Compare commits
12 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Jon Chery
|
3551b37ac0 | ||
|
Jon Chery
|
65e50e465b | ||
|
Jon Chery
|
0e7ee4f324 | ||
|
Jon Chery
|
b925fda3aa | ||
|
Jon Chery
|
9853aee589 | ||
|
Jon Chery
|
5e0b899f1a | ||
|
Jon Chery
|
0424f8ce02 | ||
|
Jon Chery
|
5600531bd7 | ||
|
Jon Chery
|
d324939699 | ||
|
Jon Chery
|
00efe25ce4 | ||
|
Jon Chery
|
1ad6780df1 | ||
|
Jon Chery
|
7dc7980d74 |
+12
-21
@@ -1,26 +1,17 @@
|
||||
{
|
||||
"phase": 13,
|
||||
"stage": "complete",
|
||||
"milestone": "v0.13",
|
||||
"milestone_slug": "production-hardening-2",
|
||||
"phase_role": "final",
|
||||
"phase": 0,
|
||||
"stage": "grill",
|
||||
"milestone": "v0.14",
|
||||
"milestone_slug": "ingress-bootstrap",
|
||||
"phase_role": "pre_execution",
|
||||
"attempts": 0,
|
||||
"updated_at": "2026-08-10T14:30:00Z",
|
||||
"milestone_complete": true,
|
||||
"previous_milestone": "v0.12",
|
||||
"phase_count": 14,
|
||||
"phases_shipped": ["P0","P1","P2","P3","P4","P5","P6","P7","P8","P9","P10","P11","P12","P13"],
|
||||
"tags_shipped": ["v0.12.0","v0.12.1","v0.12.2","v0.12.3","v0.12.4","v0.12.5","v0.12.6","v0.12.7","v0.12.8","v0.12.9","v0.12.10","v0.12.11","v0.12.12"],
|
||||
"updated_at": "2026-08-10T18:00:00Z",
|
||||
"milestone_complete": false,
|
||||
"previous_milestone": "v0.13",
|
||||
"phases_shipped": [],
|
||||
"tags_shipped": [],
|
||||
"requirements": {
|
||||
"covered": [149,150,151,152,153,154,155,156,157,158,159,160,161,162,163],
|
||||
"covered": [],
|
||||
"partial": []
|
||||
},
|
||||
"binding_conditions": ["C-39","C-40","C-41","C-42","C-43","C-44","C-45","C-46","C-47","C-48","C-49"],
|
||||
"load_bearing_rule": "R-022",
|
||||
"next_milestone": "v1.0",
|
||||
"ship": {
|
||||
"tag": "v0.12.13",
|
||||
"merged_to_milestone": true,
|
||||
"milestone_release": "v0.13"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
# CLARIFY v0.14: Ingress Bootstrap Completeness
|
||||
|
||||
**Autonomy**: full (config `autonomy.level = "full"`)
|
||||
**Budget**: 10 questions (used: 5 interactive, 5 auto-resolved)
|
||||
**Result**: all ambiguities resolved; 9 decisions (D-255..D-263) recorded in PROJECT.md
|
||||
|
||||
## Interactive Questions (resolved with operator)
|
||||
|
||||
### Q1: iptables vs nft emitter
|
||||
**Ambiguity**: Codebase is nft-only (D-218). Operator said "iptables used for SNAT/DNAT".
|
||||
**Resolution**: D-255 (partial) — Extend the existing nft emitter (`internal/emitter/nft.go`) with SNAT/MASQUERADE postrouting rules. "iptables" in the operator's description is read as "kernel NAT" — nft is the modern backend. No literal iptables emitter.
|
||||
**Confidence**: 0.95
|
||||
|
||||
### Q2: ingress LXC lifecycle
|
||||
**Ambiguity**: Should the floating-IP LXC be registered as an orca-managed node or left as a one-shot external proxy?
|
||||
**Resolution**: D-259 — Register as a managed `linux` node (name=`ingress`, addr=`<floating-ip>:8443`). `orca job run` pushes traefik dynamic config to it like any linux node. This makes routing-to-other-hosts work.
|
||||
**Confidence**: 0.92
|
||||
|
||||
### Q3: Floating-IP network topology
|
||||
**Ambiguity**: Where does SNAT run and how does the LXC get the public IP?
|
||||
**Resolution**: LXC owns floating IP on eth0 (`net0 bridge=vmbr0,hwaddr=<mac>,ip=<floating-ip>/<prefix>,gw=<gateway>`). nft runs inside the LXC. Matches Hetzner/OVH floating-IP-with-MAC model.
|
||||
**Confidence**: 0.90
|
||||
|
||||
### Q4: TLS cert resolver in the image
|
||||
**Ambiguity**: The emitted static config references `certResolver: orca` but never declares the `certificatesResolvers.orca` block. v0.11 claimed P10 would wire step-ca but it was never implemented.
|
||||
**Resolution**: D-257 — Bake a `certificatesResolvers.orca.tls: { }` block pointing at a mounted `/etc/orca/step-ca-root.crt` CA file. No ACME (offline-first, R-001). If the file is absent at start, traefik logs a warning and serves plain HTTP (graceful degradation). The orca bootstrap pushes the cluster root CA into the container volume.
|
||||
**Confidence**: 0.90
|
||||
|
||||
### Q5: Container networking
|
||||
**Ambiguity**: nft DNAT targets 127.0.0.1:8080/8443 on the host. How does the podman container receive that traffic?
|
||||
**Resolution**: D-256 — `--network host` so traefik binds 127.0.0.1:8080/8443 directly on the host (or LXC) loopback. No container port publishing. Simplest, matches the hybrid R-017 model.
|
||||
**Confidence**: 0.92
|
||||
|
||||
### Q6: Dynamic config volume strategy
|
||||
**Ambiguity**: How does the podman traefik container consume dynamic config? Today `orca job run` writes `/etc/traefik/dynamic/orca-<svc>.yaml` on the host.
|
||||
**Resolution**: D-258 — Mount `/etc/traefik/dynamic` from host (`-v /etc/traefik/dynamic:/etc/traefik/dynamic:Z`). Zero changes to the existing `deployRemote` WriteFile path. The image's file provider watches `/etc/traefik/dynamic` as today.
|
||||
**Confidence**: 0.95
|
||||
|
||||
## Auto-resolved questions (full autonomy, no operator interaction)
|
||||
|
||||
### Q7: Floating-IP mode — does the PVE host also register as a node?
|
||||
**Ambiguity**: In floating-IP mode, only the ingress LXC handles traffic. Does the PVE host also get registered?
|
||||
**Resolution**: D-259 — Yes. The PVE host registers as a `proxmox` node (for `pct`/`qm` workload dispatch). The ingress LXC registers as a `linux` node (for traefik dynamic config pushes). Both are in the registry.
|
||||
**Confidence**: 0.92
|
||||
|
||||
### Q8: `--ingress-mode` persistence
|
||||
**Ambiguity**: Should `--ingress-mode` be stored on the node record so `doctor ingress` knows which check path to run?
|
||||
**Resolution**: D-260 — Yes. Add `IngressMode` field to `model.Node` + a schema migration (0007). Values: `""` (legacy/default for linux/localhost), `"native"`, `"floating-ip"`.
|
||||
**Confidence**: 0.90
|
||||
|
||||
### Q9: MAC generation when `--mac` omitted
|
||||
**Ambiguity**: In floating-IP mode, if `--mac` is not provided, should orca generate one or require it?
|
||||
**Resolution**: D-261 — Interactive mode: generate a random locally-administered MAC (`02:XX:XX:XX:XX:XX`) and print it for operator confirmation. `--json` mode: require `--mac` explicitly (no silent generation — non-interactive means explicit inputs).
|
||||
**Confidence**: 0.88
|
||||
|
||||
### Q10: Proxmox native nft DNAT target
|
||||
**Ambiguity**: In native mode, traefik runs inside an LXC. LXC has its own network namespace. nft DNAT to `127.0.0.1:8443` on the PVE host would NOT reach a container inside an LXC (different loopback). What's the DNAT target?
|
||||
**Resolution**: D-262 — The nft DNAT target is parameterized via `NftClusterConfig.DNATTarget` (default `127.0.0.1:8443`). For proxmox native mode, the DNAT target is the LXC's bridge IP (`<lxc-ip>:8443`). The LXC gets a DHCP/static bridge IP; orca discovers it after `pct start` via `pct list` or `pct inspect`.
|
||||
**Confidence**: 0.90
|
||||
|
||||
## Additional decisions (derived from constraints, no ambiguity)
|
||||
|
||||
### D-263: LXC podman requirements
|
||||
Ubuntu 24.04 LXC template does not have podman preinstalled. Bootstrap must:
|
||||
1. `pct create` with `--features nesting=1,keyctl=1` (required for podman in unprivileged LXC)
|
||||
2. After LXC start: `apt-get update && apt-get install -y podman nftables` inside the LXC
|
||||
3. Then `podman pull orca-traefik:<tag>` + `podman run ...`
|
||||
|
||||
This adds ~30-60s to the join time. Documented in `docs/uat.md`.
