Files
fips/testing/chaos/scripts/chaos.sh
T
Johnathan Corgan 965de26239 testing: make ci-local.sh preemption-safe with per-run docker isolation
A CI worker may preempt an in-flight ci-local.sh run (SIGTERM, then SIGKILL
after a grace period) to restart on a newer commit. For that kill to be safe,
the script must clean up after itself and never let a dying run collide with
its restart. It previously had no signal handling, shared the default compose
project name across runs, and tore down each suite only at the suite end.

- Derive a per-run id (honoring FIPS_CI_RUN_ID, else short-sha+random) and
  namespace every docker resource to it: a fipsci_<run>_<suite> compose project
  per suite and per parallel chaos child, and per-run image tags
  (fips-test:<run>, fips-test-app:<run>) retagged to :latest only after both
  builds succeed so :latest never points at a half-built image.
- Install a bounded, idempotent teardown trap on SIGTERM/SIGINT (+ EXIT): reap
  parallel chaos children, then force-remove this run's docker resources via
  the new ci-cleanup.sh, wrapped in timeout so a stuck down cannot wedge it.
- Exit 143 (SIGTERM) / 130 (SIGINT), distinct from 0 (pass) / 1 (failed), so a
  preempting worker tells a cancelled run from a real failure.
- Add ci-cleanup.sh (also ci-local.sh --reap): force-removes leftover CI
  resources by the com.corganlabs.fips-ci=1 label and the fipsci_ project
  prefix, robust to however a prior run died.
- Label every per-suite docker resource so the label sweep reaps it after a
  SIGKILL regardless of network name: direct docker run/network resources, the
  sidecar compose services, and every per-suite compose network (acl-allowlist,
  boringtun, firewall, nat, static, both tor suites, and the chaos generator
  template). Parametrize the static/sidecar compose image refs so the per-run
  tags are honored.
- Give each parallel chaos child a unique /24 from 10.30.x (a new --subnet
  override on the sim CLI, assigned per-child in ci-local.sh) so parallel
  children never collide on a shared docker subnet, and a chaos net can never
  span a fixed-subnet suite (sidecar/static in 172.20.x). 10.30.x sits outside
  docker's default-address-pool range, so an auto-assigned net cannot land on
  it either; node IPs derive from the subnet, so no scenario config changes.
2026-06-29 14:23:46 +00:00

