t, body, `title="`+sluskRepo+`:1.5.0@sha256:`+strings.Repeat("a", 40)+`"`, "full ref as title")
|
||||
assert.Contains(t, body, sluskRepo+":1.5.0@sha256:"+strings.Repeat("a", 12), "short ref as text")
|
||||
assert.Equal(t, 1, strings.Count(body, `<span class="badge">running</span>`), "only the running digest is marked")
|
||||
assert.Equal(t, 1, strings.Count(body, "the service will follow no tag afterwards"), "only the tagless row")
|
||||
assert.Contains(t, body, "2026-10-12 09:05")
|
||||
assert.NotContains(t, body, "auto mode", "no auto warning for a manual service")
|
||||
}
|
||||
|
||||
func TestServicePage_VersionPickerShowsAtMostTenRows(t *testing.T) {
|
||||
srv, store, _, _, _ := newTestEnv(t)
|
||||
store.services[0].ImageRepo = sluskRepo
|
||||
for i := int64(1); i <= 12; i++ {
|
||||
store.versions = append(store.versions, model.ImageVersion{ID: i, Repo: sluskRepo, Tag: "t", Digest: "sha256:d", Source: "poll"})
|
||||
}
|
||||
|
||||
_, body := get(t, srv, "/services/1")
|
||||
|
||||
assert.Equal(t, 10, strings.Count(body, `name="version"`))
|
||||
}
|
||||
|
||||
func TestServicePage_VersionPickerWarnsForAutoServices(t *testing.T) {
|
||||
srv, store, _, _, _ := newTestEnv(t)
|
||||
store.services[0].UpdateMode = "auto"
|
||||
|
||||
_, body := get(t, srv, "/services/1")
|
||||
|
||||
assert.Contains(t, body, "This service is in auto mode")
|
||||
}
|
||||
|
||||
func TestServicePage_VersionPickerHiddenWhenServiceCannotBeUpdated(t *testing.T) {
|
||||
for _, reason := range []string{model.ReasonSelf, model.ReasonContainer, model.ReasonRemoved, model.ReasonBuilt} {
|
||||
t.Run(reason, func(t *testing.T) {
|
||||
srv, store, _, _, jobs := newTestEnv(t)
|
||||
store.services[0].ImageRepo = sluskRepo
|
||||
store.versions = []model.ImageVersion{{ID: 31, Repo: sluskRepo, Tag: "1.5.0", Source: "poll"}}
|
||||
jobs.autoErr = &model.NotUpdatableError{Reason: reason}
|
||||
|
||||
_, body := get(t, srv, "/services/1")
|
||||
|
||||
assert.Contains(t, body, "<h2>Versions</h2>")
|
||||
assert.Contains(t, body, "1.5.0", "the history is still shown")
|
||||
assert.NotContains(t, body, `name="version"`)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServicePage_VersionPickerOffersVersionsToAServiceThatFollowsNoTag(t *testing.T) {
|
||||
srv, store, _, _, jobs := newTestEnv(t)
|
||||
store.services[0].ImageRepo = sluskRepo
|
||||
store.versions = []model.ImageVersion{{ID: 31, Repo: sluskRepo, Tag: "1.5.0", Digest: "sha256:a", Source: "poll"}}
|
||||
jobs.updatable = &model.NotUpdatableError{Reason: model.ReasonNoTag} // autoErr stays nil: an explicit ref is fine
|
||||
|
||||
_, body := get(t, srv, "/services/1")
|
||||
|
||||
assert.Contains(t, body, `name="version" value="31"`)
|
||||
assert.NotContains(t, body, `<button type="submit">Update</button>`, "the plain Update button stays hidden")
|
||||
}
|
||||
|
||||
func TestServicePage_PollingRow(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
edit func(*model.Service)
|
||||
want string
|
||||
failed bool
|
||||
}{
|
||||
{"polled", func(s *model.Service) { s.ActualDigest = "sha256:cur" }, "every 6h", false},
|
||||
{"poll error", func(s *model.Service) { s.ActualDigest = "sha256:cur"; s.LastPollError = "head x: 401 <b>" }, "last check failed: head x: 401 <b>", true},
|
||||
{"built", func(s *model.Service) { s.ActualDigest = "sha256:cur"; s.Built = true }, "not polled: built from source", false},
|
||||
{"no digest", func(s *model.Service) {}, "not polled: no registry digest", false},
|
||||
{"no tag", func(s *model.Service) { s.ActualRef = "r@sha256:a"; s.ActualDigest = "sha256:a" }, "not polled: follows no tag", false},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
srv, store, _, _, _ := newTestEnvPolling(t, 6*time.Hour)
|
||||
tt.edit(&store.services[0])
|
||||
|
||||
_, body := get(t, srv, "/services/1")
|
||||
|
||||
assert.Contains(t, body, "<th>Polling</th><td")
|
||||
assert.Contains(t, body, tt.want)
|
||||
assert.Equal(t, tt.failed, strings.Contains(body, `<td class="error">`+tt.want))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestShortDuration(t *testing.T) {
|
||||
tests := []struct {
|
||||
d time.Duration
|
||||
want string
|
||||
}{
|
||||
{6 * time.Hour, "6h"},
|
||||
