mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-06 11:38:24 +00:00
Arjen
6485271ef5
Two daemons whose only transports are interface-bound, run against a veth pair the harness creates, downs, deletes and recreates underneath them. Asserts the boot race (a daemon whose only interface is missing starts, reports the transport absent and the node Degraded, rather than exiting on NoTransports or skipping the transport for the life of the process), the late attach and discovery over it, the flap in both directions, destroy-and-recreate, and that an optional interface which never appears never moves node health. Also the log policy, which is the half that is easy to regress silently: absence is logged once on the edge and not once per retry; a required interface still absent past the ten-second bring-up window errors exactly once, while the optional one — absent just as long — stays silent; and that error is not repeated on a schedule. The detach edge is checked not to error, guarded by how long detection actually took, so a slow runner skips the check rather than failing on the harness's own latency. The containers run FIPS_TEST_MODE=default, not chaos. The chaos entrypoint waits up to 30 s for every configured Ethernet interface before starting the daemon, which is precisely the workaround under test — the daemon has to do its own waiting here or the suite proves nothing. Host-namespace ip(8) runs in a short-lived privileged container sharing the host network and PID namespaces, for the reason chaos/sim/veth.py documents: on macOS the containers live in the Docker VM, so ip(8) run on the macOS host could never reach them. Chaos ethernet transports are marked optional: true. In that harness a neighbour's interface disappearing is the scenario, not a fault — node_churn stops a container, which destroys its netns and with it both ends of every veth it held, so a surviving node watches a required interface vanish for the 30-90 s the neighbour is down, once per churn event. Reporting that at error is right for a deployment and wrong for a harness that tears the interface down on purpose; the mesh-wide zero-ERROR ceiling would have failed on injected chaos rather than on a defect.
58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
networks:
|
|
# Management bridge only. The FIPS transport under test is raw Ethernet on a
|
|
# veth pair the harness creates *after* the daemons are already running —
|
|
# that is the whole point of the suite — so no FIPS traffic crosses this
|
|
# network. No subnet is requested, so two concurrent runs cannot collide on
|
|
# one address range.
|
|
#
|
|
# The compose project name is still fixed, so two runs that do not set
|
|
# COMPOSE_PROJECT_NAME share a project and the second `up` recreates the
|
|
# first's containers. The local CI runner scopes it externally
|
|
# (run_iface_binding in ci-local.sh); a bare hand run does not.
|
|
ifb-net:
|
|
driver: bridge
|
|
labels:
|
|
- "com.corganlabs.fips-ci=1"
|
|
|
|
x-fips-common: &fips-common
|
|
build:
|
|
# The harness scopes its build context per run and passes it here; the
|
|
# shared directory is the hand-run default. Compose resolves a relative
|
|
# value against THIS file's directory, so the harness must export an
|
|
# absolute path.
|
|
context: ${FIPS_BUILD_CONTEXT:-../docker}
|
|
image: ${FIPS_TEST_IMAGE:-fips-test:latest}
|
|
entrypoint: ["/usr/local/bin/entrypoint.sh"]
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
restart: "no"
|
|
environment:
|
|
# `default`, deliberately — NOT `chaos`. The chaos entrypoint waits up to
|
|
# 30 s for every configured Ethernet interface to appear before it starts
|
|
# the daemon, which is precisely the workaround this mechanism retires. The
|
|
# daemon must do its own waiting here or the suite proves nothing.
|
|
- FIPS_TEST_MODE=default
|
|
- RUST_LOG=info,fips::transport::ethernet=debug,fips::node=debug
|
|
networks:
|
|
- ifb-net
|
|
|
|
services:
|
|
node-a:
|
|
<<: *fips-common
|
|
container_name: fips-ifb-node-a${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-a
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-a/fips.key:/etc/fips/fips.key:ro
|
|
|
|
node-b:
|
|
<<: *fips-common
|
|
container_name: fips-ifb-node-b${FIPS_CI_NAME_SUFFIX:-}
|
|
hostname: host-b
|
|
volumes:
|
|
- ../docker/resolv.conf:/etc/resolv.conf:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.yaml:/etc/fips/fips.yaml:ro
|
|
- ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/node-b/fips.key:/etc/fips/fips.key:ro
|