|
||||
|
||||
### Image tag strategy
|
||||
The `orca-traefik` image uses the same version tag as the orca release (`v0.13.x` line). The podman reconciler resolves the tag from `internal/cli.version`. In dev builds (version="dev"), it falls back to `latest`.
|
||||
|
||||
### Registry auth
|
||||
The `orca-traefik` image is in the same registry/org as `orca` (`git.cloudinit.dev/coreci/`). Pulls are anonymous (REQ-045, repo is public). No `podman login` needed on workers.
|
||||
|
||||
## Requirements impact
|
||||
|
||||
No new requirements beyond REQ-171..REQ-179 (already in REQUIREMENTS.md). The clarify stage confirmed scope and resolved all implementation ambiguities. The 9 decisions (D-255..D-263) are recorded in PROJECT.md.
|
||||
@@ -0,0 +1,225 @@
|
||||
# GRILL v0.14: Ingress Bootstrap Completeness — Red-Team Review
|
||||
|
||||
**Date**: 2026-08-10
|
||||
**Reviewer**: ci-griller (adversarial)
|
||||
**Subject**: PLAN_v0.14.md (9 phases, P0–P8)
|
||||
**Confidence in plan as-written**: **0.45 — RETHINK** (was Proceed-eligible until the mTLS scope expansion was chosen)
|
||||
**Verdict**: **RETHINK** — the plan is technically grounded in strong research but contains (a) one outright correctness defect that will break execution, (b) two requirements/plan contradictions that ship broken config, (c) one scope expansion chosen during this grill that adds a 10th phase the plan does not contain, and (d) one regression of a Completed requirement. The research is the strongest artifact; the plan diverges from it in load-bearing ways.
|
||||
|
||||
---
|
||||
|
||||
## How this grill was conducted
|
||||
|
||||
Every plan claim was checked against the actual codebase (`internal/traefik/install.go`, `internal/emitter/nft.go`, `internal/emitter/traefik.go`, `internal/cli/init.go`, `internal/cli/upgrade.go`, `internal/cli/doctor_nft.go`, `internal/proxmox/bootstrap.go`, `internal/linux/bootstrap.go`, `internal/store/migrations/`, `internal/certpaths/`, `internal/sshpush/`, `scripts/release.sh`, `.coreci.yml`, `Dockerfile`, git tags, git log). Findings cite file:line. Four binding questions were asked interactively; answers recorded as G-001..G-004 below.
|
||||
|
||||
---
|
||||
|
||||
## Per-Axis Findings
|
||||
|
||||
### Axis 1 — Feasibility
|
||||
|
||||
**Finding F1.1 (BLOCKER — migration number collision).** PLAN P5 T3 (line 194) specifies "Schema migration 0007: `ALTER TABLE nodes ADD COLUMN ingress_mode TEXT DEFAULT ''`". Migration 0007 **already exists** — `internal/store/migrations/0007_certs_serial_unique.sql` (added v0.7, P1-001). The current head is `0008_audit_tamper_evidence.sql`. The migrator runs files in lexical order and records applied versions in `schema_migrations`. Reusing 0007 will either (a) silently no-op on DBs that already recorded 0007, leaving `ingress_mode` un-added, or (b) break the migration ledger. This is a guaranteed execution-time defect.
|
||||
**Evidence**: `internal/store/migrations/0007_certs_serial_unique.sql`, `internal/store/migrations/0008_audit_tamper_evidence.sql`, `internal/cli/init_test.go:84` (test asserts head = 0008).
|
||||
**Resolved by**: G-001 (use `0009_ingress_mode.sql`).
|
||||
|
||||
**Finding F1.2 (BLOCKER — `certpaths.CAPath()` does not exist).** PLAN P3 T5 step 2 (line 142) says "Push cluster root CA … from `certpaths.CAPath()` if exists". The function `certpaths.CAPath()` does not exist. The real API is `certpaths.CACertPath()` (`internal/certpaths/certpaths.go:35`) and `certpaths.CAKeyPath()` (`:39`). P4 T1 step 2 repeats the same phantom reference. This will not compile.
|
||||
**Evidence**: `internal/certpaths/certpaths.go:35` (`func CACertPath() string`); grep for `CAPath` returns zero matches in `internal/certpaths/`.
|
||||
|
||||
**Finding F1.3 (no `install_test.go` to rewrite).** PLAN P2 T10 (line 112) says "rewrite `internal/traefik/install_test.go`". That file does not exist — `internal/traefik/` contains only `install.go` (glob confirms). The task is "create", not "rewrite". Minor, but signals the plan was written against an imagined codebase shape, not the real one.
|
||||
**Evidence**: `glob internal/traefik/*.go` → only `install.go`.
|
||||
|
||||
**Finding F1.4 (good — fake-SSH harness exists and is adequate).** PLAN P7 T8 claims a "hermetic fake-SSH harness" can assert `pct create` + `podman run` inside LXC. Verified: `internal/proxmox/ssh_session_test.go:23` (`fakeSSHServer`) and `internal/sshpush/transport_test.go:27` implement an in-process SSH server with `runCommand(cmd)` pattern-matching. It can assert the right commands are *sent* (e.g. `pct create … --features nesting=1,keyctl=1,fuse=1`). It cannot actually create an LXC or run podman — but the plan only claims command assertion, which is achievable. The harness is real and reusable.
|
||||
|
||||
**Finding F1.5 (good — callsites verified).** PLAN P2 T3/T4/T5 reference `init.go:254-266`, `linux/bootstrap.go:160-172`, `proxmox/bootstrap.go:250-255`. Verified: `init.go:256` calls `installTraefikLocal()`; `linux/bootstrap.go:170` calls `traefik.InstallRemote("", sshExecFn)`; `proxmox/bootstrap.go:253` calls `traefik.InstallRemote("", runRemote)`. The line numbers are accurate within a few lines. The plan was written against the real callsites.
|
||||
|
||||
### Axis 2 — Scope
|
||||
|
||||
**Finding F2.1 (BLOCKER — mTLS scope expansion chosen, no phase exists).** During this grill (G-003) the operator chose "Wire real mTLS now" over the plan's `tls: {}` default-cert approach. This requires step-ca to mint server certs into `/etc/traefik/dynamic` + dynamic `tls.certificates` + `tls.options.default.clientAuth.caFiles`. **Step-ca server-cert minting was deferred since v0.11 and is not implemented.** The 9-phase plan contains no such phase. The operator then chose (G-004-adjacent) to add a step-ca cert minting phase, growing v0.14 from 9 to 10 phases. The plan as written does not reflect this. Until a P-step for cert minting is added, the plan is incomplete relative to the chosen direction.
|
||||
**Impact**: v0.14 cannot ship real mTLS on its current 9 phases. Either add the phase (10 phases, more risk) or revert to `tls: {}` and defer mTLS to v0.15.
|
||||
|
||||
**Finding F2.2 (regression — `traefik-on-public-ip` opt-out lost).** REQ-100 (Complete, v0.11) established the `--public-binding=traefik-on-public-ip` opt-out: traefik binds `:443`/`:80` directly instead of `127.0.0.1:8443`/`8080` + nft DNAT. The existing `RenderTraefikStaticConfig` (`internal/emitter/traefik.go:273`) implements this via `TraefikStaticOpts.PublicBinding`. The v0.14 plan's baked image (`docker/orca-traefik/traefik.yml`, PLAN lines 33-37) hard-codes `127.0.0.1:8443`/`8080` — there is no opt-out path in the image. Baking the static config into the image freezes out the opt-out mode that v0.11 shipped. This is a regression of a Completed requirement.
|
||||
**Evidence**: `internal/emitter/traefik.go:255-266` (`publicWebSecure`/`publicWeb` switch on `PublicBinding`); `internal/emitter/traefik.go:282-300` (rendered static config); REQUIREMENTS REQ-100 line 218.
|
||||
|
||||
**Finding F2.3 (9 phases is borderline; 10 is too many).** Even before the mTLS expansion, 9 phases for an "ingress bootstrap completeness" milestone is heavy. P5 (proxmox native) and P6 (floating-IP) are the two most complex (LXC creation + podman-in-LXC + apt-get + nft-inside-LXC). They could potentially be merged into one phase with two code paths, since they share `ProvisionIngressLXC` plumbing. With the mTLS expansion, 10 phases is too many for a single milestone — split v0.14 into v0.14a (linux ingress + mTLS) and v0.14b (proxmox ingress).
|
||||
|
||||
**Finding F2.4 (good — research-validated decisions are sound).** The 7 research topics (nft postrouting, pve-firewall priority, LXC features, traefik Dockerfile, pct create syntax, podman restart, SELinux) are well-sourced and the recommended approaches are technically correct. This is the strongest artifact in the v0.14 dossier.
|
||||
|
||||
### Axis 3 — Dependencies
|
||||
|
||||
**Finding F3.1 (good — ordering is correct).** P1 (image) → P2 (reconciler) → P3 (nft+init) → P4 (remote linux) → P5 (proxmox native) → P6 (floating-IP) → P7 (doctor+tests) → P8 (ship). Each phase references the prior phase's output (P3 T6 calls `EnsureTraefikContainerLocal` from P2; P5 T4 step 10 calls `EnsureTraefikContainerRemote` from P2). No phase can ship before its prerequisite.
