admin
e5a18194f4
Lockstep with felhom-controller v0.40.0. The agent now bakes a v2 bootstrap.json
carrying only what the controller needs to PULL its config from the hub:
customer.id + hub.url + hub.retrieval_password + the per-guest local_api. Stops
baking the agent's host hub key/host_id (and customer name/domain/email) into the
guest — the controller gets the customer-scoped key from the hub pull.
- internal/provision/doc.go: SchemaV2; DocCustomer{id}; DocHub{url,retrieval_password}.
- backhalf.go: render v2; require customer.id + hub.url + hub.retrieval_password.
- cmd/.../main.go --selftest=provision: new required -hub-password flag; stop
baking APIKey/HostID; -customer-domain/name/email accepted but not baked.
- configs/build-golden.sh: default CONTROLLER_IMAGE off stale :v0.35.0 -> :0.40.0.
- doc_test.go/backhalf_test.go updated to v2 shape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
2.7 KiB
Go
53 lines
2.7 KiB
Go
// Package provision implements the slice-8A provisioning BACK HALF: after the slice-7 bring-up
|
|
// front half (restore → identity → size → start), the agent mints a per-guest local-API token,
|
|
// renders the stable bootstrap.json contract, and populates a read-only config mount the golden's
|
|
// baked controller-bootstrap unit consumes (F3: host-side only, no pct exec).
|
|
//
|
|
// The agent NEVER enters the guest and NEVER puts a registry credential in the guest (the
|
|
// controller image is baked into the golden — configs/build-golden.sh). The only secret written
|
|
// into the guest is the per-guest local-API token, in the 0600 bootstrap.json on the config mount.
|
|
package provision
|
|
|
|
import "encoding/json"
|
|
|
|
// SchemaV2 is the stable agent→controller contract version. It MUST stay byte-compatible with the
|
|
// controller's internal/bootstrap.SchemaV2 / Bootstrap shape (cross-repo contract; doc_test.go
|
|
// pins the key set, mirroring the controller's bootstrap_test.go). v2 changed the contract's
|
|
// MEANING — the controller now PULLS its full controller.yaml from the hub using a per-customer
|
|
// retrieval passphrase (which yields the CUSTOMER-scoped hub key), instead of the agent baking its
|
|
// HOST key. So the agent no longer puts the hub api_key / host id (or customer name/domain/email)
|
|
// into the guest; it relays only the customer id, the hub URL, the retrieval passphrase, and the
|
|
// per-guest local-API handle.
|
|
const SchemaV2 = "felhom.bootstrap/v2"
|
|
|
|
// Doc is the bootstrap.json the agent emits. Field names + json tags MUST match the controller's
|
|
// internal/bootstrap.Bootstrap exactly. It carries ONLY what the controller needs to PULL its config
|
|
// (customer id + hub url + retrieval passphrase) and reach the agent's local API — no registry
|
|
// credential (image is baked), no customer-scoped hub key, no CF tokens (those come from the pull).
|
|
type Doc struct {
|
|
Schema string `json:"schema"`
|
|
Customer DocCustomer `json:"customer"`
|
|
Hub DocHub `json:"hub"`
|
|
LocalAPI DocLocalAPI `json:"local_api"`
|
|
}
|
|
|
|
type DocCustomer struct {
|
|
ID string `json:"id"` // the pull target; the hub provides name/domain/email
|
|
}
|
|
|
|
type DocHub struct {
|
|
URL string `json:"url"`
|
|
RetrievalPassword string `json:"retrieval_password"` // SECRET — pulls the full config (incl. the customer key)
|
|
}
|
|
|
|
type DocLocalAPI struct {
|
|
Endpoint string `json:"endpoint"` // host bridge IP:port
|
|
Fingerprint string `json:"fingerprint"` // agent leaf-cert SHA-256 (hex) to pin
|
|
Token string `json:"token"` // per-guest bearer; SECRET — written 0600 only
|
|
}
|
|
|
|
// render marshals the doc as indented JSON (the bytes written into the config mount).
|
|
func (d Doc) render() ([]byte, error) {
|
|
return json.MarshalIndent(d, "", " ")
|
|
}
|