v0.173.0 — R-77: endpoint-drift detection, samba protected-set gate, channel log honesty
Source: felhom.eu/documentation/audits/DIAG-agent-channel-2026-07-26.md bootstrap.DetectEndpointDrift names a controller.yaml vs bootstrap.json local_api.endpoint divergence -- one ERROR carrying BOTH values and BOTH paths, its own event type local_api_endpoint_drift, and its own Hungarian banner shown ABOVE the channel banner because drift is the cause and "agent unreachable" the symptom. It writes NOTHING: reconciling from bootstrap.json would clobber a correct controller.yaml on any half-provisioned or hand-repaired guest, so the authority ruling is deferred to R-78. Fail-safe silent on absent/unparseable/ incomplete bootstrap and on an empty endpoint (ensureLocalAPI's fill-if-missing path is untouched). Fingerprint compared as a BOOLEAN only; token never compared, logged or exposed. EffectiveProtected now gates samba on Enabled && UserSet, mirroring BOTH of reconcileSambaAt's early returns, and the doc comment is corrected in the same change -- it claimed "detection and deployment agree in both directions" while citing only !smb.Enabled, an assertion that went false when !smb.UserSet was added. Not over-suppressed: sharing on WITH a password and a dead container still alarms. Channel log: the debounce placeholder is stateUnconfirmed (rendered "unseeded") instead of "up", so a born-down channel no longer logs "up->down" and orUnseeded stops being dead code. Logging only -- the placeholder is still matched in the re-arm condition, so F2 born-down alerting is byte-for-byte unchanged and all nine pre-existing channelhealth tests pass. Tests 951 -> 959, all green. Red-proofs A (both directions), E and F. MinAgent unchanged; felhom-agent untouched.
This commit is contained in:
@@ -320,3 +320,95 @@ func writeFileAtomic(path string, b []byte) error {
|
||||
}
|
||||
return os.Rename(tmp, path)
|
||||
}
|
||||
|
||||
// --- Endpoint-drift detection (R-77, from DIAG-agent-channel-2026-07-26) ---------------------
|
||||
//
|
||||
// THE OUTAGE THIS EXISTS FOR: the R-50 island migration rewrote bootstrap.json's
|
||||
// local_api.endpoint to the island address; controller.yaml kept the pre-island LAN address on the
|
||||
// whole fleet; the agent no longer binds that address. Both controllers went dark for ~17.5 h, and
|
||||
// the only alert said "agent unreachable" — indistinguishable from a dead agent or a network blip,
|
||||
// so it read as infrastructure noise rather than a config fault. ensureLocalAPI could not catch it:
|
||||
// it fills an ABSENT local_api block and returns early on a present one, stale or not.
|
||||
//
|
||||
// This is DETECTION AND NAMING ONLY. It deliberately does NOT reconcile the two files:
|
||||
//
|
||||
// the mirror-image failure is just as bad — on a guest whose controller.yaml is correct and whose
|
||||
// bootstrap.json is stale, auto-reconcile would clobber a WORKING channel, fleet-wide, on the next
|
||||
// restart. Which file is authoritative is a real, unresolved question and is tracked as R-78.
|
||||
//
|
||||
// Naming it is enough to have converted that outage into a specific, actionable alert on the first
|
||||
// health cycle, which is the whole lesson of the incident.
|
||||
|
||||
// EndpointDrift is a detected divergence between the two local_api sources. It carries no secrets:
|
||||
// the fingerprint is reported as an agreement BOOLEAN and the token is not compared or exposed at
|
||||
// all (a token mismatch is a different failure — see the field comment).
|
||||
type EndpointDrift struct {
|
||||
ConfigPath string // controller.yaml
|
||||
BootstrapPath string // bootstrap.json
|
||||
ConfigEndpoint string // what the controller is actually dialling
|
||||
BootstrapEndpoint string // what the provisioning side last wrote
|
||||
// FingerprintAgrees is false when the pin ALSO moved. That is a materially different (and worse)
|
||||
// situation than a moved address — fixing the endpoint alone would then fail closed on the pin —
|
||||
// so it is surfaced, as a boolean, never as a value.