|
||||
|
||||
**Finding F3.2 (hidden dependency — P2 T8 depends on P1 T1).** P2 T8 (drop `certResolver: orca`) edits `internal/emitter/traefik.go`. P1 T1 bakes the static config. The dynamic config (`traefik.go`) and static config (`docker/orca-traefik/traefik.yml`) must be consistent: if the static config has no `certificatesResolvers.orca` (P1 T1 correctly omits it) but the dynamic config still references `certResolver: orca` (until P2 T8), traefik logs a warning on every reload. The plan orders P1 before P2, so there is a window (P1 shipped, P2 not yet) where the published image + the live dynamic config are inconsistent. This is acceptable only if P1 and P2 ship in quick succession; if P1 stalls, the image is published with a known TLS-config mismatch.
|
||||
|
||||
### Axis 4 — Security
|
||||
|
||||
**Finding F4.1 (good — nft injection guard already present).** `internal/emitter/nft.go:104-130` (`partitionTrustedProbes`) validates every `TrustedProbes` entry as IP/CIDR before rendering (F9 guard). The v0.14 plan adds `DNATTarget` (P3 T1) — this is a NEW string field rendered directly into `dnat to <DNATTarget>:8443`. **The plan does not specify validation of `DNATTarget`.** If `DNATTarget` is user-controllable (via `--floating-ip` or cluster config), an unvalidated value is an nft-syntax injection vector. The existing F9 guard covers `TrustedProbes`; `DNATTarget` needs the same treatment.
|
||||
**Binding**: C-51 (see below).
|
||||
|
||||
**Finding F4.2 (container escape surface — LXC nesting).** `--features nesting=1,keyctl=1,fuse=1` (P5/P6) is the documented requirement for podman-in-LXC, but nesting exposes host procfs/sysfs to the guest (Proxmox docs, RESEARCH Topic 3). This is an accepted tradeoff for container-in-container, but the plan does not document the threat-model acceptance. For a "production hardening" lineage, the ingress LXC is now a privileged-ish surface (nesting+keyctl) running a podman container pulling an image from a registry. The supply chain is: `git.cloudinit.dev/coreci/orca-traefik:<version>` (P1). If the registry is compromised or the tag is re-pushed, the ingress LXC runs attacker code at the host-LXC boundary. The plan has no image-signing/verification step (`podman pull --cert-dir` or cosign).
|
||||
**Binding**: C-52 (see below).
|
||||
|
||||
**Finding F4.3 (nft rules injection via re-apply).** P3 T4 changes `flush table` to `delete table`. RESEARCH Topic 1 establishes that `delete table` on a missing table errors, and the fix is to pre-create the table (`nft add table inet orca-ingress 2>/dev/null || true`) before `nft -f`. P3 T5 step 4 does this. Good. But the re-apply path (P3 T5 step 5, P4 T1 step 5) runs `nft -f` which replaces the whole table — if a concurrent process (pve-firewall, operator) adds rules to `orca-ingress` between the pre-create and the `nft -f`, they are wiped. This is by design (orca owns the table) but should be documented as "orca is the sole owner of `table inet orca-ingress`".
|
||||
|
||||
### Axis 5 — Operational
|
||||
|
||||
**Finding F5.1 (BLOCKER — no upgrade path from v0.13 binary+systemd to v0.14 podman).** P2 T6 (line 104) says "update legacy cutover to pull new image + recreate container instead of sed-ing traefik.yml". But `internal/cli/upgrade.go:244-407` implements a Traefik `:443` → `127.0.0.1:8443` cutover that does `systemctl restart traefik` (line 382) — it restarts the **systemd service**, not a container. P2 removes systemd unit generation. There is **no phase** that: (a) detects the legacy `orca-traefik.service`, (b) stops+disables it, (c) removes `/usr/local/bin/traefik` + `/etc/systemd/system/orca-traefik.service`, (d) then runs `EnsureTraefikContainerLocal`. Without this, upgrading a live v0.13 cluster leaves a dead systemd unit AND a new podman container both trying to bind `127.0.0.1:8443` → port conflict, traefik down.
|
||||
**Resolved by**: G-004 (P2 T6 must remove legacy unit + binary, idempotent, tested).
|
||||
|
||||
**Finding F5.2 (podman/podman-restart.service unavailable).** P2 T2 enables `podman-restart.service`. RESEARCH Topic 6 establishes this is not enabled by default on Ubuntu 24.04 and must be enabled. But the plan does not specify what happens if `podman` is not installed on the target host (a fresh linux node join, P4). `EnsureTraefikContainerLocal`/`Remote` calls `podman pull`/`podman run` — if `podman` is absent, this fails. The plan has no "install podman first" step for the linux topology (P3/P4). For proxmox (P5/P6) the plan installs podman via `apt-get install -y podman conmon crun fuse-overlayfs` inside the LXC (T4 step 4 / T1 step 6). But for linux nodes (P3/P4), there is no podman-install step. This is an under-specification.
|
||||
**Binding**: C-50 (see below).
|
||||
|
||||
**Finding F5.3 (good — `--network host` is correct).** RESEARCH Topic 3 confirms `--network host` inside an LXC binds the LXC's netns, so traefik binds `127.0.0.1:8080/8443` on the LXC loopback and nft on the PVE host DNATs to the LXC IP. This is sound. The `DNATTarget` parameterization (D-262) correctly distinguishes `127.0.0.1` (linux/localhost) from `<lxc-ip>` (proxmox native).
|
||||
|
||||
**Finding F5.4 (reboot persistence chain has a gap).** RESEARCH Topic 6 establishes the chain: Proxmox boot → `--onboot 1` starts LXC → LXC systemd starts → `podman-restart.service` restarts container. P5 T4 step 6 and P6 T1 step 8 enable `podman-restart.service` inside the LXC. But `--onboot 1` starts the LXC **after** the Proxmox host's network is up — if the floating IP is on a bridge that depends on a physical link that's slow to come up, the LXC may start before the bridge is ready, and the floating-IP `eth0` config may fail. The plan does not address LXC-start ordering relative to bridge readiness.
|
||||
|
||||
### Axis 6 — Testing
|
||||
|
||||
**Finding F6.1 (good — harness is real).** `fakeSSHServer` (Axis 1 F1.4) can assert `pct create` with the right `--features` and `net0` args, `apt-get install podman`, `podman run` with `--network host`. P7 T8's claims are achievable.
|
||||
|
||||
**Finding F6.2 (gap — no test for the v0.13→v0.14 upgrade).** G-004 requires the upgrade path to be tested. The plan's P2 Wave 4 (T10) tests the reconciler but not the legacy-removal path. There is no test that: (a) simulates a host with `orca-traefik.service` present, (b) runs the upgrade, (c) asserts the unit is stopped+disabled+removed, (d) asserts the podman container is running. This must be added to P2 T10.
|
||||
|
||||
**Finding F6.3 (gap — no test for DNATTarget validation).** F4.1 identifies `DNATTarget` as an injection vector. P3 T8 (nft_test) asserts `DNATTarget` substitution but does not specify a test for invalid `DNATTarget` values (e.g. `1.2.3.4:8443; flush ruleset`). The existing F9 guard test pattern should be extended.
|
||||
|
||||
**Finding F6.4 (good — doctor_nft extension is incremental).** P3 T7 extends `doctor_nft.go`. The existing file (`internal/cli/doctor_nft.go`) is well-structured with `nftCheckResult` lines; adding postrouting/masquerade/DNATTarget assertions is straightforward.
|
||||
|
||||
### Axis 7 — Performance
|
||||
|
||||
**Finding F7.1 (apt-get install podman on every proxmox join — 30-60s).** CLARIFY D-263 acknowledges "~30-60s to the join time". P5 T4 step 4 and P6 T1 step 6 run `apt-get update && apt-get install -y podman conmon crun fuse-overlayfs nftables` inside the LXC on every join. This is acceptable for a one-time bootstrap but painful if re-run. The reconciler must be idempotent (skip if podman already installed). The plan does not specify an idempotency check for the apt-get step.
|
||||
**Binding**: C-53 (see below).
|
||||
|
||||
**Finding F7.2 (image pull latency).** `podman pull orca-traefik:<tag>` (P2 T1 step 3, P5/P6) pulls from `git.cloudinit.dev/coreci/`. On a proxmox host behind a slow link, this can take 10-30s for a ~150MB traefik image. The plan has no pull-timeout. If the registry is unreachable (offline-first is R-001!), the pull fails and traefik never starts. **R-001 (offline-first) is violated**: the plan depends on a registry pull at bootstrap time. There is no "pre-pull" or "bundle image into the LXC template" fallback.
|
||||
**Binding**: C-54 (see below) — this is a tension with R-001 that the plan does not acknowledge.
|
||||
|
||||
**Finding F7.3 (nft re-apply disruption).** `nft -f` replaces the table atomically (single transaction). Existing connections are NOT disrupted (conntrack holds them). New connections during the apply window (<1ms) may be dropped. This is acceptable. No finding.
