mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
965de26239
A CI worker may preempt an in-flight ci-local.sh run (SIGTERM, then SIGKILL after a grace period) to restart on a newer commit. For that kill to be safe, the script must clean up after itself and never let a dying run collide with its restart. It previously had no signal handling, shared the default compose project name across runs, and tore down each suite only at the suite end. - Derive a per-run id (honoring FIPS_CI_RUN_ID, else short-sha+random) and namespace every docker resource to it: a fipsci_<run>_<suite> compose project per suite and per parallel chaos child, and per-run image tags (fips-test:<run>, fips-test-app:<run>) retagged to :latest only after both builds succeed so :latest never points at a half-built image. - Install a bounded, idempotent teardown trap on SIGTERM/SIGINT (+ EXIT): reap parallel chaos children, then force-remove this run's docker resources via the new ci-cleanup.sh, wrapped in timeout so a stuck down cannot wedge it. - Exit 143 (SIGTERM) / 130 (SIGINT), distinct from 0 (pass) / 1 (failed), so a preempting worker tells a cancelled run from a real failure. - Add ci-cleanup.sh (also ci-local.sh --reap): force-removes leftover CI resources by the com.corganlabs.fips-ci=1 label and the fipsci_ project prefix, robust to however a prior run died. - Label every per-suite docker resource so the label sweep reaps it after a SIGKILL regardless of network name: direct docker run/network resources, the sidecar compose services, and every per-suite compose network (acl-allowlist, boringtun, firewall, nat, static, both tor suites, and the chaos generator template). Parametrize the static/sidecar compose image refs so the per-run tags are honored. - Give each parallel chaos child a unique /24 from 10.30.x (a new --subnet override on the sim CLI, assigned per-child in ci-local.sh) so parallel children never collide on a shared docker subnet, and a chaos net can never span a fixed-subnet suite (sidecar/static in 172.20.x). 10.30.x sits outside docker's default-address-pool range, so an auto-assigned net cannot land on it either; node IPs derive from the subnet, so no scenario config changes.
114 lines
3.5 KiB
YAML
114 lines
3.5 KiB
YAML
networks:
|
|
acl-net:
|
|
driver: bridge
|
|
labels:
|
|
- "com.corganlabs.fips-ci=1"
|
|
ipam:
|
|
config:
|
|
- subnet: 172.31.0.0/24
|
|
|
|
x-fips-common: &fips-common
|
|
build:
|
|
context: ../docker
|
|
image: fips-test:latest
|
|
entrypoint: ["/usr/local/bin/entrypoint.sh"]
|
|
cap_add:
|
|
- NET_ADMIN
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
sysctls:
|
|
- net.ipv6.conf.all.disable_ipv6=0
|
|
restart: "no"
|
|
environment:
|
|
- FIPS_TEST_MODE=default
|
|
- RUST_LOG=info,fips::node=debug
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
|
|
services:
|
|
service-a:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-a
|
|
hostname: host-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-a/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-a/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs/node-a/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs/node-a/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-a/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
acl-net:
|
|
ipv4_address: 172.31.0.10
|
|
|
|
service-b:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-b
|
|
hostname: host-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-b/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-b/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs/node-b/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs/node-b/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-b/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
acl-net:
|
|
ipv4_address: 172.31.0.11
|
|
|
|
service-c:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-c
|
|
hostname: host-c
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-c/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-c/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs/node-c/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs/node-c/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-c/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
acl-net:
|
|
ipv4_address: 172.31.0.12
|
|
|
|
service-d:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-d
|
|
hostname: host-d
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-d/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-d/peers.allow:/etc/fips/peers.allow:ro
|
|
- ./generated-configs/node-d/peers.deny:/etc/fips/peers.deny:ro
|
|
- ./generated-configs/node-d/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-d/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
acl-net:
|
|
ipv4_address: 172.31.0.13
|
|
|
|
service-e:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-e
|
|
hostname: host-e
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-e/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-e/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-e/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
acl-net:
|
|
ipv4_address: 172.31.0.14
|
|
|
|
service-f:
|
|
<<: *fips-common
|
|
container_name: fips-acl-container-f
|
|
hostname: host-f
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs/node-f/hosts:/etc/fips/hosts:ro
|
|
- ./generated-configs/node-f/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs/node-f/fips.key:/etc/fips/fips.key:ro
|
|
networks:
|
|
acl-net:
|
|
ipv4_address: 172.31.0.15
|