diff --git a/testing/acl-allowlist/.gitignore b/testing/acl-allowlist/.gitignore index 31315f6..b06c7df 100644 --- a/testing/acl-allowlist/.gitignore +++ b/testing/acl-allowlist/.gitignore @@ -1 +1 @@ -generated-configs +generated-configs* diff --git a/testing/acl-allowlist/README.md b/testing/acl-allowlist/README.md index 6c5c231..95d0f2e 100644 --- a/testing/acl-allowlist/README.md +++ b/testing/acl-allowlist/README.md @@ -79,6 +79,12 @@ Docker service/container/hostname identifiers in this harness intentionally use `node-a` through `node-f`. For data-plane checks and operator examples, use the explicit FIPS names such as `node-a.fips` and `node-d.fips`. +The bridge network requests no subnet, so docker assigns one from its own +address pool and two concurrent runs of this harness never contend for a fixed +range. Consequently no node's IPv4 address is known before startup, and the +generated peer stanzas address each other by docker hostname (`host-a` … +`host-f`), resolved through the container's dnsmasq to docker's embedded DNS. + ACL paths are fixed in this branch: - `/etc/fips/peers.allow` @@ -93,7 +99,9 @@ Mounted ACL files in this harness: Generated fixture location: -- `testing/acl-allowlist/generated-configs/` +- `testing/acl-allowlist/generated-configs/`, or + `generated-configs/` when `FIPS_CI_NAME_SUFFIX` is set, which is how + concurrent runs keep their fixtures apart Inspect peer state: diff --git a/testing/acl-allowlist/docker-compose.yml b/testing/acl-allowlist/docker-compose.yml index abef96d..7d731d9 100644 --- a/testing/acl-allowlist/docker-compose.yml +++ b/testing/acl-allowlist/docker-compose.yml @@ -1,11 +1,21 @@ networks: + # No subnet is requested: docker assigns one from the daemon's address pool. + # A fixed request is honoured verbatim, so two runs asking for the same range + # collide on "Pool overlaps" — which is why the generated peer addresses are + # docker hostnames (host-a … host-f) rather than literal IPs. Docker's + # embedded DNS is per-network, so the same hostname in two concurrent runs + # resolves inside each run's own subnet. + # + # That removes one of the two obstacles to running this suite twice at once, + # not both. The compose project name is still fixed, so two runs that do not + # set COMPOSE_PROJECT_NAME share a project, and the second `up` recreates the + # first's containers while either `down` removes both. Nothing scopes it for + # this suite: it is run by hand only, so the caller has to. Do not read the + # floating subnet as making concurrent bare runs safe. acl-net: driver: bridge labels: - "com.corganlabs.fips-ci=1" - ipam: - config: - - subnet: 172.31.0.0/24 x-fips-common: &fips-common build: @@ -32,14 +42,13 @@ services: hostname: host-a volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/node-a/hosts:/etc/fips/hosts:ro - - ./generated-configs/node-a/peers.allow:/etc/fips/peers.allow:ro - - ./generated-configs/node-a/peers.deny:/etc/fips/peers.deny:ro - - ./generated-configs/node-a/fips.yaml:/etc/fips/fips.yaml:ro - - ./generated-configs/node-a/fips.key:/etc/fips/fips.key:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/hosts:/etc/fips/hosts:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/peers.allow:/etc/fips/peers.allow:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/peers.deny:/etc/fips/peers.deny:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.key:/etc/fips/fips.key:ro networks: - acl-net: - ipv4_address: 172.31.0.10 + - acl-net service-b: <<: *fips-common @@ -47,14 +56,13 @@ services: hostname: host-b volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/node-b/hosts:/etc/fips/hosts:ro - - ./generated-configs/node-b/peers.allow:/etc/fips/peers.allow:ro - - ./generated-configs/node-b/peers.deny:/etc/fips/peers.deny:ro - - ./generated-configs/node-b/fips.yaml:/etc/fips/fips.yaml:ro - - ./generated-configs/node-b/fips.key:/etc/fips/fips.key:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/hosts:/etc/fips/hosts:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/peers.allow:/etc/fips/peers.allow:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/peers.deny:/etc/fips/peers.deny:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.key:/etc/fips/fips.key:ro networks: - acl-net: - ipv4_address: 172.31.0.11 + - acl-net service-c: <<: *fips-common @@ -62,14 +70,13 @@ services: hostname: host-c volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/node-c/hosts:/etc/fips/hosts:ro - - ./generated-configs/node-c/peers.allow:/etc/fips/peers.allow:ro - - ./generated-configs/node-c/peers.deny:/etc/fips/peers.deny:ro - - ./generated-configs/node-c/fips.yaml:/etc/fips/fips.yaml:ro - - ./generated-configs/node-c/fips.key:/etc/fips/fips.key:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/hosts:/etc/fips/hosts:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/peers.allow:/etc/fips/peers.allow:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/peers.deny:/etc/fips/peers.deny:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/fips.