{90 * time.Minute, "1h30m"},
|
||||
{30 * time.Minute, "30m"},
|
||||
{90 * time.Second, "1m30s"},
|
||||
{45 * time.Second, "45s"},
|
||||
{6*time.Hour + 5*time.Second, "6h0m5s"},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.want, func(t *testing.T) {
|
||||
assert.Equal(t, tt.want, shortDuration(tt.d))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func postVersion(t *testing.T, srv *httptest.Server, version string) (*http.Response, string) {
|
||||
t.Helper()
|
||||
resp, err := noRedirectClient().PostForm(srv.URL+"/services/1/update", url.Values{"csrf_token": {"csrf"}, "version": {version}})
|
||||
require.NoError(t, err)
|
||||
defer resp.Body.Close()
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
return resp, string(body)
|
||||
}
|
||||
|
||||
func TestUpdateService_VersionStartsThatVersion(t *testing.T) {
|
||||
srv, _, _, _, jobs := newTestEnv(t)
|
||||
jobs.job = model.Job{ID: 42}
|
||||
|
||||
resp, _ := postVersion(t, srv, "31")
|
||||
|
||||
assert.Equal(t, http.StatusSeeOther, resp.StatusCode)
|
||||
assert.Equal(t, "/jobs/42", resp.Header.Get("Location"))
|
||||
assert.Equal(t, []int64{31}, jobs.triggered)
|
||||
assert.Equal(t, []int64{1}, jobs.triggerSvc)
|
||||
assert.Equal(t, "alice", jobs.triggeredBy())
|
||||
assert.Zero(t, jobs.plainCalls)
|
||||
}
|
||||
|
||||
func TestUpdateService_WithoutVersionTriggersTheFollowedTag(t *testing.T) {
|
||||
srv, _, _, _, jobs := newTestEnv(t)
|
||||
jobs.job = model.Job{ID: 42}
|
||||
|
||||
resp, _ := postVersion(t, srv, "")
|
||||
|
||||
assert.Equal(t, http.StatusSeeOther, resp.StatusCode)
|
||||
assert.Equal(t, 1, jobs.plainCalls)
|
||||
assert.Empty(t, jobs.triggered)
|
||||
}
|
||||
|
||||
func TestUpdateService_VersionErrors(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
version string
|
||||
err error
|
||||
wantCode int
|
||||
wantBody string
|
||||
wantJob string // Location header
|
||||
}{
|
||||
{"not a number", "abc", nil, http.StatusBadRequest, "invalid version", ""},
|
||||
{"a ref instead of an id", "repo:evil@sha256:x", nil, http.StatusBadRequest, "invalid version", ""},
|
||||
{"unknown version or other repo", "77", model.ErrNotFound, http.StatusNotFound, "not found", ""},
|
||||
{"not updatable", "31", &model.NotUpdatableError{Reason: model.ReasonBuilt}, http.StatusConflict, "Cannot update: " + model.ReasonBuilt + ".", ""},
|
||||
{"job already active", "31", model.ErrJobActive, http.StatusSeeOther, "", "/jobs/41"},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
srv, _, _, _, jobs := newTestEnv(t)
|
||||
jobs.err, jobs.job = tt.err, model.Job{ID: 41}
|
||||
|
||||
resp, body := postVersion(t, srv, tt.version)
|
||||
|
||||
assert.Equal(t, tt.wantCode, resp.StatusCode)
|
||||
assert.Contains(t, body, tt.wantBody)
|
||||
assert.Equal(t, tt.wantJob, resp.Header.Get("Location"))
|
||||
if tt.wantCode == http.StatusBadRequest {
|
||||
assert.Empty(t, jobs.triggered, "no job for a malformed version")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestOverview_ShowsFollowsNoTagAndPollFailedBadges(t *testing.T) {
|
||||
srv, store, _, _, _ := newTestEnv(t)
|
||||
store.services[0].LastPollError = `head x: "boom" <script>`
|
||||
|
||||
for _, path := range []string{"/", "/fragments/services"} {
|
||||
_, body := get(t, srv, path)
|
||||
assert.Equal(t, 1, strings.Count(body, "Follows no tag"), "only the digest-only Swarm service: "+path)
|
||||
assert.Contains(t, body, `class="tag f-err" title="head x: "boom" <script>">Poll failed</span>`, path)
|
||||
assert.Equal(t, 1, strings.Count(body, "Poll failed"), path)
|
||||
}
|
||||
}
|
||||
+292
-25
@@ -1,62 +1,329 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"cmp"
|
||||
"slices"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
"unicode/utf8"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/imageref"
|
||||
"github.com/shcizo/package-updater/internal/master/jobs"
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
"github.com/shcizo/package-updater/internal/master/poller"
|
||||
"github.com/shcizo/package-updater/internal/master/web/icons"
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
// serviceGroup is one block of the overview: a machine, a Swarm cluster or
|
||||
// the services whose agent is unknown.
