didericis
3fed570da6
Follow-ups from the #402 review of the single-tenant data-plane teardown. - egress_entrypoint.sh: refuse to launch mitmdump when BOT_BOTTLE_ORCHESTRATOR_URL is unset, so the fail-closed guarantee no longer rests solely on mitmproxy's errorcheck addon exiting on the addon's load-time raise. A misconfigured gateway can never come up as a bare TLS-bumping open proxy with no policy. - orchestrator/gateway.py: ensure_running() raises GatewayError on an empty orchestrator URL — a URL-less launch would only crash-loop the now-resolver-only daemons (egress raises, git-http exits 1, supervise exits 2). The env-injection branch is now unconditional. - Drop stale "single-tenant" / "reads routes.yaml" comments in gateway.py and egress_entrypoint.sh, and the /etc/egress/routes.yaml layout line in Dockerfile.gateway. - Tests: gateway fixtures supply an orchestrator URL; add a refuse-without-URL test and assert the URL env is injected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ
50 lines
1.6 KiB
Python
50 lines
1.6 KiB
Python
"""Integration: the consolidated Docker gateway is an idempotent singleton.
|
|
|
|
Gated on a reachable Docker daemon. Uses a unique name so it never
|
|
collides with a real per-host gateway or a leftover from another run.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import secrets
|
|
import subprocess
|
|
import unittest
|
|
|
|
from bot_bottle.orchestrator.gateway import DockerGateway
|
|
from tests._docker import skip_unless_docker
|
|
|
|
IMAGE = "busybox"
|
|
|
|
|
|
@skip_unless_docker()
|
|
class TestDockerGatewayIntegration(unittest.TestCase):
|
|
def setUp(self) -> None:
|
|
self.name = "bot-bottle-orch-gateway-itest-" + secrets.token_hex(4)
|
|
# Resolver-only data plane (PRD 0070) requires an orchestrator URL to
|
|
# run; busybox never dials it, so a placeholder is enough here.
|
|
self.sc = DockerGateway(
|
|
IMAGE, name=self.name, orchestrator_url="http://orchestrator:9000",
|
|
)
|
|
self.addCleanup(self.sc.stop)
|
|
|
|
def _count(self) -> int:
|
|
proc = subprocess.run(
|
|
["docker", "ps", "-a", "--filter", f"name=^{self.name}$",
|
|
"--format", "{{.Names}}"],
|
|
stdout=subprocess.PIPE, text=True, check=False,
|
|
)
|
|
return sum(1 for n in proc.stdout.split() if n == self.name)
|
|
|
|
def test_ensure_is_idempotent_singleton(self) -> None:
|
|
self.sc.ensure_running()
|
|
self.assertEqual(1, self._count())
|
|
# A second ensure must not spawn a second container — one per host.
|
|
self.sc.ensure_running()
|
|
self.assertEqual(1, self._count())
|
|
self.sc.stop()
|
|
self.assertEqual(0, self._count())
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|