admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.53.0: restore guests INTO the felhom pool (pool-scoped-ACL enabler)

Browse Source 
RestoreLXCOptions.Pool → pct restore --pool (omit-when-empty). New
reconcile.DefaultPool="felhom"; BringUpSpec.Pool threaded to the bring-up
restore; BOTH restore sites pool the guest (provision/DR via spec.Pool set to
DefaultPool by the CLI; restore-test scratch via DefaultPool = SPIKE residual
#2). No agent ACL change (ships in host-install v1.6.0); the pool param is inert
until the token has Pool.Allocate + the pool exists, so publishing is safe ahead
of the coordinated swap. Tests + red-proofs; go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-07-01 12:32:41 +02:00
parent 33e3443545
commit 7639ab5c4b
8 changed files with 129 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/proxmox/mutate.go
+8
View File
@@ -34,6 +34,11 @@ type RestoreLXCOptions struct {
Archive string // source archive volid, e.g. "local:backup/vzdump-lxc-9001-...tar.zst"
Storage string // target storage for the rootfs, e.g. "local-lvm"
Force bool // overwrite an existing VMID (destructive — caller must have authority)
// Pool allocates the restored guest INTO a PVE pool (pct restore --pool). "" = no pool. Under a
// pool-scoped token this is REQUIRED for the restore to authorize (VM.Allocate + Pool.Allocate are
// granted at /pool/<pool>, not /), and it makes the guest reachable by the scoped token afterwards
// (SPIKE-pool-scoped-acl-2026-07-01). Empty is valid — a broad-token restore needs no pool.
Pool string
// MountOverrides overrides specific mountpoints at restore time (mpN -> full value, e.g.
// "local-lvm:1,mp=/data,backup=0"). A restore param takes precedence over the archive's own
// mpN. The restore-test uses this to neutralize a SOURCE host bind-mount mountpoint (slice-10
@@ -59,6 +64,9 @@ func (c *Client) RestoreLXC(ctx context.Context, opts RestoreLXCOptions) (string
if opts.Force {
v.Set("force", "1")
}
if opts.Pool != "" {
v.Set("pool", opts.Pool) // allocate into the pool (pool-scoped token needs this — see RestoreLXCOptions.Pool)
}
for k, val := range opts.MountOverrides {
v.Set(k, val) // e.g. mp0 -> "local-lvm:1,mp=/data,backup=0" (overrides the archive's mp0)
}
internal/proxmox/restore_test.go
+39
View File
@@ -0,0 +1,39 @@
package proxmox
import (
"context"
"io"
"net/http"
"strings"
"testing"
)
// RestoreLXC sends pool= only when Pool is set. Under a pool-scoped token the restore MUST carry
// pool=felhom (else VM.Allocate/Pool.Allocate 403); with Pool empty it MUST be omitted (a naive
// unconditional Set would send an empty pool= — omit-when-empty is the guarantee).
func TestRestoreLXC_PoolParam(t *testing.T) {
var body string
d := &mockDoer{fn: func(r *http.Request) (*http.Response, error) {
b, _ := io.ReadAll(r.Body)
body = string(b)
return jsonResp(200, `{"data":"`+testUPID+`"}`), nil
}}
c := newTestClient(d)
ctx := context.Background()
// Pool set → pool=felhom present in the POST body.
if _, err := c.RestoreLXC(ctx, RestoreLXCOptions{VMID: 9100, Archive: "local:backup/a.tar.zst", Storage: "local-lvm", Pool: "felhom"}); err != nil {
t.Fatalf("RestoreLXC(Pool): %v", err)
}
if !strings.Contains(body, "pool=felhom") {
t.Errorf("Pool set: expected pool=felhom in body, got %q", body)
}
// Pool empty → NO pool key at all (omit-when-empty).
if _, err := c.RestoreLXC(ctx, RestoreLXCOptions{VMID: 9100, Archive: "local:backup/a.tar.zst", Storage: "local-lvm"}); err != nil {
t.Fatalf("RestoreLXC(no Pool): %v", err)
}
if strings.Contains(body, "pool=") {
t.Errorf("Pool empty: pool key must be ABSENT, got %q", body)
}
}
internal/reconcile/bringup.go
+8 -1
View File
@@ -43,6 +43,12 @@ const bringUpKind = "bring_up"
// DefaultDataVolMount is the mpN slot the golden bakes the Docker-data volume (/var/lib/docker) at.
const DefaultDataVolMount = "mp0"
// DefaultPool is the PVE pool every Felhom-managed guest is restored INTO. Under the pool-scoped agent
// token, restore-into-pool is how a fresh vmid gets allocated (VM.Allocate + Pool.Allocate at
// /pool/felhom) and how the guest becomes reachable by the scoped token (SPIKE-pool-scoped-acl-2026-07-01).