|
||||
|
||||
### Axis 8 — Cost
|
||||
|
||||
**Finding F8.1 (2 images per release — sustainable).** P1 adds `orca-traefik` image alongside `orca`. `.coreci.yml` gets a `container-publish-traefik` step (P1 T5). `scripts/release.sh` gets a second docker block (P1 T4). The traefik image is small (~150MB, Alpine-based). Registry storage: 2 images × N releases. At v0.13.x cadence (8 tags), that's 16 image-tags per milestone. Sustainable for a private Gitea registry. No finding.
|
||||
|
||||
**Finding F8.2 (good — release.sh extension is minimal).** P1 T4 adds ~8 lines to `scripts/release.sh` after line 212. Verified the insertion point (line 213 is end of existing docker block). Clean.
|
||||
|
||||
### Axis 9 — Completeness (3 topologies)
|
||||
|
||||
**Finding F9.1 (linux topology — covered by P3+P4).** `orca init` (P3) bootstraps nft+podman on the lead; `orca node join --type linux` (P4) does it remotely. Complete.
|
||||
|
||||
**Finding F9.2 (proxmox-native — covered by P5, but LXC IP discovery is hand-wavy).** P5 T4 step 9 says "Discover LXC IP via `pct config <vmid>` (parse `net0` line) or `pct exec <vmid> -- hostname -I`". But in native mode the LXC is created **without** a static IP (P5 T4 step 2 has no `ip=` in the `pct create` — unlike P6 which has `ip=<floating-ip>/<prefix>`). So the LXC gets a DHCP/bridge IP that is not known at create time. P5 step 9 discovers it after `pct start`. But step 10 then re-applies nft with the discovered IP. This is a two-phase apply: first apply with default `127.0.0.1` (wrong for native), then re-apply with LXC IP. The plan does not specify what happens to traffic between the first and second apply (it DNATs to 127.0.0.1:8443 on the PVE host where nothing listens → connections refused). There is a window of ingress downtime during native-mode bootstrap.
|
||||
**Binding**: C-55 (see below).
|
||||
|
||||
**Finding F9.3 (floating-IP — covered by P6, but MAC uniqueness is untested).** P6 T4 generates a random `02:XX:XX:XX:XX:XX` MAC in interactive mode. The plan does not check for MAC collision on the bridge. RESEARCH Topic 5 pitfall 2: "hwaddr must be unique on the bridge". A random 02: prefix has 46 bits of entropy — collision is unlikely on a single bridge but not impossible across a multi-node cluster.
|
||||
**Binding**: C-56 (see below).
|
||||
|
||||
**Finding F9.4 (no `localhost`/lead topology with podman).** P3 bootstraps the lead via `EnsureTraefikContainerLocal`. But `orca init` runs on the lead — if the lead has no podman installed (fresh host), `EnsureTraefikContainerLocal` fails. Same as F5.2 but for the lead. The plan assumes podman is present on the lead. No install step.
|
||||
|
||||
---
|
||||
|
||||
## Binding Conditions (gates that MUST be met before a phase ships)
|
||||
|
||||
| ID | Gate | Phase | Severity |
|
||||
|----|------|-------|----------|
|
||||
| **C-50** | P2 must not break existing `orca init` on a host without podman installed — either install podman as part of `BootstrapLocalIngress` (P3) or emit a clear error with install instructions. Same for `orca node join --type linux` (P4). | P2/P3/P4 | BLOCKER |
|
||||
| **C-51** | `NftClusterConfig.DNATTarget` must be validated as `net.ParseIP` or `ip:port` before rendering. Unvalidated values are an nft-syntax injection vector (same F9 guard as TrustedProbes). Test required. | P3 | BLOCKER |
|
||||
| **C-52** | The `orca-traefik` image supply chain must be documented: registry is public (anonymous pull per REQ-045), no image signing in v0.14. Document the threat-model acceptance: a compromised registry = attacker code in the ingress LXC. Add `podman image trust` or cosign verification as a v0.15 hardening item. | P1/P8 | High |
|
||||
| **C-53** | The `apt-get install podman` step inside the LXC (P5 T4 step 4, P6 T1 step 6) must be idempotent: check `command -v podman` first, skip if present. Re-running join on an existing LXC must not re-run apt-get. | P5/P6 | High |
|
||||
| **C-54** | R-001 (offline-first) tension: `podman pull` at bootstrap requires registry reachability. Either (a) document that ingress bootstrap requires online access (exception to R-001), or (b) pre-bundle the `orca-traefik` image into the LXC template / load from a local archive. The plan must acknowledge this tension explicitly. | P2/P5/P6 | BLOCKER |
|
||||
| **C-55** | P5 native-mode bootstrap must not create a window of ingress downtime. The first nft apply must use the LXC IP (discovered after `pct start` but before the first nft apply), OR the plan must accept and document the downtime window. Two-phase apply (default → LXC IP) is a transient outage. | P5 | High |
|
||||
| **C-56** | P6 MAC generation must check for collision against existing nodes' MACs in the cluster registry. Reject or regenerate on collision. | P6 | Medium |
|
||||
| **C-57** | P2 T6 must implement the v0.13→v0.14 upgrade: detect `orca-traefik.service`, stop+disable, remove `/usr/local/bin/traefik` + unit file, then `EnsureTraefikContainerLocal`. Idempotent. Tested with a simulated-legacy-host test (F6.2). | P2 | BLOCKER |
|
||||
| **C-58** | The baked `docker/orca-traefik/traefik.yml` must not regress REQ-100's `traefik-on-public-ip` opt-out. Either (a) bake both configs and select via env/flag, or (b) document that the opt-out is dropped in v0.14 and update REQ-100, or (c) mount the static config from host (not baked) so `RenderTraefikStaticConfig` still works. | P1 | High |
|
||||
| **C-59** | Migration for `ingress_mode` must be `0009_ingress_mode.sql`, NOT 0007 (already taken by certs_serial_unique). | P5 | BLOCKER |
|
||||
| **C-60** | `certpaths.CAPath()` references in P3 T5 and P4 T1 must be corrected to `certpaths.CACertPath()`. | P3/P4 | BLOCKER (compile) |
|
||||
| **C-61** | REQ-172 must be amended: `--restart=always` → `--restart=unless-stopped` (per RESEARCH Topic 6 + PLAN), and `:Z` → omitted (per G-002). The requirement text contradicts the plan and research. | P2 | High |
|
||||
| **C-62** | If mTLS is in-scope for v0.14 (per G-003), a new phase must be added implementing step-ca server-cert minting into `/etc/traefik/dynamic` + dynamic `tls.certificates` + `tls.options.default.clientAuth.caFiles`. The plan currently has no such phase (P2 T8 emits `tls: {}`). | NEW PHASE | BLOCKER |
|
||||
|
||||
---
|
||||
|
||||
## Phase Challenges (specific challenges a phase must overcome)
|
||||
|
||||
| ID | Challenge | Phase |
|
||||
|----|-----------|-------|
|
||||
| **PC-01** | P1 must bake a static config that doesn't regress the `traefik-on-public-ip` opt-out (REQ-100). Baking freezes the config; the opt-out needs a runtime switch. | P1 |
|
||||
| **PC-02** | P2 must handle the 3-way TLS contradiction (CLARIFY D-257 vs RESEARCH Topic 4 vs PLAN T8). Per G-003, real mTLS is chosen — P2 alone cannot deliver it; a new phase is needed. | P2 + new |
|
||||
| **PC-03** | P2 T6 must remove the legacy systemd unit + binary without breaking a running v0.13 cluster. The existing `upgrade.go` cutover logic (lines 244-407) must be rewritten to stop+disable+remove the unit, not `systemctl restart traefik`. | P2 |
|
||||
| **PC-04** | P3 must install podman on the lead if absent (C-50). The plan assumes podman is present. `BootstrapLocalIngress` must either install it or fail with a clear message. | P3 |
|
||||
| **PC-05** | P3 T5 must use `certpaths.CACertPath()` not the phantom `certpaths.CAPath()`. | P3 |
|
||||
| **PC-06** | P3 T1 (`DNATTarget`) must validate input (C-51). New string field rendered into nft ruleset — injection risk. | P3 |
|
||||
| **PC-07** | P3 T4 (first-apply flush-table fix) must work across nft versions. RESEARCH establishes `delete table` on missing table is version-dependent. The pre-create approach (`nft add table … 2>/dev/null \|\| true` before `nft -f`) is robust; the plan uses it (T5 step 4). Verify on Proxmox kernel. | P3 |
|
||||
| **PC-08** | P5 native-mode has a two-phase nft apply (default 127.0.0.1 → LXC IP) that creates a transient outage window. Must be eliminated or documented (C-55). | P5 |
|
||||
| **PC-09** | P5/P6 `apt-get install podman` inside LXC takes 30-60s and must be idempotent (C-53). Re-join must not re-install. | P5/P6 |
|
||||
| **PC-10** | P5/P6 `podman pull` requires registry reachability, violating R-001 (offline-first). Must be acknowledged or mitigated (C-54). | P5/P6 |
|
||||
| **PC-11** | P5/P6 LXC reboot chain (Proxmox boot → `--onboot 1` → LXC systemd → `podman-restart.service`) has a gap: LXC may start before bridge is ready. Floating-IP `eth0` config may fail. | P5/P6 |
|
||||
| **PC-12** | P6 MAC generation must check for collision (C-56). | P6 |
|
||||
| **PC-13** | P7 T8 integration test must include the v0.13→v0.14 upgrade path (F6.2): simulated legacy host → upgrade → assert unit removed + podman running. | P7 |