|
||||
type serviceGroup struct {
|
||||
Title string
|
||||
Services []serviceRow
|
||||
Key string // "agent-<id>", "swarm-<cluster id>" or "unknown"; the machine filter matches on it
|
||||
Title string
|
||||
TitleHint string // hover text of the title; the full cluster id
|
||||
Kind string // "Machine" or "Swarm cluster"
|
||||
Meta string // hostname, or the cluster's managers
|
||||
Cluster bool
|
||||
Sub bool // a machine that belongs to the cluster shown above it
|
||||
// Offline says the agent (or, for a cluster, every manager) is not
|
||||
// connected, so the rows show the last known state.
|
||||
Offline bool
|
||||
OfflineLabel string // what the banner says before "since"
|
||||
OfflineSince *time.Time // when the agent was last seen; nil if unknown
|
||||
Services []serviceRow
|
||||
}
|
||||
|
||||
// serviceRow is a service as shown in the overview table.
|
||||
// serviceRow is a service as shown in the overview.
|
||||
type serviceRow struct {
|
||||
model.Service
|
||||
AutoBlocked string // why the service cannot be set to auto; "" when it can
|
||||
|
||||
Name string // the service's own name, without its stack
|
||||
Stack string // the Compose project; "" for Swarm and plain containers
|
||||
Repo string // image repository without the registry host
|
||||
Tag string // ":tag", or ""
|
||||
Digest string // "@sha256:<12 hex>…" when the image has no tag, else ""
|
||||
AvailableTag string // the tag of AvailableRef, or ""
|
||||
Icon string // Simple Icons slug; "" when there is no icon
|
||||
Letter string // shown instead of an icon
|
||||
LetterClass string // lc-0 .. lc-3
|
||||
StatusLabel string
|
||||
StatusClass string
|
||||
Search string // what the search box matches against, lowercased
|
||||
}
|
||||
|
||||
// groupServices groups machine-bound services per agent and Swarm services
|
||||
// in one group, keeping the store's order (machines first, Swarm last).
|
||||
// autoBlocked is called for every service and returns the reason it cannot be
|
||||
// set to auto, or "" when it can.
|
||||
func groupServices(services []model.Service, autoBlocked func(model.Service) string) []serviceGroup {
|
||||
var groups []serviceGroup
|
||||
index := map[string]int{}
|
||||
// newServiceRow fills the display fields of a row.
|
||||
func newServiceRow(s model.Service, autoBlocked string) serviceRow {
|
||||
r := serviceRow{Service: s, AutoBlocked: autoBlocked}
|
||||
switch s.Kind {
|
||||
case protocol.KindCompose:
|
||||
r.Name, r.Stack = s.ComposeService, s.ComposeProject
|
||||
case protocol.KindSwarm:
|
||||
r.Name = s.SwarmService
|
||||
default:
|
||||
r.Name = s.ContainerName
|
||||
}
|
||||
r.Repo, r.Tag, r.Digest = imageParts(s.ActualRef)
|
||||
r.AvailableTag = imageref.Parse(s.AvailableRef).Tag
|
||||
r.Icon = icons.ForImage(s.ActualRef)
|
||||
r.Letter = "?"
|
||||
if first, _ := utf8.DecodeRuneInString(r.Name); first != utf8.RuneError {
|
||||
r.Letter = strings.ToUpper(string(first))
|
||||
}
|
||||
r.LetterClass = letterClass(r.Name)
|
||||
switch s.Status {
|
||||
case "running":
|
||||
r.StatusLabel, r.StatusClass = "Running", "s-running"
|
||||
case "degraded":
|
||||
r.StatusLabel, r.StatusClass = "Degraded", "s-degraded"
|
||||
case "stopped":
|
||||
r.StatusLabel, r.StatusClass = "Stopped", "s-stopped"
|
||||
default:
|
||||
r.StatusLabel, r.StatusClass = "Unknown", "s-unknown"
|
||||
}
|
||||
r.Search = strings.ToLower(strings.Join([]string{r.Name, r.Stack, r.Repo, strings.TrimPrefix(r.Tag, ":"), s.AgentName}, " "))
|
||||
return r
|
||||
}
|
||||
|
||||
// imageParts splits an image reference for display: the repository without
|
||||
// its registry host, ":tag", and a shortened digest that is only given when
|
||||
// there is no tag.
|
||||
func imageParts(ref string) (repo, tag, digest string) {
|
||||
r := imageref.Parse(ref)
|
||||
repo = r.Repo
|
||||
if host, rest, ok := strings.Cut(repo, "/"); ok && (imageref.IsRegistryHost(host)) {
|
||||
repo = rest
|
||||
}
|
||||
if r.Tag != "" {
|
||||
return repo, ":" + r.Tag, ""
|
||||
}
|
||||
if r.Digest != "" {
|
||||
return repo, "", "@" + shortDigest(r.Digest)
|
||||
}
|
||||
return repo, "", ""
|
||||
}
|
||||
|
||||
// shortDigest shortens "sha256:<hex>" to 12 hex characters and an ellipsis.
|
||||
func shortDigest(d string) string {
|
||||
if hex, ok := strings.CutPrefix(d, "sha256:"); ok && len(hex) > 12 {
|
||||
return "sha256:" + hex[:12] + "…"
|
||||
}
|
||||
return d
|
||||
}
|
||||
|
||||
// letterClass picks one of four colours from the name, so a service keeps
|
||||
// its colour.