|
||||
FingerprintAgrees bool
|
||||
}
|
||||
|
||||
// DetectEndpointDrift compares controller.yaml's live local_api.endpoint against bootstrap.json's.
|
||||
// Returns nil (silent, no alert) in every ambiguous or not-applicable case:
|
||||
//
|
||||
// - cfg is nil, or its endpoint is EMPTY — that is the fill-if-missing path ensureLocalAPI owns,
|
||||
// not drift;
|
||||
// - bootstrap.json is absent, unreadable or unparseable — a legacy / manually-configured /
|
||||
// unprovisioned guest is not a drifted one;
|
||||
// - the bootstrap local_api block is incomplete (any of endpoint/fingerprint/token empty) — the
|
||||
// same completeness bar ensureLocalAPI applies before it will merge;
|
||||
// - the endpoints agree.
|
||||
//
|
||||
// It reads two files and writes NOTHING. Emitting the ERROR here (rather than at the call site)
|
||||
// keeps the diagnosis in one line of log even when the alert path is unavailable.
|
||||
func DetectEndpointDrift(configPath string, cfg *config.Config, logger *log.Logger) *EndpointDrift {
|
||||
if cfg == nil || cfg.LocalAPI.Endpoint == "" {
|
||||
return nil
|
||||
}
|
||||
data, err := os.ReadFile(Path())
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
var b Bootstrap
|
||||
if err := json.Unmarshal(data, &b); err != nil {
|
||||
return nil
|
||||
}
|
||||
if b.LocalAPI.Endpoint == "" || b.LocalAPI.Fingerprint == "" || b.LocalAPI.Token == "" {
|
||||
return nil
|
||||
}
|
||||
if cfg.LocalAPI.Endpoint == b.LocalAPI.Endpoint {
|
||||
return nil
|
||||
}
|
||||
d := &EndpointDrift{
|
||||
ConfigPath: configPath,
|
||||
BootstrapPath: Path(),
|
||||
ConfigEndpoint: cfg.LocalAPI.Endpoint,
|
||||
BootstrapEndpoint: b.LocalAPI.Endpoint,
|
||||
FingerprintAgrees: cfg.LocalAPI.Fingerprint == b.LocalAPI.Fingerprint,
|
||||
}
|
||||
if logger != nil {
|
||||
logger.Printf("[ERROR] bootstrap: local_api endpoint DRIFT — %s says %q but %s says %q; "+
|
||||
"the controller is dialling the FORMER. Pin agrees: %v. Not auto-corrected (R-78 owns the "+
|
||||
"authority ruling) — fix the intended file and restart the controller.",
|
||||
d.ConfigPath, d.ConfigEndpoint, d.BootstrapPath, d.BootstrapEndpoint, d.FingerprintAgrees)
|
||||
}
|
||||
return d
|
||||
}
|
||||
|
||||
// EnglishMessage is the operator-tier alert body (operator events are English by convention).
|
||||
func (d *EndpointDrift) EnglishMessage() string {
|
||||
return fmt.Sprintf("local_api endpoint drift: controller.yaml=%s bootstrap.json=%s (pin agrees: %v) "+
|
||||
"— the controller is dialling controller.yaml's value; the agent may be listening on the other.",
|
||||
d.ConfigEndpoint, d.BootstrapEndpoint, d.FingerprintAgrees)
|
||||
}
|
||||
|
||||
// HungarianMessage is the customer-facing dashboard line, matching channelhealth's tone (short,
|
||||
// no addresses — the operator gets those in the event and the log).
|
||||
func (d *EndpointDrift) HungarianMessage() string {
|
||||
return "A tárolókezelő ügynök címe elavult a beállításokban."
|
||||
}
|
||||
|
||||
@@ -0,0 +1,223 @@
|
||||
package bootstrap
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"log"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-controller/internal/config"
|
||||
)
|
||||
|
||||
// R-77 endpoint-drift detection. The outage this guards is DIAG-agent-channel-2026-07-26: the island
|
||||
// migration rewrote bootstrap.json, controller.yaml kept the pre-island LAN address, and the fleet's
|
||||
// controllers dialled the wrong host for 17.5 h while alerting only "agent unreachable".