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-c/fips.key:/etc/fips/fips.key:ro networks: - acl-net: - ipv4_address: 172.31.0.12 + - acl-net service-d: <<: *fips-common @@ -77,14 +84,13 @@ services: hostname: host-d volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/node-d/hosts:/etc/fips/hosts:ro - - ./generated-configs/node-d/peers.allow:/etc/fips/peers.allow:ro - - ./generated-configs/node-d/peers.deny:/etc/fips/peers.deny:ro - - ./generated-configs/node-d/fips.yaml:/etc/fips/fips.yaml:ro - - ./generated-configs/node-d/fips.key:/etc/fips/fips.key:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/hosts:/etc/fips/hosts:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/peers.allow:/etc/fips/peers.allow:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/peers.deny:/etc/fips/peers.deny:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/fips.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-d/fips.key:/etc/fips/fips.key:ro networks: - acl-net: - ipv4_address: 172.31.0.13 + - acl-net service-e: <<: *fips-common @@ -92,12 +98,11 @@ services: hostname: host-e volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/node-e/hosts:/etc/fips/hosts:ro - - ./generated-configs/node-e/fips.yaml:/etc/fips/fips.yaml:ro - - ./generated-configs/node-e/fips.key:/etc/fips/fips.key:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/hosts:/etc/fips/hosts:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/fips.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-e/fips.key:/etc/fips/fips.key:ro networks: - acl-net: - ipv4_address: 172.31.0.14 + - acl-net service-f: <<: *fips-common @@ -105,9 +110,8 @@ services: hostname: host-f volumes: - ../docker/resolv.conf:/etc/resolv.conf:ro - - ./generated-configs/node-f/hosts:/etc/fips/hosts:ro - - ./generated-configs/node-f/fips.yaml:/etc/fips/fips.yaml:ro - - ./generated-configs/node-f/fips.key:/etc/fips/fips.key:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/hosts:/etc/fips/hosts:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/fips.yaml:/etc/fips/fips.yaml:ro + - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-f/fips.key:/etc/fips/fips.key:ro networks: - acl-net: - ipv4_address: 172.31.0.15 + - acl-net diff --git a/testing/acl-allowlist/generate-configs.sh b/testing/acl-allowlist/generate-configs.sh index 01ced41..302b127 100755 --- a/testing/acl-allowlist/generate-configs.sh +++ b/testing/acl-allowlist/generate-configs.sh @@ -3,7 +3,12 @@ set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -GENERATED_DIR="$SCRIPT_DIR/generated-configs" + +# Scoped by the per-run suffix because this directory is wiped and rewritten +# below: two runs sharing one output directory would delete each other's +# fixtures out from under running containers. Unset (a bare hand run, or the +# GitHub-hosted path) it collapses to the historical "generated-configs". +GENERATED_DIR="$SCRIPT_DIR/generated-configs${FIPS_CI_NAME_SUFFIX:-}" write_file() { local path="$1" @@ -23,6 +28,10 @@ node-f npub1ytrut7gjncn2zfnhn56c0zgftf0w6p99gf6fu8j73hzw5603zglqc9av6c EOF } +# Peers are addressed by the docker hostname the compose file assigns +# (host-a … host-f), not by IP. The network requests no subnet so that two +# concurrent runs cannot collide on one address range, which means no node's +# address is knowable before `docker compose up`. echo "Generating ACL allowlist fixtures..." rm -rf "$GENERATED_DIR" @@ -48,31 +57,31 @@ peers: alias: "node-b" addresses: - transport: udp - addr: "172.31.0.11:2121" + addr: "host-b:2121" connect_policy: auto_connect - npub: "npub1cld9yay0u24davpu6c35l4vldrhzvaq66pcqtg9a0j2cnjrn9rtsxx2pe6" alias: "node-c" addresses: - transport: udp - addr: "172.31.0.12:2121" + addr: "host-c:2121" connect_policy: auto_connect - npub: "npub1n9lpnv0592cc2ps6nm0ca3qls642vx7yjsv35rkxqzj2vgds52sqgpverl" alias: "node-d" addresses: - transport: udp - addr: "172.31.0.13:2121" + addr: "host-d:2121" connect_policy: auto_connect - npub: "npub1x5z9rwzzm26q9verutx4aajhf2zw2pyp34c6whhde2zduxqav40qgq36l6" alias: "node-e" addresses: - transport: udp - addr: "172.31.0.14:2121" + addr: "host-e:2121" connect_policy: auto_connect - npub: "npub1ytrut7gjncn2zfnhn56c0zgftf0w6p99gf6fu8j73hzw5603zglqc9av6c" alias: "node-f" addresses: - transport: udp - addr: "172.31.0.15:2121" + addr: "host-f:2121" connect_policy: auto_connect EOF @@ -113,19 +122,19 @@ peers: alias: "node-a" addresses: - transport: udp - addr: "172.31.0.10:2121" + addr: "host-a:2121" connect_policy: auto_connect - npub: "npub1cld9yay0u24davpu6c35l4vldrhzvaq66pcqtg9a0j2cnjrn9rtsxx2pe6" alias: "node-c" addresses: - transport: udp - addr: "172.31.0.12:2121" + addr: "host-c:2121" connect_policy: auto_connect - npub: "npub1n9lpnv0592cc2ps6nm0ca3qls642vx7yjsv35rkxqzj2vgds52sqgpverl" alias: "node-d" addresses: - transport: udp - addr: "172.31.0.13:2121" + addr: "host-d:2121" connect_policy: auto_connect EOF @@ -166,7 +175,7 @@ peers: alias: "node-a" addresses: - transport: udp - addr: "172.31.0.10:2121" + addr: "host-a:2121" connect_policy: auto_connect EOF @@ -209,7 +218,7 @@ peers: alias: "node-a" addresses: - transport: udp - addr: "172.31.0.10:2121" + addr: "host-a:2121" connect_policy: auto_connect EOF @@ -252,7 +261,7 @@ peers: alias: "node-a" addresses: - transport: udp - addr: "172.31.0.10:2121" + addr: "host-a:2121" connect_policy: auto_connect EOF @@ -282,7 +291,7 @@ peers: alias: "node-a" addresses: - transport: udp - addr: "172.31.0.10:2121" + addr: "host-a:2121" connect_policy: auto_connect EOF