didericis
05df21f210
Replace the docker backend's ad-hoc gateway wiring with the shared `Gateway` service ABC (in the gateway package), the first of the two per-host service classes that supersede the per-backend infra glue. The contract is backend-neutral: `connect_to_orchestrator(url, gateway_token)` binds the gateway to its control plane and brings it up, `address()` reports the agent-facing proxy target, `ca_cert_pem()` vends the mitmproxy CA, and `provisioning_transport()` hands back the exec/cp seam git-gate provisioning stages per-bottle repos + deploy keys through. `GatewayProvisionError` + `GatewayTransport` move to the ABC so every backend shares them. Key trust-model change: the gateway no longer mints its own token. It never holds the signing key (#469), so the orchestrator mints the role-scoped `gateway` JWT and hands it in via `connect_to_orchestrator`; the gateway only injects it. `DockerGateway.ensure_running` becomes `connect_to_orchestrator` (stashing the URL + token as instance state), and the docker launch flow reads `address()` / `provisioning_transport()` off the service rather than re-deriving the container IP + transport itself. macOS + firecracker gateways move under the ABC in following commits. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
101 lines
3.9 KiB
Python
101 lines
3.9 KiB
Python
"""Unit: consolidated launch sequence — compose the orchestrator primitives (PRD 0070)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import MagicMock, Mock, patch
|
|
|
|
from bot_bottle.backend.docker.consolidated_launch import (
|
|
launch_consolidated,
|
|
teardown_consolidated,
|
|
)
|
|
from bot_bottle.egress import EgressPlan, EgressRoute
|
|
from bot_bottle.git_gate import GitGatePlan
|
|
from bot_bottle.orchestrator.client import RegisteredBottle
|
|
|
|
_MOD = "bot_bottle.backend.docker.consolidated_launch"
|
|
_UTIL = "bot_bottle.backend.consolidated_util"
|
|
|
|
|
|
def _egress_plan() -> EgressPlan:
|
|
return EgressPlan(
|
|
slug="demo", routes_path=Path("/x"), routes=(EgressRoute(host="api.example.com"),),
|
|
token_env_map={},
|
|
)
|
|
|
|
|
|
def _git_plan() -> GitGatePlan:
|
|
return GitGatePlan(
|
|
slug="demo", entrypoint_script=Path(), hook_script=Path(),
|
|
access_hook_script=Path(), upstreams=(),
|
|
)
|
|
|
|
|
|
def _client(*, bottles: list[dict[str, object]] | None = None) -> Mock:
|
|
c = Mock()
|
|
c.list_bottles.return_value = bottles or []
|
|
c.register_bottle.return_value = RegisteredBottle("b1", "tok")
|
|
return c
|
|
|
|
|
|
class TestLaunchConsolidated(unittest.TestCase):
|
|
def _run(
|
|
self, client: Mock, provision: Mock | None = None,
|
|
*, on_network: tuple[str, ...] = ("172.18.0.2",),
|
|
):
|
|
service = MagicMock()
|
|
service.ensure_running.return_value = "http://orch:8080"
|
|
# The launch flow reads the gateway's agent-facing address + provisioning
|
|
# transport off the Gateway service (service.gateway()).
|
|
gateway = service.gateway.return_value
|
|
gateway.name = "bot-bottle-gateway"
|
|
gateway.address.return_value = "172.18.0.2"
|
|
with patch(f"{_MOD}._network_cidr", return_value="172.18.0.0/16"), \
|
|
patch(f"{_MOD}._network_container_ips", return_value=list(on_network)), \
|
|
patch(f"{_MOD}.OrchestratorClient", return_value=client), \
|
|
patch(f"{_UTIL}.provision_git_gate", provision or Mock()):
|
|
return launch_consolidated(_egress_plan(), _git_plan(), service=service)
|
|
|
|
def test_allocates_ip_registers_and_provisions(self) -> None:
|
|
client = _client()
|
|
provision = Mock()
|
|
ctx = self._run(client, provision)
|
|
# .1 is the router, .2 is the gateway → first bottle gets .3.
|
|
self.assertEqual("172.18.0.3", ctx.source_ip)
|
|
self.assertEqual("172.18.0.2", ctx.gateway_ip)
|
|
self.assertEqual("b1", ctx.bottle_id)
|
|
self.assertEqual("tok", ctx.identity_token)
|
|
self.assertEqual("http://orch:8080", ctx.orchestrator_url)
|
|
# Registered with the source IP + the egress policy blob.
|
|
kwargs = client.register_bottle.call_args
|
|
self.assertEqual("172.18.0.3", kwargs.args[0])
|
|
self.assertIn("api.example.com", kwargs.kwargs["policy"])
|
|
provision.assert_called_once()
|
|
|
|
def test_skips_all_addresses_on_the_network(self) -> None:
|
|
# Gateway .2 + orchestrator .3 already attached -> agent gets .4.
|
|
ctx = self._run(_client(), on_network=("172.18.0.2", "172.18.0.3"))
|
|
self.assertEqual("172.18.0.4", ctx.source_ip)
|
|
|
|
def test_provision_failure_rolls_back_registration(self) -> None:
|
|
client = _client()
|
|
provision = Mock(side_effect=RuntimeError("provision boom"))
|
|
with self.assertRaises(RuntimeError):
|
|
self._run(client, provision)
|
|
client.teardown_bottle.assert_called_once_with("b1") # no orphan left
|
|
|
|
|
|
class TestTeardownConsolidated(unittest.TestCase):
|
|
def test_deregisters_and_deprovisions(self) -> None:
|
|
client = Mock()
|
|
with patch(f"{_UTIL}.OrchestratorClient", return_value=client), \
|
|
patch(f"{_UTIL}.deprovision_git_gate") as deprov:
|
|
teardown_consolidated("b1", orchestrator_url="http://orch:8080")
|
|
client.teardown_bottle.assert_called_once_with("b1")
|
|
deprov.assert_called_once()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|