|
||||
|
||||
const driftYAML = `customer:
|
||||
id: demo-hp
|
||||
local_api:
|
||||
endpoint: %ENDPOINT%
|
||||
fingerprint: aaaa1111
|
||||
token: tok-secret
|
||||
`
|
||||
|
||||
// writeDriftFixture lays out a controller.yaml + bootstrap.json pair and points Path() at the latter.
|
||||
func writeDriftFixture(t *testing.T, cfgEndpoint, bsEndpoint, bsFingerprint, bsToken string) (cfgPath string, cfg *config.Config) {
|
||||
t.Helper()
|
||||
dir := t.TempDir()
|
||||
cfgPath = filepath.Join(dir, "controller.yaml")
|
||||
if err := os.WriteFile(cfgPath, []byte(strings.ReplaceAll(driftYAML, "%ENDPOINT%", cfgEndpoint)), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
bsPath := filepath.Join(dir, "bootstrap.json")
|
||||
b := Bootstrap{}
|
||||
b.LocalAPI = BootstrapLocalAPI{Endpoint: bsEndpoint, Fingerprint: bsFingerprint, Token: bsToken}
|
||||
raw, _ := json.Marshal(b)
|
||||
if err := os.WriteFile(bsPath, raw, 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Setenv("FELHOM_BOOTSTRAP_PATH", bsPath)
|
||||
|
||||
var err error
|
||||
cfg, err = config.LoadPermissive(cfgPath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return cfgPath, cfg
|
||||
}
|
||||
|
||||
func sha(t *testing.T, p string) []byte {
|
||||
t.Helper()
|
||||
b, err := os.ReadFile(p)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return b
|
||||
}
|
||||
|
||||
// Scenario A — drift is DETECTED, NAMED, and nothing is written.
|
||||
//
|
||||
// The "nothing is written" half is the load-bearing assertion: auto-reconcile is R-78 and would
|
||||
// clobber a working channel on any guest whose controller.yaml is the correct one. "An error was
|
||||
// logged" alone would be a hollow test.
|
||||
func TestScenarioA_DriftDetectedAndNamed_NoWrite(t *testing.T) {
|
||||
cfgPath, cfg := writeDriftFixture(t,
|
||||
"192.168.0.87:8443", // the live demo-hp value
|
||||
"169.254.253.1:8443", // the island value the migration wrote
|
||||
"aaaa1111", "tok-secret")
|
||||
before := sha(t, cfgPath)
|
||||
|
||||
var buf bytes.Buffer
|
||||
d := DetectEndpointDrift(cfgPath, cfg, log.New(&buf, "", 0))
|
||||
|
||||
if d == nil {
|
||||
t.Fatal("drift must be DETECTED — this is the exact live shape from the 2026-07-25 outage")
|
||||
}
|
||||
if d.ConfigEndpoint != "192.168.0.87:8443" || d.BootstrapEndpoint != "169.254.253.1:8443" {
|
||||
t.Errorf("wrong values captured: %+v", d)
|
||||
}
|
||||
if !d.FingerprintAgrees {
|
||||
t.Error("fingerprints are identical in this fixture — must report agreement")
|
||||
}
|
||||
|
||||
// The log line alone must diagnose it: BOTH values AND BOTH paths.
|
||||
logged := buf.String()
|
||||
for _, want := range []string{"192.168.0.87:8443", "169.254.253.1:8443", cfgPath, "bootstrap.json", "ERROR"} {
|
||||
if !strings.Contains(logged, want) {
|
||||
t.Errorf("the ERROR line must contain %q; got:\n%s", want, logged)
|
||||
}
|
||||
}
|
||||
// Never log a secret.
|
||||
if strings.Contains(logged, "tok-secret") {
|
||||
t.Error("the token must NEVER be logged")
|
||||
}
|
||||
|
||||
// THE assertion: controller.yaml is byte-identical.
