didericis-codex
89058fbaec
test / integration-docker (pull_request) Successful in 24s
lint / lint (push) Failing after 1m0s
test / unit (pull_request) Successful in 2m3s
test / integration-firecracker (pull_request) Successful in 4m48s
test / coverage (pull_request) Successful in 20s
test / publish-infra (pull_request) Has been skipped
tracker-policy-pr / check-pr (pull_request) Failing after 11m36s
36 lines
1.1 KiB
Python
36 lines
1.1 KiB
Python
"""Shared host-side join for backend-discovered bottle encryption keys."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from .client import OrchestratorClient, OrchestratorClientError
|
|
|
|
|
|
def reprovision_bottles(
|
|
client: OrchestratorClient,
|
|
secrets_by_source_ip: dict[str, str],
|
|
) -> int:
|
|
"""Restore tokens for registered bottles whose backend exposes a key.
|
|
|
|
Backends own discovery because containers and microVMs have different
|
|
enumeration primitives. This helper owns the shared registry join and
|
|
intentionally tolerates one bad/missing key without blocking a launch.
|
|
"""
|
|
restored = 0
|
|
for bottle in client.list_bottles():
|
|
bottle_id = bottle.get("bottle_id")
|
|
source_ip = bottle.get("source_ip")
|
|
if not isinstance(bottle_id, str) or not isinstance(source_ip, str):
|
|
continue
|
|
secret = secrets_by_source_ip.get(source_ip, "").strip()
|
|
if not secret:
|
|
continue
|
|
try:
|
|
if client.reprovision_gateway(bottle_id, secret):
|
|
restored += 1
|
|
except OrchestratorClientError:
|
|
continue
|
|
return restored
|
|
|
|
|
|
__all__ = ["reprovision_bottles"]
|