|
||||
func letterClass(name string) string {
|
||||
sum := 0
|
||||
for i := 0; i < len(name); i++ {
|
||||
sum += int(name[i])
|
||||
}
|
||||
return "lc-" + strconv.Itoa(sum%4)
|
||||
}
|
||||
|
||||
// groupServices groups the services into one block per Swarm cluster and per
|
||||
// machine. A cluster comes first, followed by the machines that belong to it;
|
||||
// the remaining machines follow by name and the services whose agent is
|
||||
// unknown come last. Agents without services get no block. online says
|
||||
// whether an agent is connected; autoBlocked returns the reason a service
|
||||
// cannot be set to auto, or "".
|
||||
func groupServices(services []model.Service, agents []model.Agent, online func(int64) bool, autoBlocked func(model.Service) string) []serviceGroup {
|
||||
agentByID := map[int64]model.Agent{}
|
||||
for _, a := range agents {
|
||||
agentByID[a.ID] = a
|
||||
}
|
||||
var clusterIDs []string
|
||||
clusterRows := map[string][]serviceRow{}
|
||||
clusterRowAgents := map[string]map[int64]bool{} // agents named by a cluster's rows
|
||||
machineRows := map[int64][]serviceRow{}
|
||||
var unknownRows []serviceRow
|
||||
for _, s := range services {
|
||||
title := s.AgentName
|
||||
if s.Kind == protocol.KindSwarm {
|
||||
title = "Swarm"
|
||||
} else if title == "" {
|
||||
title = "Unknown agent"
|
||||
row := newServiceRow(s, autoBlocked(s))
|
||||
_, known := agentByID[derefID(s.AgentID)]
|
||||
switch {
|
||||
case s.Kind == protocol.KindSwarm:
|
||||
if _, seen := clusterRows[s.SwarmClusterID]; !seen {
|
||||
clusterIDs = append(clusterIDs, s.SwarmClusterID)
|
||||
clusterRowAgents[s.SwarmClusterID] = map[int64]bool{}
|
||||
}
|
||||
clusterRows[s.SwarmClusterID] = append(clusterRows[s.SwarmClusterID], row)
|
||||
if s.AgentID != nil {
|
||||
clusterRowAgents[s.SwarmClusterID][*s.AgentID] = true
|
||||
}
|
||||
case s.AgentID != nil && known:
|
||||
machineRows[*s.AgentID] = append(machineRows[*s.AgentID], row)
|
||||
default:
|
||||
unknownRows = append(unknownRows, row)
|
||||
}
|
||||
i, ok := index[title]
|
||||
if !ok {
|
||||
i = len(groups)
|
||||
index[title] = i
|
||||
groups = append(groups, serviceGroup{Title: title})
|
||||
}
|
||||
|
||||
machineIDs := make([]int64, 0, len(machineRows))
|
||||
for id := range machineRows {
|
||||
machineIDs = append(machineIDs, id)
|
||||
}
|
||||
slices.SortFunc(machineIDs, func(a, b int64) int {
|
||||
return cmp.Or(cmp.Compare(agentByID[a].Name, agentByID[b].Name), cmp.Compare(a, b))
|
||||
})
|
||||
machine := func(id int64, sub bool) serviceGroup {
|
||||
a := agentByID[id]
|
||||
return serviceGroup{
|
||||
Key: "agent-" + strconv.FormatInt(id, 10), Title: a.Name, Kind: "Machine", Meta: a.Hostname, Sub: sub,
|
||||
Offline: !online(id), OfflineLabel: "Agent offline", OfflineSince: a.LastSeenAt, Services: machineRows[id],
|
||||
}
|
||||
groups[i].Services = append(groups[i].Services, serviceRow{Service: s, AutoBlocked: autoBlocked(s)})
|
||||
}
|
||||
|
||||
var groups []serviceGroup
|
||||
placed := map[int64]bool{}
|
||||
for _, cid := range clusterIDs {
|
||||
title := "Swarm"
|
||||
if len(clusterIDs) > 1 {
|
||||
title += " " + cid[:min(len(cid), 8)]
|
||||
}
|
||||
g := serviceGroup{
|
||||
Key: "swarm-" + cid, Title: title, TitleHint: cid, Kind: "Swarm cluster", Cluster: true,
|
||||
Offline: true, OfflineLabel: "No manager online", Services: clusterRows[cid],
|
||||
}
|
||||
var names []string
|
||||
for _, a := range agents {
|
||||
isManager := a.SwarmManager && a.SwarmClusterID == cid
|
||||
if a.RevokedAt != nil || !(isManager || clusterRowAgents[cid][a.ID]) {
|
||||
continue
|
||||
}
|
||||
names = append(names, a.Name)
|
||||
if online(a.ID) {
|
||||
g.Offline = false
|
||||
}
|
||||
if a.LastSeenAt != nil && (g.OfflineSince == nil || a.LastSeenAt.After(*g.OfflineSince)) {
|
||||
g.OfflineSince = a.LastSeenAt
|
||||
}
|
||||
}
|
||||
slices.Sort(names)
|
||||
if len(names) > 0 {
|
||||
g.Meta = "managers " + strings.Join(names, ", ")
|
||||
}
|
||||
groups = append(groups, g)
|
||||
for _, id := range machineIDs {
|
||||
if cid != "" && agentByID[id].SwarmClusterID == cid && !placed[id] {
|
||||
placed[id] = true
|
||||
groups = append(groups, machine(id, true))
|
||||
}
|
||||
}
|
||||
}
|
||||
for _, id := range machineIDs {
|
||||
if !placed[id] {
|
||||
groups = append(groups, machine(id, false))
|
||||
}
|
||||
}
|
||||
if len(unknownRows) > 0 {
|
||||
groups = append(groups, serviceGroup{
|
||||
Key: "unknown", Title: "Unknown agent", Kind: "Machine", Offline: true, OfflineLabel: "Agent offline", Services: unknownRows,
|
||||
})
|
||||
}
|
||||
return groups
|
||||
}
|
||||
|
||||
func derefID(id *int64) int64 {
|
||||
if id == nil {
|
||||
return 0
|
||||
}
|
||||
return *id
|
||||
}
|
||||
|
||||
// shortRef shortens a digest in an image reference to 12 hex characters.