|
||||
if after := sha(t, cfgPath); !bytes.Equal(before, after) {
|
||||
t.Errorf("controller.yaml was MODIFIED — detection must never write (that is R-78)\nbefore:\n%s\nafter:\n%s", before, after)
|
||||
}
|
||||
}
|
||||
|
||||
// Scenario B — agreement is silent. A spurious alert on every healthy boot would be worse than the
|
||||
// bug: it trains the operator to ignore the banner.
|
||||
func TestScenarioB_AgreementIsSilent(t *testing.T) {
|
||||
cfgPath, cfg := writeDriftFixture(t, "169.254.253.1:8443", "169.254.253.1:8443", "aaaa1111", "tok-secret")
|
||||
before := sha(t, cfgPath)
|
||||
var buf bytes.Buffer
|
||||
if d := DetectEndpointDrift(cfgPath, cfg, log.New(&buf, "", 0)); d != nil {
|
||||
t.Errorf("matching endpoints must not report drift: %+v", d)
|
||||
}
|
||||
if strings.Contains(buf.String(), "ERROR") {
|
||||
t.Errorf("no ERROR on agreement; got: %s", buf.String())
|
||||
}
|
||||
if after := sha(t, cfgPath); !bytes.Equal(before, after) {
|
||||
t.Error("controller.yaml must not be touched")
|
||||
}
|
||||
}
|
||||
|
||||
// Scenario D — an absent / unparseable / incomplete bootstrap is NOT drift. An unprovisioned or
|
||||
// legacy guest must stay silent, not alarm.
|
||||
func TestScenarioD_IncompleteBootstrapIsFailSafe(t *testing.T) {
|
||||
t.Run("bootstrap absent", func(t *testing.T) {
|
||||
cfgPath, cfg := writeDriftFixture(t, "192.168.0.87:8443", "169.254.253.1:8443", "aaaa1111", "tok")
|
||||
os.Remove(os.Getenv("FELHOM_BOOTSTRAP_PATH"))
|
||||
if d := DetectEndpointDrift(cfgPath, cfg, log.New(io.Discard, "", 0)); d != nil {
|
||||
t.Errorf("a missing bootstrap is not drift: %+v", d)
|
||||
}
|
||||
})
|
||||
t.Run("bootstrap unparseable", func(t *testing.T) {
|
||||
cfgPath, cfg := writeDriftFixture(t, "192.168.0.87:8443", "169.254.253.1:8443", "aaaa1111", "tok")
|
||||
os.WriteFile(os.Getenv("FELHOM_BOOTSTRAP_PATH"), []byte("{not json"), 0o600)
|
||||
if d := DetectEndpointDrift(cfgPath, cfg, log.New(io.Discard, "", 0)); d != nil {
|
||||
t.Errorf("an unparseable bootstrap is not drift: %+v", d)
|
||||
}
|
||||
})
|
||||
// Incomplete = any of endpoint/fingerprint/token empty — the same completeness bar ensureLocalAPI
|
||||
// applies before it will merge.