|
||||
| **PC-14** | If the new mTLS phase is added (G-003), it must mint server certs into `/etc/traefik/dynamic` atomically (C-10 protocol) and traefik must reload them via the file provider watch. Step-ca minting was deferred since v0.11 — this is net-new work, not a completion. | new phase |
|
||||
|
||||
---
|
||||
|
||||
## Binding Decisions (from interactive grill)
|
||||
|
||||
| ID | Decision | Rationale | Confidence | Alternatives rejected |
|
||||
|----|----------|-----------|------------|---------------------|
|
||||
| **G-001** | Migration for `ingress_mode` is `0009_ingress_mode.sql` | 0007 is already `certs_serial_unique`; 0008 is `audit_tamper_evidence`. Reusing 0007 breaks the migrator. | 0.95 | Renumber existing (breaks deployed DBs); accept collision (guaranteed defect) |
|
||||
| **G-002** | Omit `:Z` flag on volume mounts; use `:ro` on both | RESEARCH Topic 7: `:Z` relabels host dirs to private container label, blocks host-side orca writes on SELinux. No-op on Ubuntu/Proxmox but a latent footgun. PLAN P2 T1 + RESEARCH agree; CLARIFY D-258 + REQ-172 are wrong. | 0.90 | Keep `:Z` (wrong on future SELinux); `:z` shared (unnecessary) |
|
||||
| **G-003** | Wire real mTLS now (dynamic `tls.certificates` + `clientAuth.caFiles`) | Operator chose this over `tls: {}` default. Requires step-ca server-cert minting which is not implemented (deferred since v0.11). | 0.55 | `tls: {}` now (plan's approach, defers mTLS); keep `certResolver: orca` (broken — key doesn't exist in traefik v3.3) |
|
||||
| **G-004** | P2 T6 must remove legacy systemd unit + binary on upgrade from v0.13 | Without it, upgrading a live v0.13 cluster leaves a dead systemd unit + a new podman container both binding 127.0.0.1:8443 → port conflict. Idempotent + tested. | 0.90 | Leave legacy unit (port conflict); fresh-installs only (unacceptable) |
|
||||
|
||||
---
|
||||
|
||||
## Escalations (unresolved, confidence < 0.60)
|
||||
|
||||
| ID | Escalation | Confidence | Reason |
|
||||
|----|------------|------------|--------|
|
||||
| **E-001** | G-003 (real mTLS now) creates a scope expansion that the 9-phase plan does not contain. The operator chose to add a step-ca cert minting phase (growing v0.14 to 10 phases) but the plan has not been updated to reflect this. Until the new phase is specified (scope, tasks, tests), v0.14's mTLS direction is **undetermined**. The plan as written ships `tls: {}` (no mTLS), which contradicts G-003. | 0.55 | The choice is made but the plan does not reflect it. This is a plan-spec gap, not a technical unknown. |
|
||||
|
||||
---
|
||||
|
||||
## Meta — Closing Review
|
||||
|
||||
**What the auditor would flag**:
|
||||
1. The plan ships a known-broken TLS config. RESEARCH Topic 4 calls `certResolver: orca` "the biggest v0.14 finding" and says it does not exist in traefik v3.3. CLARIFY D-257 and REQ-171 still specify it. The plan (P2 T8) drops it but emits `tls: {}` (no real TLS). G-003 chose real mTLS, which the plan doesn't contain. **Three artifacts disagree on TLS.**
|
||||
2. The plan regresses REQ-100 (`traefik-on-public-ip` opt-out) by baking the static config.
|
||||
3. The plan has no upgrade path from v0.13 (binary+systemd) to v0.14 (podman). G-004 binds the fix but the plan must be updated.
|
||||
4. The plan references a phantom function (`certpaths.CAPath()`) and a phantom migration number (0007). Both will fail at compile/execution time.
|
||||
5. The plan's offline-first claim (R-001) is violated by `podman pull` at bootstrap (C-54).
|
||||
|
||||
**What the project is NOT doing that it should**:
|
||||
- Image supply-chain verification (no cosign, no `podman image trust`).
|
||||
- LXC-start ordering relative to bridge readiness (reboot persistence gap).
|
||||
- Idempotency check for `apt-get install podman` inside LXC.
|
||||
- MAC collision check on the bridge.
|
||||
- A test for the v0.13→v0.14 upgrade path.
|
||||
|
||||
**Simplest 80%-value version**: Ship P1 (image) + P2 (reconciler, with legacy-removal) + P3 (nft+init) + P4 (linux remote) + P7 (doctor+tests). Defer P5 (proxmox native) and P6 (floating-IP) to v0.15. This delivers the linux topology (the most common) + the podman migration + nft completeness, and avoids the two most complex phases (LXC+podman-in-LXC). If G-003 (real mTLS) holds, add the mTLS phase to v0.14a. Proxmox ingress becomes v0.14b/v0.15.
|
||||
|
||||
**What must be true for v0.14 to succeed in 90 days**:
|
||||
1. The 3-way TLS contradiction is resolved in the plan (not just in this grill). Today: unresolved.
|
||||
2. The migration number is 0009. Today: plan says 0007 (wrong).
|
||||
3. The upgrade path from v0.13 is specified and tested. Today: not specified.
|
||||
4. The `certpaths.CAPath()` phantom is fixed. Today: not fixed.
|
||||
5. The offline-first tension (podman pull) is acknowledged. Today: not acknowledged.
|
||||
6. If mTLS is in-scope, the new phase is written. Today: no such phase.
|
||||
|
||||
**Confidence**: 0.45 that the plan as-written can ship v0.14 without rework. The research is strong; the plan diverges from it and from the codebase in load-bearing ways. The mTLS scope expansion (G-003) makes it worse unless the plan is updated.
|
||||
|
||||
---
|
||||
|
||||
## Verdict
|
||||
|
||||
**RETHINK** (confidence 0.45).
|
||||
|
||||
The plan must be revised to:
|
||||
1. Fix the migration number → 0009 (C-59, G-001).
|
||||
2. Fix `certpaths.CAPath()` → `certpaths.CACertPath()` (C-60).
|
||||
3. Add the v0.13→v0.14 upgrade path to P2 T6 (C-57, G-004).
|
||||
4. Resolve the TLS model: either add a new mTLS phase (G-003) or revert to `tls: {}` and defer mTLS to v0.15. The plan cannot ship `certResolver: orca` (broken) and cannot ship `tls: {}` if G-003 holds.
|
||||
5. Amend REQ-172: `--restart=unless-stopped` (not `always`), omit `:Z` (C-61, G-002).
|
||||
6. Address the offline-first tension (C-54) or document the exception.
|
||||
7. Address the REQ-100 regression (C-58): bake-vs-mount the static config.
|
||||
8. Add `DNATTarget` validation (C-51).
|
||||
9. Add podman-install step for linux topology (C-50).
|
||||
10. If mTLS is in-scope, write the new phase (C-62, E-001).
|
||||
|
||||
Once these are addressed, the plan is feasible. The research foundation is solid; the plan just needs to actually follow it.
|
||||
|
||||
---
|
||||
|
||||
*This grill is recorded in `.ciagent/GRILL_v0.14.md`. Escalations are visible via `ciagent audit`. Binding decisions (G-001..G-004) should be promoted to PROJECT.md via a follow-up clarify or explicitly by the operator. The grill surfaces; it does not rewrite.*
|
||||
+32
-26
@@ -10,41 +10,47 @@ deactivated:
|
||||
- network-engineer
|
||||
- devops-engineer
|
||||
phase_specific:
|
||||
- uat-engineer (P12 only)
|
||||
- release-engineer (P1 only — Dockerfile.traefik + release pipeline)
|
||||
reason: |
|
||||
Orca v0.13 is a production-hardening milestone. The active roster is
|
||||
trimmed to the four personas that own the hardening work:
|
||||
- lead-developer: coordinates phase decomposition, owns scheduler
|
||||
wiring (R-022) and jobspec parser fixes (P03)
|
||||
- backend-engineer: owns ACL enforcement wiring (R-023), injection
|
||||
hardening (P02), transport/SSH safety (P08), concurrency (P07)
|
||||
- data-engineer: owns SQLite busy_timeout, audit chain race fix,
|
||||
migration safety, DB retention (P05, P07, P09)
|
||||
- security-engineer: owns toolchain vulns (P01), seal/audit CLI
|
||||
(P05), auth init-idp (P06), key zeroing, WebAuthn reg auth (P04)
|
||||
|
||||
Orca v0.14 is the ingress bootstrap completeness milestone. The active
|
||||
roster owns the podman-traefik container + nft SNAT/DNAT + proxmox LXC
|
||||
ingress work:
|
||||
- lead-developer: coordinates phase decomposition, owns podman traefik
|
||||
reconciler (P2), nft emitter extension (P3), init/bootstrap wiring (P3,P4)
|
||||
- backend-engineer: owns Dockerfile.traefik + release pipeline (P1),
|
||||
proxmox native ingress mode (P5), floating-IP LXC provisioning (P6),
|
||||
doctor ingress (P7)
|
||||
- data-engineer: owns IngressMode schema migration (P5), node record
|
||||
updates for floating-IP LXC registration (P6)
|
||||
- security-engineer: owns nft priority collision fix (pve-firewall
|
||||
coexistence), step-ca root CA push to nodes, TLS model change
|
||||
(certResolver → dynamic tls.certificates)
|
||||
|
||||
network-engineer and devops-engineer are deactivated — their territory
|
||||
(nft ruleset, collector scripts) is covered by backend-engineer in
|
||||
this milestone. cli-engineer and frontend-engineer remain deactivated
|
||||
(no CLI framework or UI work).