|
||||
func shortRef(ref string) string {
|
||||
r := imageref.Parse(ref)
|
||||
if hex, ok := strings.CutPrefix(r.Digest, "sha256:"); ok && len(hex) > 12 {
|
||||
r.Digest = "sha256:" + hex[:12] + "…"
|
||||
}
|
||||
r.Digest = shortDigest(r.Digest)
|
||||
return r.String()
|
||||
}
|
||||
|
||||
// followsNoTag says the service's image reference has a digest but no tag,
|
||||
// so there is no tag to poll or update.
|
||||
func followsNoTag(svc model.Service) bool {
|
||||
return jobs.FollowedRef(svc.ActualRef) == ""
|
||||
}
|
||||
|
||||
// versionRow is an image version as shown on the service page.
|
||||
type versionRow struct {
|
||||
model.ImageVersion
|
||||
Running bool // the service runs exactly this digest
|
||||
}
|
||||
|
||||
// versionRows marks the version the service runs now, by digest.
|
||||
func versionRows(versions []model.ImageVersion, actualDigest string) []versionRow {
|
||||
rows := make([]versionRow, len(versions))
|
||||
for i, v := range versions {
|
||||
rows[i] = versionRow{ImageVersion: v, Running: v.Digest != "" && v.Digest == actualDigest}
|
||||
}
|
||||
return rows
|
||||
}
|
||||
|
||||
// pollingStatus is the text of the "Polling" row on the service page and
|
||||
// whether it is a registry error.
|
||||
func pollingStatus(svc model.Service, interval time.Duration) (text string, failed bool) {
|
||||
switch {
|
||||
case poller.SkipReason(svc) != "":
|
||||
return "not polled: " + poller.SkipReason(svc), false
|
||||
case svc.LastPollError != "":
|
||||
return "last check failed: " + svc.LastPollError, true
|
||||
}
|
||||
return "every " + shortDuration(interval), false
|
||||
}
|
||||
|
||||
// shortDuration formats d without trailing zero units: "6h", "1h30m", "90s".
|
||||
func shortDuration(d time.Duration) string {
|
||||
s := d.String()
|
||||
if strings.HasSuffix(s, "m0s") {
|
||||
s = s[:len(s)-2]
|
||||
}
|
||||
if strings.HasSuffix(s, "h0m") {
|
||||
s = s[:len(s)-2]
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
// agentRow is an agent as shown on the agents page.
|
||||
type agentRow struct {
|
||||
model.Agent
|
||||
Online bool
|
||||
Online bool
|
||||
Status string // Online, Offline, Never connected or Revoked
|
||||
StatusClass string
|
||||
Role string // Manager, Worker or "—"
|
||||
VersionOld bool // the agent runs another version than the master
|
||||
}
|
||||
|
||||
// newAgentRow fills the display fields of a row. masterVersion is the
|
||||
// master's build version; "dev" and "" never mark an agent as old.
|
||||
func newAgentRow(a model.Agent, online bool, masterVersion string) agentRow {
|
||||
r := agentRow{Agent: a, Online: online}
|
||||
switch {
|
||||
case a.RevokedAt != nil:
|
||||
r.Status, r.StatusClass = "Revoked", "a-revoked"
|
||||
case online:
|
||||
r.Status, r.StatusClass = "Online", "a-on"
|
||||
case a.LastSeenAt == nil:
|
||||
r.Status, r.StatusClass = "Never connected", "a-never"
|
||||
default:
|
||||
r.Status, r.StatusClass = "Offline", "a-off"
|
||||
}
|
||||
switch {
|
||||
case a.SwarmManager:
|
||||
r.Role = "Manager"
|
||||
case a.SwarmClusterID != "":
|
||||
r.Role = "Worker"
|
||||
default:
|
||||
r.Role = "—"
|
||||
}
|
||||
r.VersionOld = a.AgentVersion != "" && masterVersion != "" && masterVersion != "dev" && a.AgentVersion != masterVersion
|
||||
return r
|
||||
}
|
||||
|
||||
// middle shortens a long secret for display: its first 8 and last 4 characters.