|
||||
for _, tc := range []struct{ name, ep, fp, tok string }{
|
||||
{"no endpoint", "", "aaaa1111", "tok"},
|
||||
{"no fingerprint", "169.254.253.1:8443", "", "tok"},
|
||||
{"no token", "169.254.253.1:8443", "aaaa1111", ""},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
cfgPath, cfg := writeDriftFixture(t, "192.168.0.87:8443", tc.ep, tc.fp, tc.tok)
|
||||
if d := DetectEndpointDrift(cfgPath, cfg, log.New(io.Discard, "", 0)); d != nil {
|
||||
t.Errorf("an incomplete bootstrap is not drift: %+v", d)
|
||||
}
|
||||
})
|
||||
}
|
||||
t.Run("controller.yaml has no endpoint — that is the fill-if-missing path, not drift", func(t *testing.T) {
|
||||
cfgPath, cfg := writeDriftFixture(t, `""`, "169.254.253.1:8443", "aaaa1111", "tok")
|
||||
if cfg.LocalAPI.Endpoint != "" {
|
||||
t.Skipf("fixture did not produce an empty endpoint (got %q)", cfg.LocalAPI.Endpoint)
|
||||
}
|
||||
if d := DetectEndpointDrift(cfgPath, cfg, log.New(io.Discard, "", 0)); d != nil {
|
||||
t.Errorf("an absent local_api endpoint is ensureLocalAPI's job, not drift: %+v", d)
|
||||
}
|
||||
})
|
||||
t.Run("nil cfg", func(t *testing.T) {
|
||||
if d := DetectEndpointDrift("/nonexistent", nil, log.New(io.Discard, "", 0)); d != nil {
|
||||
t.Error("nil cfg must be silent")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// A moved PIN alongside a moved address is a materially different failure — fixing the endpoint
|
||||
// alone would then fail closed on the pin. It must be surfaced, as a boolean, never as a value.
|
||||
func TestDrift_FingerprintDisagreementIsSurfacedNotLeaked(t *testing.T) {
|
||||
cfgPath, cfg := writeDriftFixture(t, "192.168.0.87:8443", "169.254.253.1:8443", "bbbb2222", "tok-secret")
|
||||
var buf bytes.Buffer
|
||||
d := DetectEndpointDrift(cfgPath, cfg, log.New(&buf, "", 0))
|
||||
if d == nil {
|
||||
t.Fatal("drift expected")
|
||||
}
|
||||
if d.FingerprintAgrees {
|
||||
t.Error("fingerprints differ in this fixture — must report DISagreement")
|
||||
}
|
||||
for _, secret := range []string{"aaaa1111", "bbbb2222", "tok-secret"} {
|
||||
if strings.Contains(buf.String(), secret) {
|
||||
t.Errorf("a fingerprint/token value leaked into the log: %q", secret)
|
||||
}
|
||||
if strings.Contains(d.EnglishMessage(), secret) {
|
||||
t.Errorf("a fingerprint/token value leaked into the operator message: %q", secret)
|
||||
}
|
||||
}
|
||||
if !strings.Contains(d.EnglishMessage(), "false") {
|
||||
t.Errorf("the operator message must carry the pin-agreement boolean: %q", d.EnglishMessage())
|
||||
}
|
||||
}
|
||||
|
||||
// Scenario C — the fill-if-missing path is untouched by any of this (it is the ONLY writer).
|
||||
func TestScenarioC_AbsentBlockStillMerges(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
cfgPath := filepath.Join(dir, "controller.yaml")
|
||||
if err := os.WriteFile(cfgPath, []byte("customer:\n id: demo-hp\n"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
bsPath := filepath.Join(dir, "bootstrap.json")
|
||||
b := Bootstrap{}
|
||||
b.LocalAPI = BootstrapLocalAPI{Endpoint: "169.254.253.1:8443", Fingerprint: "aaaa1111", Token: "tok"}
|
||||
raw, _ := json.Marshal(b)
|
||||
os.WriteFile(bsPath, raw, 0o600)
|
||||
t.Setenv("FELHOM_BOOTSTRAP_PATH", bsPath)
|
||||
|
||||
cfg, err := config.LoadPermissive(cfgPath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if cfg.LocalAPI.Endpoint != "" {
|
||||
t.Fatalf("precondition: fixture should have no local_api, got %q", cfg.LocalAPI.Endpoint)
|
||||
}
|
||||
got := ensureLocalAPI(cfgPath, cfg, log.New(io.Discard, "", 0))
|
||||
if got == nil || got.LocalAPI.Endpoint != "169.254.253.1:8443" {
|
||||
t.Fatalf("the fill-if-missing merge must still work; got %+v", got)
|
||||
}
|
||||
// And the drift check stays silent on the now-merged config.
|
||||
if d := DetectEndpointDrift(cfgPath, got, log.New(io.Discard, "", 0)); d != nil {
|
||||
t.Errorf("after a successful merge the two files agree — no drift: %+v", d)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user