Ilker ManapandClaude Opus 5.5
8df78a4d41
The leading control plane tells the mirror over its API (PUT /v1/firewall, kept as .firewall.json beside the models and applied by the same path unit control planes use), and keeps the state in the store's cluster_state for members that run no llmgw, which a root timer reads from the member's own copy. The mirror also lets in the network of every node and control plane the leader knows. Tried on the PoC: off, on and a network added, on every kind of machine. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
60 lines
1.9 KiB
Go
60 lines
1.9 KiB
Go
package cli
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"log/slog"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/config"
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/mirror"
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/store"
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/tlsconf"
|
|
)
|
|
|
|
func TestTheLeaderTellsTheMirrorAndTheStoreWhatTheFirewallSettingsSay(t *testing.T) {
|
|
ctx := context.Background()
|
|
st, err := store.OpenSQLite(ctx, filepath.Join(t.TempDir(), "s.db"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer st.Close()
|
|
if err := st.PutControlPlane(ctx, store.ControlPlane{URL: "https://10.0.0.150:7443", Name: "ctl02"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
root := t.TempDir()
|
|
srv := httptest.NewServer(mirror.NewAPI(mirror.NewManager(root, slog.New(slog.DiscardHandler)), "http://m:8081").Handler())
|
|
defer srv.Close()
|
|
mc, _ := mirror.NewClient(srv.URL, tlsconf.Config{}, 0)
|
|
|
|
cfg := config.Server{Firewall: config.FirewallSettings{Enabled: false}, FirewallNetworks: []string{"192.168.5.0/24"}}
|
|
leader := false
|
|
p := newFirewallPublisher(func() config.Server { return cfg }, st,
|
|
func() []string { return []string{"10.0.0.147", "", "10.0.0.147", "node-by-name"} },
|
|
func() bool { return leader }, slog.New(slog.DiscardHandler))
|
|
p.setMirror(mc)
|
|
|
|
p.once(ctx)
|
|
if _, err := st.ClusterState(ctx, firewallStateKey); err == nil {
|
|
t.Error("a standby told the store")
|
|
}
|
|
leader = true
|
|
p.once(ctx)
|
|
var got mirror.FirewallState
|
|
v, err := st.ClusterState(ctx, firewallStateKey)
|
|
if err != nil || json.Unmarshal([]byte(v), &got) != nil {
|
|
t.Fatalf("the store holds %q %v", v, err)
|
|
}
|
|
if got.Enabled || got.Networks[0] != "192.168.5.0/24" || len(got.Toward) != 2 ||
|
|
got.Toward[0] != "10.0.0.147" || got.Toward[1] != "10.0.0.150" {
|
|
t.Errorf("state %+v", got)
|
|
}
|
|
b, err := os.ReadFile(filepath.Join(root, mirror.FirewallFile))
|
|
if err != nil || string(b) != v {
|
|
t.Errorf("the mirror holds %s, the store %s", b, v)
|
|
}
|
|
}
|