|
||||
func middle(s string) string {
|
||||
if len(s) <= 14 {
|
||||
return s
|
||||
}
|
||||
return s[:8] + "…" + s[len(s)-4:]
|
||||
}
|
||||
|
||||
// jobDuration is how long a job ran, or has been running; "" before it starts.
|
||||
|
||||
@@ -0,0 +1,213 @@
|
||||
package web
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/shcizo/package-updater/internal/master/model"
|
||||
"github.com/shcizo/package-updater/internal/protocol"
|
||||
)
|
||||
|
||||
func TestImageParts(t *testing.T) {
|
||||
cases := []struct {
|
||||
ref, repo, tag, digest string
|
||||
}{
|
||||
{"postgres:17.10", "postgres", ":17.10", ""},
|
||||
{"postgres", "postgres", "", ""},
|
||||
{"gitea/gitea:1.27.3", "gitea/gitea", ":1.27.3", ""},
|
||||
{"gitea.shcizo.se/shcizo/slusk:v0.8.1", "shcizo/slusk", ":v0.8.1", ""},
|
||||
{"localhost:5000/foo:v1", "foo", ":v1", ""},
|
||||
{"localhost/foo", "foo", "", ""},
|
||||
{"lscr.io/linuxserver/jellyfin@sha256:0f42497a69fa0441bfd5f9d6bba8694f2a656ec984e571d0ac04c6dd91250039", "linuxserver/jellyfin", "", "@sha256:0f42497a69fa…"},
|
||||
{"r/x:1.0@sha256:0f42497a69fa0441", "r/x", ":1.0", ""}, // the digest is hidden when there is a tag
|
||||
{"r/x@sha256:abc", "r/x", "", "@sha256:abc"},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.ref, func(t *testing.T) {
|
||||
repo, tag, digest := imageParts(c.ref)
|
||||
assert.Equal(t, c.repo, repo)
|
||||
assert.Equal(t, c.tag, tag)
|
||||
assert.Equal(t, c.digest, digest)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestLetterClass(t *testing.T) {
|
||||
assert.Equal(t, "lc-0", letterClass(""))
|
||||
assert.Equal(t, "lc-1", letterClass("a"), "97 mod 4")
|
||||
assert.Equal(t, letterClass("gitea"), letterClass("gitea"), "a name always gets the same colour")
|
||||
for _, name := range []string{"gitea", "authentik-server", "ø", "n8n"} {
|
||||
assert.Regexp(t, `^lc-[0-3]$`, letterClass(name))
|
||||
}
|
||||
}
|
||||
|
||||
func TestNewAgentRow(t *testing.T) {
|
||||
seen := ptr(time.Now())
|
||||
cases := []struct {
|
||||
name string
|
||||
agent model.Agent
|
||||
online bool
|
||||
masterVersion string
|
||||
status, role string
|
||||
old bool
|
||||
}{
|
||||
{"online manager", model.Agent{SwarmManager: true, AgentVersion: "v1"}, true, "v1", "Online", "Manager", false},
|
||||
{"offline worker on another version", model.Agent{SwarmClusterID: "c", AgentVersion: "v0", LastSeenAt: seen}, false, "v1", "Offline", "Worker", true},
|
||||
{"never connected", model.Agent{}, false, "v1", "Never connected", "—", false},
|
||||
{"revoked wins over online", model.Agent{RevokedAt: seen, LastSeenAt: seen}, true, "v1", "Revoked", "—", false},
|
||||
{"dev master marks nothing", model.Agent{AgentVersion: "v0"}, true, "dev", "Online", "—", false},
|
||||
{"agent without version", model.Agent{}, true, "v1", "Online", "—", false},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
row := newAgentRow(c.agent, c.online, c.masterVersion)
|
||||
assert.Equal(t, c.status, row.Status)
|
||||
assert.Equal(t, c.role, row.Role)
|
||||
assert.Equal(t, c.old, row.VersionOld)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestMiddle(t *testing.T) {
|
||||
assert.Equal(t, "short", middle("short"))
|
||||
assert.Equal(t, "pua_7Hq2…Ge5A", middle("pua_7Hq2mX9vKc4LwT8nRb3ZyF6dJp1sGe5A"))
|
||||
}
|
||||
|
||||
func TestGroupServices(t *testing.T) {
|
||||
at := func(h, m int) *time.Time { return ptr(time.Date(2026, 10, 12, h, m, 0, 0, time.UTC)) }
|
||||
id := func(n int64) *int64 { return &n }
|
||||
compose := func(sid int64, agent *int64, name string) model.Service {
|
||||
return model.Service{ID: sid, Kind: protocol.KindCompose, AgentID: agent, ComposeProject: "p", ComposeService: name, ActualRef: "r/" + name + ":1"}
|
||||
}
|
||||
swarm := func(sid int64, cluster string, agent *int64) model.Service {
|
||||
return model.Service{ID: sid, Kind: protocol.KindSwarm, SwarmClusterID: cluster, AgentID: agent, SwarmService: "s" + cluster}
