didericis
343f3a0735
`backend/docker/gateway_provision.py` had no docker-specific code left once `DockerGatewayTransport` moved out — `provision_git_gate` / `deprovision_git_gate` drive any `GatewayTransport`, and the guest-side paths they write (`/git-gate/creds/<id>`, `/git/<id>`, `/etc/git-gate/...`) are identical inside every backend's gateway. Yet the neutral `backend/consolidated_util.py` reached into the docker package to import them. Move it to `backend/gateway_provision.py`, a sibling of its only importer. The gateway *package* can't host it (git_gate already imports gateway.git_gate, so gateway importing git_gate would cycle), but the backend layer uses git_gate freely. Docstrings + the git_gate/service.py pointer updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
70 lines
2.5 KiB
Python
70 lines
2.5 KiB
Python
"""Shared helpers for the consolidated launch sequence (PRD 0070).
|
|
|
|
Logic that was duplicated across the docker, macos_container, and
|
|
firecracker consolidated_launch modules — extracted so each backend
|
|
imports it rather than re-implementing it.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import dataclasses
|
|
|
|
from ..egress import EgressPlan
|
|
from ..git_gate import GitGatePlan
|
|
from ..orchestrator.client import OrchestratorClient, RegisteredBottle
|
|
from ..orchestrator.registration import registration_inputs
|
|
from ..orchestrator.store.secret_store import new_env_var_secret
|
|
from .gateway_provision import GatewayTransport, deprovision_git_gate, provision_git_gate
|
|
|
|
|
|
def provision_bottle(
|
|
client: OrchestratorClient,
|
|
source_ip: str,
|
|
egress_plan: EgressPlan,
|
|
git_gate_plan: GitGatePlan,
|
|
transport: GatewayTransport,
|
|
*,
|
|
image_ref: str = "",
|
|
tokens: dict[str, str] | None = None,
|
|
env_var_secret: str | None = None,
|
|
) -> RegisteredBottle:
|
|
"""Register the bottle and provision its git-gate state. Rolls back the
|
|
registration if provisioning fails so no orphan is left.
|
|
|
|
Generates a fresh ENV_VAR_SECRET, passes it to the orchestrator so it can
|
|
encrypt the token values at rest, and stamps the secret onto the returned
|
|
``RegisteredBottle`` so callers can inject it into the agent container's
|
|
environment."""
|
|
inputs = registration_inputs(egress_plan)
|
|
env_var_secret = env_var_secret or new_env_var_secret()
|
|
reg = client.register_bottle(
|
|
source_ip, image_ref=image_ref, policy=inputs.policy,
|
|
metadata=inputs.metadata, tokens=tokens, env_var_secret=env_var_secret,
|
|
)
|
|
try:
|
|
provision_git_gate(transport, reg.bottle_id, git_gate_plan)
|
|
except Exception:
|
|
client.teardown_bottle(reg.bottle_id)
|
|
raise
|
|
return dataclasses.replace(reg, env_var_secret=env_var_secret)
|
|
|
|
|
|
def teardown_consolidated(
|
|
bottle_id: str,
|
|
transport: GatewayTransport,
|
|
*,
|
|
orchestrator_url: str,
|
|
timeout: float | None = None,
|
|
) -> None:
|
|
"""Deregister the bottle and remove its git-gate state. Both steps are
|
|
idempotent so this is safe from a cleanup trap."""
|
|
from ..orchestrator.store.config_store import DEFAULT_TEARDOWN_TIMEOUT_SECONDS
|
|
OrchestratorClient(
|
|
orchestrator_url,
|
|
timeout=timeout if timeout is not None else DEFAULT_TEARDOWN_TIMEOUT_SECONDS,
|
|
).teardown_bottle(bottle_id)
|
|
deprovision_git_gate(transport, bottle_id)
|
|
|
|
|
|
__all__ = ["provision_bottle", "teardown_consolidated"]
|