|
||||
|
||||
uat-engineer is phase-specific for P12 (UAT plan + signoff script).
|
||||
|
||||
(nft ruleset, container deployment) is covered by backend-engineer +
|
||||
lead-developer in this milestone. cli-engineer and frontend-engineer
|
||||
remain deactivated (no CLI framework or UI work).
|
||||
|
||||
release-engineer is phase-specific for P1 (Dockerfile.traefik +
|
||||
release.sh + .coreci.yml container-publish-traefik step).
|
||||
|
||||
Territory enforcement is warn mode (config.json
|
||||
personas.territory_enforcement=warn). Cross-territory fixes (e.g. a
|
||||
fix that touches both daemon handlers and SQLite) are allowed with a
|
||||
warning.
|
||||
fix that touches both nft emitter and proxmox bootstrap) are allowed
|
||||
with a warning.
|
||||
|
||||
Framework alignment (from go.mod):
|
||||
- lead-developer: cobra
|
||||
- backend-engineer: cobra, connectrpc
|
||||
- backend-engineer: cobra, podman (CLI), pct (CLI via SSH)
|
||||
- data-engineer: modernc/sqlite
|
||||
- security-engineer: go-webauthn, go-jose, x/crypto
|
||||
- uat-engineer: bash, bats
|
||||
- security-engineer: nft, step-ca, TLS
|
||||
- release-engineer: docker, .coreci.yml
|
||||
|
||||
Constraint alignment:
|
||||
- All personas: offline-first, no-redundant-implementations
|
||||
- backend-engineer: API-first, error-handling, security-first
|
||||
- backend-engineer: API-first, error-handling, security-first,
|
||||
container-first (R-024)
|
||||
- data-engineer: schema-first, migration-safe, local-storage-only
|
||||
- security-engineer: deny-by-default, zero-trust, no-passwords (R-021)
|
||||
- uat-engineer: idempotent, read-only, claim-coverage
|
||||
- security-engineer: deny-by-default, zero-trust, no-passwords (R-021),
|
||||
pve-firewall-coexistence
|
||||
- release-engineer: per-release-tagging, registry-auth
|
||||
@@ -0,0 +1,340 @@
|
||||
# PLAN v0.14: Ingress Bootstrap Completeness
|
||||
|
||||
**Status**: active. 9 phases (P0 + P1..P7 + P8 final). Each phase ships a
|
||||
patch tag on the v0.13.x line. This plan references requirement IDs from
|
||||
REQUIREMENTS.md and follows the vertical-slice integrity rule (each phase
|
||||
is independently shippable).
|
||||
|
||||
**Research-validated decisions** (from RESEARCH_v0.14.md + GRILL_v0.14.md):
|
||||
|
||||
- nft postrouting: `ip saddr 127.0.0.0/8 oifname != "lo" masquerade`
|
||||
- nft first-apply: pre-create table (`nft add table inet orca-ingress 2>/dev/null || true`) before `nft -f`
|
||||
- pve-firewall: shift orca input/forward chains to `priority -10` (before pve-firewall's 0)
|
||||
- LXC features: `nesting=1,keyctl=1,fuse=1` (fuse=1 for fuse-overlayfs)
|
||||
- traefik TLS: **drop `certResolver: orca`** — does not exist in v3.3; emit `tls: {}` for v0.14 (real mTLS via dynamic `tls.certificates` + `clientAuth.caFiles` deferred to v0.15 — grill G-003 confidence 0.55 < 0.60 threshold, auto-resolved to defer)
|
||||
- podman restart: `--restart=unless-stopped` + enable `podman-restart.service`
|
||||
- volumes: omit `:Z` flag, use `:ro` on both mounts
|
||||
- traefik image: `FROM traefik:v3.3.0`, `ENTRYPOINT ["/traefik"]` inherited, `CMD ["--configFile=/etc/traefik/traefik.yml"]`
|
||||
- `NftClusterConfig.DNATTarget`: default `127.0.0.1:8443`/`:8080`; proxmox-native = `<lxc-ip>:8443`/`:8080`
|
||||
- Migration: `0009_ingress_mode.sql` (NOT 0007 — already taken by certs_serial_unique)
|
||||
- CA path: `certpaths.CACertPath()` (NOT `certpaths.CAPath()` — does not exist)
|
||||
- Upgrade path: P2 must detect+remove legacy `orca-traefik.service` + `/usr/local/bin/traefik` before starting podman container (C-57)
|
||||
- Podman install: `BootstrapLocalIngress` and `BootstrapRemoteIngress` must install podman if absent (C-50)
|
||||
- Offline-first: `podman pull` requires registry reachability — documented exception to R-001 for ingress bootstrap (C-54)
|
||||
- Static config: mount from host (not baked) to preserve `traefik-on-public-ip` opt-out (C-58)
|
||||
- DNATTarget validation: `net.ParseIP` or `ip:port` parse before render (C-51)
|
||||
- apt-get idempotency: `command -v podman` check before install (C-53)
|
||||
- MAC collision: check against existing nodes' MACs (C-56)
|
||||
- Native-mode nft: first apply uses LXC IP (not default 127.0.0.1) — discover LXC IP before first nft apply (C-55)
|
||||
|
||||
## Phase 0: Pre-execution (this phase)
|
||||
|
||||
**Status**: complete. SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL → SHIP.
|
||||
Ships as `v0.13.0`.
|
||||
|
||||
## Phase 1: `orca-traefik` container image + release pipeline (REQ-171)
|
||||
|
||||
**Tag**: `v0.13.1` | **Type**: feat | **Persona**: release-engineer (phase-specific) + backend-engineer
|
||||
|
||||
### Wave 1 (image)
|
||||
- **T1**: Create `docker/orca-traefik/traefik.yml` — the **default** static config baked into the image (used when no host-side override is mounted):
|
||||
```yaml
|
||||
entryPoints:
|
||||
websecure:
|
||||
address: "127.0.0.1:8443"
|
||||
web:
|
||||
address: "127.0.0.1:8080"
|
||||
traefik:
|
||||
address: "127.0.0.1:8081"
|
||||
providers:
|
||||
file:
|
||||
directory: "/etc/traefik/dynamic"
|
||||
watch: true
|
||||
log:
|
||||
level: INFO
|
||||
format: json
|
||||
accessLog:
|
||||
format: json
|
||||
```
|
||||
No `certificatesResolvers` (research finding: does not exist for CA-based; TLS is via dynamic config).
|
||||
**C-58**: The baked config is a default. The podman run command also mounts a host-side `/etc/traefik/traefik.yml` if it exists (overriding the baked one), preserving the `traefik-on-public-ip` opt-out (REQ-100). The reconciler renders the static config via `emitter.RenderTraefikStaticConfig` to `/etc/traefik/traefik.yml` on the host, then mounts it `-v /etc/traefik/traefik.yml:/etc/traefik/traefik.yml:ro`. This way `PublicBinding` opt-out still works.
|
||||
- **T2**: Create `Dockerfile.traefik` at repo root:
|
||||
```dockerfile
|
||||
FROM traefik:v3.3.0
|
||||
LABEL org.opencontainers.image.title="orca-traefik"
|
||||
LABEL org.opencontainers.image.source="https://git.cloudinit.dev/coreci/orca"
|
||||
COPY docker/orca-traefik/traefik.yml /etc/traefik/traefik.yml
|
||||
CMD ["--configFile=/etc/traefik/traefik.yml"]
|
||||
```
|
||||
(ENTRYPOINT inherited as `["/traefik"]` from base image.)
|
||||
- **T3**: Create placeholder `docker/orca-traefik/step-ca-root.crt` (empty file) — real CA is volume-mounted at runtime. If absent, traefik starts without TLS termination (graceful).
|
||||
|
||||
### Wave 2 (release pipeline)
|
||||
- **T4**: `scripts/release.sh` — add a second docker block after the existing one (~line 212):
|
||||
```bash
|
||||
# Build + push orca-traefik image
|
||||
TRAEFIK_IMAGE="${CONTAINER_REGISTRY}/${CONTAINER_OWNER}/orca-traefik"
|
||||
if command -v docker >/dev/null 2>&1; then
|
||||
docker build -f Dockerfile.traefik -t "${TRAEFIK_IMAGE}:${VERSION}" -t "${TRAEFIK_IMAGE}:latest" .
