mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
965de26239
A CI worker may preempt an in-flight ci-local.sh run (SIGTERM, then SIGKILL after a grace period) to restart on a newer commit. For that kill to be safe, the script must clean up after itself and never let a dying run collide with its restart. It previously had no signal handling, shared the default compose project name across runs, and tore down each suite only at the suite end. - Derive a per-run id (honoring FIPS_CI_RUN_ID, else short-sha+random) and namespace every docker resource to it: a fipsci_<run>_<suite> compose project per suite and per parallel chaos child, and per-run image tags (fips-test:<run>, fips-test-app:<run>) retagged to :latest only after both builds succeed so :latest never points at a half-built image. - Install a bounded, idempotent teardown trap on SIGTERM/SIGINT (+ EXIT): reap parallel chaos children, then force-remove this run's docker resources via the new ci-cleanup.sh, wrapped in timeout so a stuck down cannot wedge it. - Exit 143 (SIGTERM) / 130 (SIGINT), distinct from 0 (pass) / 1 (failed), so a preempting worker tells a cancelled run from a real failure. - Add ci-cleanup.sh (also ci-local.sh --reap): force-removes leftover CI resources by the com.corganlabs.fips-ci=1 label and the fipsci_ project prefix, robust to however a prior run died. - Label every per-suite docker resource so the label sweep reaps it after a SIGKILL regardless of network name: direct docker run/network resources, the sidecar compose services, and every per-suite compose network (acl-allowlist, boringtun, firewall, nat, static, both tor suites, and the chaos generator template). Parametrize the static/sidecar compose image refs so the per-run tags are honored. - Give each parallel chaos child a unique /24 from 10.30.x (a new --subnet override on the sim CLI, assigned per-child in ci-local.sh) so parallel children never collide on a shared docker subnet, and a chaos net can never span a fixed-subnet suite (sidecar/static in 172.20.x). 10.30.x sits outside docker's default-address-pool range, so an auto-assigned net cannot land on it either; node IPs derive from the subnet, so no scenario config changes.
133 lines
3.3 KiB
Bash
Executable File
133 lines
3.3 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
NAT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
|
|
SCENARIO="${1:?usage: setup-topology.sh <cone|symmetric>}"
|
|
|
|
case "$SCENARIO" in
|
|
cone)
|
|
node_a="fips-nat-cone-a"
|
|
node_b="fips-nat-cone-b"
|
|
;;
|
|
symmetric)
|
|
node_a="fips-nat-symmetric-a"
|
|
node_b="fips-nat-symmetric-b"
|
|
;;
|
|
*)
|
|
echo "Unsupported topology scenario: $SCENARIO" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
router_a="fips-nat-router-a"
|
|
router_b="fips-nat-router-b"
|
|
|
|
helper_image() {
|
|
if [ -n "${IP_HELPER_IMAGE:-}" ]; then
|
|
echo "$IP_HELPER_IMAGE"
|
|
return 0
|
|
fi
|
|
|
|
docker inspect -f '{{.Config.Image}}' "$router_a"
|
|
}
|
|
|
|
wait_for_pid() {
|
|
local container="$1"
|
|
local timeout_secs="${2:-30}"
|
|
local deadline=$((SECONDS + timeout_secs))
|
|
local pid=""
|
|
|
|
while [ "$SECONDS" -lt "$deadline" ]; do
|
|
pid="$(docker inspect -f '{{.State.Pid}}' "$container" 2>/dev/null || true)"
|
|
if [[ "$pid" =~ ^[0-9]+$ ]] && [ "$pid" -gt 0 ]; then
|
|
echo "$pid"
|
|
return 0
|
|
fi
|
|
sleep 0.5
|
|
done
|
|
|
|
echo "Timed out waiting for container PID: $container" >&2
|
|
return 1
|
|
}
|
|
|
|
run_host_ip() {
|
|
local image="$1"
|
|
shift
|
|
docker run --rm \
|
|
--label com.corganlabs.fips-ci=1 \
|
|
--privileged \
|
|
--net=host \
|
|
--pid=host \
|
|
--entrypoint ip \
|
|
"$image" \
|
|
"$@"
|
|
}
|
|
|
|
configure_node_iface() {
|
|
local container="$1"
|
|
local current_name="$2"
|
|
local final_name="$3"
|
|
local cidr="$4"
|
|
|
|
docker exec "$container" sh -lc "
|
|
ip link set lo up &&
|
|
ip link set '$current_name' name '$final_name' &&
|
|
ip addr flush dev '$final_name' &&
|
|
ip addr add '$cidr' dev '$final_name' &&
|
|
ip link set '$final_name' up
|
|
"
|
|
}
|
|
|
|
configure_router_iface() {
|
|
local container="$1"
|
|
local current_name="$2"
|
|
local final_name="$3"
|
|
local cidr="$4"
|
|
|
|
docker exec "$container" sh -lc "
|
|
ip link set lo up &&
|
|
ip link set '$current_name' name '$final_name' &&
|
|
ip addr flush dev '$final_name' &&
|
|
ip addr add '$cidr' dev '$final_name' &&
|
|
ip link set '$final_name' up
|
|
"
|
|
}
|
|
|
|
setup_pair() {
|
|
local image="$1"
|
|
local node_container="$2"
|
|
local router_container="$3"
|
|
local host_node="$4"
|
|
local host_router="$5"
|
|
local node_cidr="$6"
|
|
local router_cidr="$7"
|
|
|
|
local node_pid router_pid
|
|
node_pid="$(wait_for_pid "$node_container")"
|
|
router_pid="$(wait_for_pid "$router_container")"
|
|
|
|
run_host_ip "$image" link delete "$host_node" >/dev/null 2>&1 || true
|
|
run_host_ip "$image" link delete "$host_router" >/dev/null 2>&1 || true
|
|
run_host_ip "$image" link add "$host_node" type veth peer name "$host_router"
|
|
run_host_ip "$image" link set "$host_node" netns "$node_pid"
|
|
run_host_ip "$image" link set "$host_router" netns "$router_pid"
|
|
|
|
configure_node_iface "$node_container" "$host_node" eth0 "$node_cidr"
|
|
configure_router_iface "$router_container" "$host_router" eth1 "$router_cidr"
|
|
}
|
|
|
|
main() {
|
|
cd "$NAT_DIR"
|
|
|
|
local image
|
|
image="$(helper_image)"
|
|
|
|
setup_pair "$image" "$node_a" "$router_a" vna0 vna1 172.31.1.10/24 172.31.1.254/24
|
|
setup_pair "$image" "$node_b" "$router_b" vnb0 vnb1 172.31.2.10/24 172.31.2.254/24
|
|
}
|
|
|
|
main "$@"
|