163 lines
4.5 KiB
Bash
Executable File

#!/bin/bash
# Run a FIPS stochastic network simulation.
#
# Usage: ./scripts/chaos.sh <scenario> [options]
# scenario: path to YAML file, or scenario name (e.g., "churn-10")
#
# Options:
# -v, --verbose Enable debug logging
# --seed <N> Override scenario seed
# --duration <secs> Override scenario duration
# --nodes <N> Override topology.num_nodes
# --list List available scenarios
#
# Examples:
# ./scripts/chaos.sh churn-10
# ./scripts/chaos.sh churn-10 --seed 123 --verbose
# ./scripts/chaos.sh scenarios/churn-10.yaml --duration 300
# ./scripts/chaos.sh --list
set -e
trap 'echo ""; echo "Simulation interrupted"; exit 130' INT
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CHAOS_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
SCENARIO_DIR="$CHAOS_DIR/scenarios"
usage() {
echo "Usage: $0 <scenario> [options]"
echo ""
echo "Arguments:"
echo " scenario Path to YAML file, or scenario name (e.g., churn-10)"
echo ""
echo "Options:"
echo " -v, --verbose Enable debug logging"
echo " --seed <N> Override scenario seed"
echo " --duration <secs> Override scenario duration"
echo " --nodes <N> Override topology.num_nodes"
echo " --list List available scenarios"
exit 1
}
list_scenarios() {
echo "=== Available Scenarios ==="
echo ""
for f in "$SCENARIO_DIR"/*.yaml; do
[ -f "$f" ] || continue
echo " $(basename "$f" .yaml)"
done
exit 0
}
# Handle --list before requiring a positional arg
for arg in "$@"; do
case "$arg" in
--list) list_scenarios ;;
esac
done
# Require at least one argument (the scenario)
[ $# -lt 1 ] && usage
# Parse arguments
SCENARIO_ARG=""
VERBOSE=""
SEED=""
DURATION=""
NODES=""
SUBNET=""
while [ $# -gt 0 ]; do
case "$1" in
-v|--verbose) VERBOSE="--verbose"; shift ;;
--seed) SEED="$2"; shift 2 ;;
--duration) DURATION="$2"; shift 2 ;;
--nodes) NODES="$2"; shift 2 ;;
--subnet) SUBNET="$2"; shift 2 ;;
--list) list_scenarios ;;
-*) echo "Error: Unknown option '$1'" >&2; usage ;;
*)
if [ -z "$SCENARIO_ARG" ]; then
SCENARIO_ARG="$1"
else
echo "Error: Unexpected argument '$1'" >&2
usage
fi
shift
;;
esac
done
[ -z "$SCENARIO_ARG" ] && usage
# Resolve scenario path
if [ -f "$SCENARIO_ARG" ]; then
SCENARIO_FILE="$SCENARIO_ARG"
elif [ -f "$SCENARIO_DIR/$SCENARIO_ARG.yaml" ]; then
SCENARIO_FILE="$SCENARIO_DIR/$SCENARIO_ARG.yaml"
else
echo "Error: Scenario not found: $SCENARIO_ARG" >&2
echo "Tried:" >&2
echo " $SCENARIO_ARG" >&2
echo " $SCENARIO_DIR/$SCENARIO_ARG.yaml" >&2
echo "" >&2
echo "Available scenarios:" >&2
for f in "$SCENARIO_DIR"/*.yaml; do
[ -f "$f" ] || continue
echo " $(basename "$f" .yaml)" >&2
done
exit 1
fi
# Check prerequisites
if ! command -v python3 &> /dev/null; then
echo "Error: python3 not found" >&2
exit 1
fi
if ! command -v docker &> /dev/null; then
echo "Error: docker not found" >&2
exit 1
fi
if ! docker info &> /dev/null; then
echo "Error: Docker is not running" >&2
exit 1
fi
DOCKER_DIR="$CHAOS_DIR/../docker"
if [ ! -f "$DOCKER_DIR/fips" ]; then
echo "Error: FIPS binary not found at $DOCKER_DIR/fips" >&2
echo "Run testing/scripts/build.sh first" >&2
exit 1
fi
# Build python args
PYTHON_ARGS=("$SCENARIO_FILE")
[ -n "$VERBOSE" ] && PYTHON_ARGS+=("$VERBOSE")
[ -n "$SEED" ] && PYTHON_ARGS+=("--seed" "$SEED")
[ -n "$DURATION" ] && PYTHON_ARGS+=("--duration" "$DURATION")
[ -n "$SUBNET" ] && PYTHON_ARGS+=("--subnet" "$SUBNET")
echo "=== FIPS Stochastic Simulation ==="
echo ""
echo " Scenario: $(basename "$SCENARIO_FILE" .yaml)"
echo " File: $SCENARIO_FILE"
[ -n "$SEED" ] && echo " Seed: $SEED (override)"
[ -n "$DURATION" ] && echo " Duration: ${DURATION}s (override)"
[ -n "$NODES" ] && echo " Nodes: $NODES (override)"
[ -n "$SUBNET" ] && echo " Subnet: $SUBNET (override)"
echo ""
# If --nodes is specified, create a patched copy of the scenario file
if [ -n "$NODES" ]; then
PATCHED=$(mktemp /tmp/chaos-scenario-XXXXXX.yaml)
sed "s/^\( num_nodes:\).*/\1 $NODES/" "$SCENARIO_FILE" > "$PATCHED"
PYTHON_ARGS[0]="$PATCHED"
trap 'rm -f "$PATCHED"' EXIT
fi
# Run from testing/chaos directory (sim expects relative paths)
cd "$CHAOS_DIR"
python3 -m sim "${PYTHON_ARGS[@]}"