|
||||
}
|
||||
noBlock := func(model.Service) string { return "" }
|
||||
onlineSet := func(ids ...int64) func(int64) bool {
|
||||
return func(a int64) bool {
|
||||
for _, i := range ids {
|
||||
if i == a {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
}
|
||||
titles := func(groups []serviceGroup) []string {
|
||||
var out []string
|
||||
for _, g := range groups {
|
||||
out = append(out, g.Title)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
t.Run("empty", func(t *testing.T) {
|
||||
assert.Empty(t, groupServices(nil, []model.Agent{{ID: 1, Name: "a"}}, onlineSet(), noBlock))
|
||||
})
|
||||
|
||||
t.Run("agents without services get no group", func(t *testing.T) {
|
||||
groups := groupServices([]model.Service{compose(1, id(1), "web")},
|
||||
[]model.Agent{{ID: 1, Name: "a"}, {ID: 2, Name: "idle"}}, onlineSet(1, 2), noBlock)
|
||||
assert.Equal(t, []string{"a"}, titles(groups))
|
||||
assert.Equal(t, "agent-1", groups[0].Key)
|
||||
assert.Equal(t, "Machine", groups[0].Kind)
|
||||
assert.False(t, groups[0].Offline)
|
||||
})
|
||||
|
||||
t.Run("services without a known agent are offline and last", func(t *testing.T) {
|
||||
groups := groupServices(
|
||||
[]model.Service{compose(1, nil, "orphan"), compose(2, id(7), "ghost"), compose(3, id(1), "web")},
|
||||
[]model.Agent{{ID: 1, Name: "a"}}, onlineSet(1), noBlock)
|
||||
assert.Equal(t, []string{"a", "Unknown agent"}, titles(groups))
|
||||
unknown := groups[1]
|
||||
assert.Equal(t, "unknown", unknown.Key)
|
||||
assert.True(t, unknown.Offline)
|
||||
assert.Nil(t, unknown.OfflineSince)
|
||||
assert.Len(t, unknown.Services, 2)
|
||||
})
|
||||
|
||||
t.Run("an offline agent says since when", func(t *testing.T) {
|
||||
groups := groupServices([]model.Service{compose(1, id(1), "web")},
|
||||
[]model.Agent{{ID: 1, Name: "a", Hostname: "a.lan", LastSeenAt: at(13, 51)}}, onlineSet(), noBlock)
|
||||
require.Len(t, groups, 1)
|
||||
assert.True(t, groups[0].Offline)
|
||||
assert.Equal(t, "Agent offline", groups[0].OfflineLabel)
|
||||
assert.Equal(t, at(13, 51), groups[0].OfflineSince)
|
||||
assert.Equal(t, "a.lan", groups[0].Meta)
|
||||
})
|
||||
|
||||
t.Run("a cluster is online when any manager is", func(t *testing.T) {
|
||||
agents := []model.Agent{
|
||||
{ID: 1, Name: "m1", SwarmManager: true, SwarmClusterID: "c1", LastSeenAt: at(10, 0)},
|
||||
{ID: 2, Name: "m2", SwarmManager: true, SwarmClusterID: "c1", LastSeenAt: at(11, 0)},
|
||||
}
|
||||
groups := groupServices([]model.Service{swarm(1, "c1", nil)}, agents, onlineSet(2), noBlock)
|
||||
require.Len(t, groups, 1)
|
||||
assert.False(t, groups[0].Offline)
|
||||
assert.Equal(t, "Swarm", groups[0].Title)
|
||||
assert.Equal(t, "c1", groups[0].TitleHint)
|
||||
assert.Equal(t, "Swarm cluster", groups[0].Kind)
|
||||
assert.Equal(t, "managers m1, m2", groups[0].Meta)
|
||||
assert.Equal(t, "swarm-c1", groups[0].Key)
|
||||
})
|
||||
|
||||
t.Run("a cluster with no manager online has been offline since the latest manager was seen", func(t *testing.T) {
|
||||
agents := []model.Agent{
|
||||
{ID: 1, Name: "m1", SwarmManager: true, SwarmClusterID: "c1", LastSeenAt: at(10, 0)},
|
||||
{ID: 2, Name: "m2", SwarmManager: true, SwarmClusterID: "c1", LastSeenAt: at(11, 0)},
|
||||
}
|
||||
groups := groupServices([]model.Service{swarm(1, "c1", nil)}, agents, onlineSet(), noBlock)
|
||||
assert.True(t, groups[0].Offline)
|
||||
assert.Equal(t, "No manager online", groups[0].OfflineLabel)
|
||||
assert.Equal(t, at(11, 0), groups[0].OfflineSince)
|
||||
})
|
||||
|
||||
t.Run("a revoked manager does not count", func(t *testing.T) {
|
||||
agents := []model.Agent{
|
||||
{ID: 1, Name: "gone", SwarmManager: true, SwarmClusterID: "c1", LastSeenAt: at(12, 0), RevokedAt: at(12, 5)},
|
||||
{ID: 2, Name: "m2", SwarmManager: true, SwarmClusterID: "c1", LastSeenAt: at(9, 0)},
|
||||
}
|
||||