// Single source of truth for both restore sites (provision bring-up + restore-test).
const DefaultPool = "felhom"
// DefaultSysDataMount is the mpN slot the golden bakes the SSD user-data volume (/mnt/sys_drive) at.
// This is the controller's system_data_path; provision grows it (SysDataGrowGB) like the Docker-data
// volume. mp1 is the natural next bring-up slot (mp8/mp9 are added by the provision back-half).
@@ -76,6 +82,7 @@ type BringUpSpec struct {
VMID int // caller-provided target VMID (NOT the restore-test band / 9999)
RestoreStorage string // rootfs target storage
Hostname string // hostname to set (provision); ignored for DR (continuity)
Pool string // restore the guest INTO this PVE pool ("" = none); required under a pool-scoped token
Cores int // 0 = leave as restored
MemoryMB int // 0 = leave as restored
RootfsGrowGB int // optional grow-only rootfs resize (0 = skip)
@@ -200,7 +207,7 @@ func (e *Engine) runBringUp(ctx context.Context, spec BringUpSpec, res *BringUpR
// 1. Restore archive → VMID (token-covered ClassCreate; keyctl preserved — phase3 + spike).
upid, err := e.api.RestoreLXC(ctx, proxmox.RestoreLXCOptions{
VMID: spec.VMID, Archive: spec.Archive, Storage: spec.RestoreStorage,
VMID: spec.VMID, Archive: spec.Archive, Storage: spec.RestoreStorage, Pool: spec.Pool,
})
if err != nil {
res.Err = fmt.Errorf("reconcile: bring-up restore: %w", err)
internal/reconcile/bringup_test.go
+36
View File
@@ -119,6 +119,42 @@ func TestBuildBringUpConfig_ResourceCaps(t *testing.T) {
}
}
// Both restore sites allocate the guest INTO the felhom pool (SPIKE 3b): the provision bring-up
// threads spec.Pool, and the restore-test hardcodes DefaultPool — else a pool-scoped token 403s on
// the created guest's config/start/destroy. Asserts via the fakeAPI's captured RestoreLXCOptions.
func TestRestoreSitesUsePool(t *testing.T) {
// provision bring-up: spec.Pool must flow to the restore
const vmid = 8060
api := &fakeAPI{cfg: map[int]proxmox.GuestConfig{vmid: scratchCfg()}}
e, _, q := newEngine(t, api, EmptyProvider{})
defer q.Close()
res := e.RunBringUp(context.Background(), BringUpSpec{
Mode: ModeProvision, Archive: "local:backup/g.tar.zst", VMID: vmid,
RestoreStorage: "local-lvm", Pool: DefaultPool,
})
if res.Err != nil || !res.Pass {
t.Fatalf("bring-up must pass: %+v", res)
}
if len(api.restores) != 1 || api.restores[0].Pool != DefaultPool {
t.Fatalf("provision restore must set Pool=%q, got %+v", DefaultPool, api.restores)
}
// restore-test: the scratch restore hardcodes DefaultPool
api2 := &fakeAPI{cfg: map[int]proxmox.GuestConfig{990000: scratchCfg()}}
e2, _, q2 := newEngine(t, api2, EmptyProvider{})
defer q2.Close()
rt := e2.RunRestoreTest(context.Background(), RestoreTestSpec{
Archive: "local:backup/x.tar.zst", RestoreStorage: "local-lvm",
ScratchMin: 990000, ScratchMax: 990009, SourceTier: "local",
})
if rt.Err != nil || !rt.Pass {
t.Fatalf("restore-test must pass: %+v", rt)
}
if len(api2.restores) != 1 || api2.restores[0].Pool != DefaultPool {
t.Fatalf("restore-test restore must set Pool=%q, got %+v", DefaultPool, api2.restores)
}
}
// The golden-carried Docker-data volume is grown via a SEPARATE resize on its mpN slot (B4),
// alongside (but distinct from) the rootfs grow.
func TestRunBringUp_StorageSplit_DataVolGrow(t *testing.T) {
internal/reconcile/restoretest.go
+3 -1
View File
@@ -192,7 +192,9 @@ func (e *Engine) runScratchTest(ctx context.Context, vmid int, spec RestoreTestS
}
}
upid, err := e.api.RestoreLXC(ctx, proxmox.RestoreLXCOptions{
VMID: vmid, Archive: spec.Archive, Storage: spec.RestoreStorage, MountOverrides: mountOverrides,
// Pool=DefaultPool so the scratch guest is created INTO the felhom pool — else a pool-scoped
// token 403s on the scratch guest's config/start/destroy (SPIKE residual #2).
VMID: vmid, Archive: spec.Archive, Storage: spec.RestoreStorage, MountOverrides: mountOverrides, Pool: DefaultPool,
})
if err != nil {
res.Err = fmt.Errorf("reconcile: restore-test restore: %w", err)