|
||||
docker push "${TRAEFIK_IMAGE}:${VERSION}"
|
||||
docker push "${TRAEFIK_IMAGE}:latest"
|
||||
fi
|
||||
```
|
||||
- **T5**: `.coreci.yml` — add `container-publish-traefik` step mirroring `container-publish` with `CONTAINER_IMAGE=orca-traefik` + `DOCKERFILE=Dockerfile.traefik`.
|
||||
|
||||
### Wave 3 (tests)
|
||||
- **T6**: Verify `docker build -f Dockerfile.traefik .` succeeds and the resulting image starts traefik with `--configFile=/etc/traefik/traefik.yml` (can test with `docker run --rm orca-traefik --version`).
|
||||
|
||||
### Must-haves
|
||||
- [ ] `Dockerfile.traefik` builds successfully
|
||||
- [ ] Image starts traefik with the baked static config
|
||||
- [ ] `release.sh` publishes `orca-traefik:<version>` + `:latest`
|
||||
- [ ] `.coreci.yml` has `container-publish-traefik` step
|
||||
|
||||
## Phase 2: Podman traefik reconciler (REQ-172)
|
||||
|
||||
**Tag**: `v0.13.2` | **Type**: feat | **Persona**: lead-developer
|
||||
|
||||
### Wave 1 (reconciler)
|
||||
- **T1**: Rewrite `internal/traefik/install.go` — replace binary+systemd install with podman container reconciler:
|
||||
- `EnsureTraefikContainer(ctx, execFn, image, tag)` — idempotent:
|
||||
1. `podman inspect orca-traefik` → if running, no-op; if stopped, `podman start orca-traefik`; if absent, go to step 2
|
||||
2. `mkdir -p /etc/traefik/dynamic /etc/orca`
|
||||
3. `podman pull <image>:<tag>`
|
||||
4. `podman run -d --name orca-traefik --restart=unless-stopped --network host -v /etc/traefik/dynamic:/etc/traefik/dynamic:ro -v /etc/orca/step-ca-root.crt:/etc/orca/step-ca-root.crt:ro <image>:<tag>`
|
||||
- `EnsureTraefikContainerLocal(ctx, image, tag)` — uses `exec.CommandContext("podman", ...)` locally
|
||||
- `EnsureTraefikContainerRemote(ctx, execFn, image, tag)` — uses SSH exec function
|
||||
- Image/tag resolution: `git.cloudinit.dev/coreci/orca-traefik:<version>` where version = `internal/cli.version` (or `latest` if dev)
|
||||
- **Remove** systemd unit generation + `systemctl enable`
|
||||
- **T2**: Add `podman-restart.service` enable step: `systemctl enable --now podman-restart.service` (research finding: needed for reboot persistence)
|
||||
- **T2a**: **C-50**: `EnsureTraefikContainerLocal`/`Remote` must check `command -v podman` first. If absent: on localhost, attempt `apt-get install -y podman` (or fail with clear install instructions if no apt). On remote, `apt-get install -y podman conmon crun fuse-overlayfs` via SSH. Non-fatal warn if podman unavailable (offline host) — traefik won't start but `orca init` succeeds (same tolerance as v0.13).
|
||||
|
||||
### Wave 2 (callsite updates + v0.13 upgrade path)
|
||||
- **T3**: `internal/cli/init.go:254-266` — replace `installTraefikLocal()` with `EnsureTraefikContainerLocal`
|
||||
- **T4**: `internal/linux/bootstrap.go:160-172` — replace `traefik.InstallRemote` with `EnsureTraefikContainerRemote`
|
||||
- **T5**: `internal/proxmox/bootstrap.go:250-255` — replace `traefik.InstallRemote` with `EnsureTraefikContainerRemote` (for native mode; floating-IP calls it inside the LXC in P6)
|
||||
- **T6**: **C-57 (v0.13→v0.14 upgrade path)**: `internal/cli/upgrade.go` — rewrite the Traefik cutover to:
|
||||
1. Detect legacy `orca-traefik.service`: `systemctl is-active orca-traefik.service`
|
||||
2. If active: `systemctl stop orca-traefik.service && systemctl disable orca-traefik.service`
|
||||
3. Remove `/etc/systemd/system/orca-traefik.service` + `/usr/local/bin/traefik` (if exists)
|
||||
4. `systemctl daemon-reload`
|
||||
5. Render static config via `emitter.RenderTraefikStaticConfig` to `/etc/traefik/traefik.yml`
|
||||
6. `EnsureTraefikContainerLocal` (pull + run podman container)
|
||||
7. Idempotent: if no legacy unit, skip steps 1-4
|
||||
- **T7**: `internal/cli/traefik_install.go` — update CLI wrapper
|
||||
|
||||
### Wave 3 (TLS model fix — research finding)
|
||||
- **T8**: `internal/emitter/traefik.go` — drop `certResolver: orca` from the dynamic config router TLS stanza (line ~185-188). Replace with `tls: {}` (empty TLS stanza — traefik uses its default cert). Document that real mTLS via `tls.certificates` + `tls.options.default.clientAuth.caFiles` will be wired when step-ca mints certs into the dynamic dir (post-v0.14 or v1.x).
|
||||
- **T9**: Update `internal/emitter/traefik_test.go` — remove assertion for `certResolver: orca`, add assertion for `tls: {}` presence.
|
||||
|
||||
### Wave 4 (tests)
|
||||
- **T10**: Create `internal/traefik/install_test.go` (new file — F1.3: does not exist today) — assert `podman run` is invoked (not `curl|tar`), `--restart=unless-stopped --network host` present, volume mounts present, `podman-restart.service` enabled.
|
||||
- **T10a**: **C-57/F6.2**: Add v0.13→v0.14 upgrade test: simulate a host with `orca-traefik.service` present (fake), run upgrade, assert unit stopped+disabled+removed, podman container running.
|
||||
|
||||
### Must-haves
|
||||
- [ ] `orca init` → `podman inspect orca-traefik` shows running
|
||||
- [ ] `podman logs orca-traefik` shows traefik started with baked config
|
||||
- [ ] No systemd `orca-traefik.service` generated
|
||||
- [ ] `--restart=unless-stopped` + `podman-restart.service` enabled
|
||||
- [ ] `certResolver: orca` removed from dynamic config
|
||||
|
||||
## Phase 3: nft SNAT+DNAT + `orca init` ingress bootstrap (REQ-173)
|
||||
|
||||
**Tag**: `v0.13.3` | **Type**: feat | **Persona**: lead-developer + security-engineer
|
||||
|
||||
### Wave 1 (nft emitter extension)
|
||||
- **T1**: `internal/emitter/nft.go` — add `DNATTarget` field to `NftClusterConfig` (default `127.0.0.1`). Render DNAT rules as `dnat to <DNATTarget>:8443` / `dnat to <DNATTarget>:8080`. **C-51**: Validate `DNATTarget` with `net.ParseIP` before rendering. Reject invalid values with error (same F9 injection guard pattern as `partitionTrustedProbes`).
|
||||
- **T2**: `internal/emitter/nft.go` — add `EnableSNAT bool` (default true) + `postrouting` chain:
|
||||
```nft
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority 100; policy accept;
|
||||
ip saddr 127.0.0.0/8 oifname != "lo" masquerade
|
||||
}
|
||||
```
|
||||
Only when `EnableSNAT == true`.
|
||||
- **T3**: `internal/emitter/nft.go` — shift `input` and `forward` chain priorities from `filter` (=0) to `-10` (research finding: avoids pve-firewall same-priority undefined order).
|
||||
- **T4**: `internal/emitter/nft.go` — fix first-apply flush-table bug: change `flush table inet orca-ingress` to `delete table inet orca-ingress` (nft ≥1.0 treats delete-of-missing as warning in `-f` mode). If that's version-unsafe, the apply step (T7) pre-creates the table.
|
||||
|
||||
### Wave 2 (ingress bootstrap)
|
||||
- **T5**: New `internal/ingress/bootstrap.go`:
|
||||
- `BootstrapLocalIngress(ctx)`:
|
||||
1. `mkdir -p /etc/traefik/dynamic /etc/orca`
|
||||
2. **C-60**: Push cluster root CA to `/etc/orca/step-ca-root.crt` from `certpaths.CACertPath()` (if exists, else empty placeholder)
|
||||
3. Render static config via `emitter.RenderTraefikStaticConfig` to `/etc/traefik/traefik.yml` (preserves `traefik-on-public-ip` opt-out — C-58)
|
||||
4. Render `orca.nft` via `NftEmitter.RenderNftConfig` + write to `/etc/nftables.d/orca.nft`
|
||||
5. Pre-create table: `nft add table inet orca-ingress 2>/dev/null || true`
|
||||
6. Apply: `nft -f /etc/nftables.d/orca.nft`
|
||||
7. **C-50**: Ensure podman installed (check `command -v podman`, install if absent)
|
||||
8. `EnsureTraefikContainerLocal` (from P2) — mounts `/etc/traefik/traefik.yml:ro` + `/etc/traefik/dynamic:ro` + `/etc/orca/step-ca-root.crt:ro`
|
||||
- Each step non-fatal warn (offline host tolerance)
|
||||
- **T6**: Wire into `internal/cli/init.go` after `EnsureTraefikContainerLocal` (Step 4e, replacing the old traefik install step).