groups := groupServices([]model.Service{swarm(1, "c1", nil)}, agents, onlineSet(1), noBlock)
|
||||
assert.True(t, groups[0].Offline, "the revoked manager is not connected for this purpose")
|
||||
assert.Equal(t, "managers m2", groups[0].Meta)
|
||||
assert.Equal(t, at(9, 0), groups[0].OfflineSince)
|
||||
})
|
||||
|
||||
t.Run("managers are found through the rows when no agent reports the cluster", func(t *testing.T) {
|
||||
agents := []model.Agent{{ID: 4, Name: "reporter", LastSeenAt: at(8, 0)}}
|
||||
groups := groupServices([]model.Service{swarm(1, "c1", id(4))}, agents, onlineSet(4), noBlock)
|
||||
assert.False(t, groups[0].Offline)
|
||||
assert.Equal(t, "managers reporter", groups[0].Meta)
|
||||
})
|
||||
|
||||
t.Run("order is cluster, its machines, other machines by name, unknown", func(t *testing.T) {
|
||||
agents := []model.Agent{
|
||||
{ID: 1, Name: "zeta"},
|
||||
{ID: 2, Name: "mgr", SwarmManager: true, SwarmClusterID: "c1"},
|
||||
{ID: 3, Name: "alpha"},
|
||||
{ID: 4, Name: "mgr2", SwarmManager: true, SwarmClusterID: "c1"},
|
||||
}
|
||||
services := []model.Service{
|
||||
compose(1, id(1), "a"), compose(2, id(2), "b"), compose(3, id(3), "c"),
|
||||
compose(4, id(4), "d"), compose(5, nil, "e"), swarm(6, "c1", nil),
|
||||
}
|
||||
groups := groupServices(services, agents, onlineSet(1, 2, 3, 4), noBlock)
|
||||
assert.Equal(t, []string{"Swarm", "mgr", "mgr2", "alpha", "zeta", "Unknown agent"}, titles(groups))
|
||||
assert.Equal(t, []bool{false, true, true, false, false, false}, []bool{groups[0].Sub, groups[1].Sub, groups[2].Sub, groups[3].Sub, groups[4].Sub, groups[5].Sub})
|
||||
})
|
||||
|
||||
t.Run("two clusters carry their ids in the titles", func(t *testing.T) {
|
||||
groups := groupServices([]model.Service{swarm(1, "abcdefghijkl", nil), swarm(2, "xyz", nil)}, nil, onlineSet(), noBlock)
|
||||
assert.Equal(t, []string{"Swarm abcdefgh", "Swarm xyz"}, titles(groups))
|
||||
assert.Equal(t, "abcdefghijkl", groups[0].TitleHint)
|
||||
})
|
||||
|
||||
t.Run("the auto-blocked reason is kept on the row", func(t *testing.T) {
|
||||
groups := groupServices([]model.Service{compose(1, id(1), "web")}, []model.Agent{{ID: 1, Name: "a"}}, onlineSet(1),
|
||||
func(model.Service) string { return "because" })
|
||||
assert.Equal(t, "because", groups[0].Services[0].AutoBlocked)
|
||||
})
|
||||
}
|
||||
@@ -16,11 +16,16 @@ import (
|
||||
|
||||
// Version is the protocol version this build speaks. Agents send it in
|
||||
// Hello. Phase-1 agents do not send the field, which reads as 0.
|
||||
const Version = 2
|
||||
const Version = 3
|
||||
|
||||
// MinJobVersion is the lowest agent protocol version the master sends jobs to.
|
||||
const MinJobVersion = 2
|
||||
|
||||
// MinPinnedRefVersion is the lowest agent protocol version the master sends
|
||||
// jobs whose Ref has a digest or no tag to. Version-2 agents refuse a Ref
|
||||
// with a digest.
|
||||
const MinPinnedRefVersion = 3
|
||||
|
||||
// MaxJobOutput caps the job output an agent keeps and the master stores, in
|
||||
// bytes. Only the tail is kept. With JSON escaping (worst case 6 bytes per
|
||||
// byte) a JobResult carrying this much output still fits the 1 MiB read limit.
|
||||
@@ -123,8 +128,10 @@ type Remove struct {
|
||||
Key string `json:"key"`
|
||||
}
|
||||
|
||||
// JobStart asks the agent to deploy Ref to one service. Ref is "repo:tag";
|
||||
// the agent resolves the tag's current digest and deploys "repo:tag@digest".
|
||||
// JobStart asks the agent to deploy Ref to one service. Ref is "repo:tag",
|
||||
// "repo:tag@digest" or "repo@digest". For "repo:tag" the agent resolves the
|
||||
// tag's current digest and deploys "repo:tag@digest"; a Ref with a digest is
|
||||
// deployed as is.
|
||||
// The agent reads the Compose working directory and config files from its
|
||||
// own Docker daemon, not from this message.
|
||||
type JobStart struct {
|
||||
|
||||
Reference in New Issue
Block a user