|
||||
|
||||
### Wave 3 (doctor nft update)
|
||||
- **T7**: `internal/cli/doctor_nft.go` — extend assertions: postrouting masquerade present, DNAT target matches `NftClusterConfig.DNATTarget`.
|
||||
|
||||
### Wave 4 (tests)
|
||||
- **T8**: `internal/emitter/nft_test.go` — assert postrouting chain present when `EnableSNAT=true`, absent when false. Assert `DNATTarget` substitution. Assert priority `-10` on input/forward.
|
||||
- **T9**: Integration test: `orca init` → `nft list table inet orca-ingress` shows DNAT + postrouting; `podman inspect orca-traefik` running.
|
||||
|
||||
### Must-haves
|
||||
- [ ] `orca init` → nft table has DNAT + postrouting masquerade
|
||||
- [ ] nft input/forward chains at priority -10
|
||||
- [ ] First-apply doesn't error (table pre-created or delete-table idiom)
|
||||
- [ ] `/etc/orca/step-ca-root.crt` exists (real CA or placeholder)
|
||||
- [ ] `podman inspect orca-traefik` running
|
||||
|
||||
## Phase 4: `orca node join --type linux` remote ingress bootstrap (REQ-174)
|
||||
|
||||
**Tag**: `v0.13.4` | **Type**: feat | **Persona**: lead-developer
|
||||
|
||||
### Wave 1 (remote ingress)
|
||||
- **T1**: `internal/ingress/bootstrap.go` — add `BootstrapRemoteIngress(ctx, execFn)`:
|
||||
1. `mkdir -p /etc/traefik/dynamic /etc/orca` (remote)
|
||||
2. **C-60**: Push step-ca root CA to remote `/etc/orca/step-ca-root.crt` from `certpaths.CACertPath()` via `WriteFile`
|
||||
3. Render `orca.nft` + write to remote `/etc/nftables.d/orca.nft` via `WriteFile`
|
||||
4. `nft add table inet orca-ingress 2>/dev/null || true` (remote)
|
||||
5. `nft -f /etc/nftables.d/orca.nft` (remote)
|
||||
6. `systemctl enable --now podman-restart.service` (remote)
|
||||
7. `EnsureTraefikContainerRemote` (from P2)
|
||||
- **T2**: Wire into `internal/linux/bootstrap.go` after the traefik container reconciler step.
|
||||
- **T3**: Extend `linux.Result` with `IngressOK bool` for reporting.
|
||||
|
||||
### Wave 2 (tests)
|
||||
- **T4**: Fake-SSH test: assert remote `nft -f` + `podman run` + `WriteFile` for step-ca CA invoked.
|
||||
|
||||
### Must-haves
|
||||
- [ ] `orca node join --type linux --host <ip>` → remote has podman traefik running + nft applied + step-ca CA mounted
|
||||
- [ ] `doctor ingress --peer <linux-node>` passes
|
||||
|
||||
## Phase 5: Proxmox native ingress mode (REQ-175)
|
||||
|
||||
**Tag**: `v0.13.5` | **Type**: feat | **Persona**: backend-engineer + data-engineer
|
||||
|
||||
### Wave 1 (flags + schema)
|
||||
- **T1**: Add flags to `node join`: `--ingress-mode` (values: `native` default, `floating-ip`), `--floating-ip`, `--gateway`, `--mac`, `--net-prefix` (default `24`).
|
||||
- **T2**: Add `IngressMode` field to `model.Node` (string: `""`, `"native"`, `"floating-ip"`).
|
||||
- **T3**: **C-59**: Schema migration `0009_ingress_mode.sql` (NOT 0007 — already taken): `ALTER TABLE nodes ADD COLUMN ingress_mode TEXT DEFAULT '';`
|
||||
|
||||
### Wave 2 (native mode bootstrap)
|
||||
- **T4**: In `proxmox.BootstrapProxmox`, when `IngressMode == "native"`:
|
||||
1. On the PVE host: render+apply nft with `DNATTarget = <lxc-bridge-ip>` (the traefik LXC's IP, discovered after `pct start`)
|
||||
2. Create unprivileged LXC with `--features nesting=1,keyctl=1,fuse=1` (research finding: fuse=1 for fuse-overlayfs). `pct create <vmid> local:vztmpl/<template> --hostname orca-traefik --unprivileged 1 --features nesting=1,keyctl=1,fuse=1 --onboot 1 --memory 2048 --swap 0 --rootfs local:8`
|
||||
3. `pct start <vmid>`
|
||||
3a. **C-55**: Discover LXC IP via `pct config <vmid>` (parse `net0` line for `ip=`) or `pct exec <vmid> -- hostname -I` BEFORE the first nft apply. The nft DNAT target is set to the LXC IP from the start — no two-phase apply, no downtime window.
|
||||
4. Inside the LXC: **C-53**: `command -v podman >/dev/null 2>&1 || (apt-get update && apt-get install -y podman conmon crun fuse-overlayfs nftables)` — idempotent, skip if podman already installed
|
||||
5. Configure podman storage (`/etc/containers/storage.conf`): `mount_program = "/usr/bin/fuse-overlayfs"` (fallback: `driver = "vfs"`)
|
||||
6. `systemctl enable --now podman-restart.service` (inside LXC)
|
||||
7. Push step-ca root CA into LXC
|
||||
8. `EnsureTraefikContainerRemote` (podman pull + run inside LXC with `--network host`)
|
||||
9. **C-55**: Render+apply nft on PVE host with `DNATTarget = <lxc-ip>` (discovered in step 3a) — single apply, no downtime window
|
||||
|
||||
### Wave 3 (registration)
|
||||
- **T5**: Register PVE host as `proxmox` node with `IngressMode: "native"`.
|
||||
|
||||
### Wave 4 (tests)
|
||||
- **T6**: Fake-SSH test: assert `pct create` with `--features nesting=1,keyctl=1,fuse=1`, `apt-get install podman`, `podman run` inside LXC, nft DNAT target = LXC IP.
|
||||
|
||||
### Must-haves
|
||||
- [ ] `orca node join --type proxmox --host <ip>` (native) → LXC created with nesting+keyctl+fuse
|
||||
- [ ] Podman + orca-traefik running inside LXC
|
||||
- [ ] PVE host nft DNATs to LXC IP
|
||||
- [ ] `IngressMode: "native"` on node record
|
||||
- [ ] Schema migration 0007 applied
|
||||
|
||||
## Phase 6: Proxmox floating-IP LXC "ingress" (REQ-176)
|
||||
|
||||
**Tag**: `v0.13.6` | **Type**: feat | **Persona**: backend-engineer
|
||||
|
||||
### Wave 1 (LXC provisioning)
|
||||
- **T1**: New `internal/proxmox/ingress_lxc.go` — `ProvisionIngressLXC(ctx, opts)`:
|
||||
1. `pveam download local <template>` (idempotent, already in bootstrap)
|
||||
2. Deterministic VMID for "ingress" (hash of host+"ingress")
|
||||
3. `pct create <vmid> local:vztmpl/<template> --hostname ingress --unprivileged 1 --features nesting=1,keyctl=1,fuse=1 --net0 name=eth0,bridge=vmbr0,hwaddr=<mac>,ip=<floating-ip>/<prefix>,gw=<gateway> --onboot 1 --memory 2048 --swap 0 --rootfs local:8`
|
||||
4. `pct start <vmid>`
|
||||
5. Wait for LXC network (retry SSH to `<floating-ip>` with backoff, 60s timeout)
|
||||
6. Inside the LXC: **C-53**: `command -v podman >/dev/null 2>&1 || (apt-get update && apt-get install -y podman conmon crun fuse-overlayfs nftables)` — idempotent
|
||||
7. Configure podman storage (fuse-overlayfs / vfs fallback)
|
||||
8. `systemctl enable --now podman-restart.service`
|
||||
9. Push step-ca root CA into LXC
|
||||
10. Render+apply nft INSIDE the LXC (DNAT `:443`→`127.0.0.1:8443`, `:80`→`127.0.0.1:8080` + postrouting masquerade) — `DNATTarget = 127.0.0.1` here because traefik runs with `--network host` inside the LXC
|
||||
11. `EnsureTraefikContainerRemote` (podman pull + run inside LXC with `--network host`)
|
||||
12. Push orca SSH pubkey into LXC for future `job run` traefik dynamic-config pushes
|
||||
|
||||
### Wave 2 (registration)
|
||||
- **T2**: Register LXC as managed node: `registry.Join` with `Kind: "linux"`, `Name: "ingress"`, `Address: "<floating-ip>:8443"`, `OS: "linux"`, `IngressMode: "floating-ip"`.
|
||||
- **T3**: Also register PVE host as `proxmox` node (for workload dispatch).
|
||||
|
||||
### Wave 3 (interactive prompting)
|
||||
- **T4**: Interactive prompting in `joinProxmox` (node.go): when `--ingress-mode` empty and `!jsonOutput`:
|
||||
- Prompt "Ingress mode [native/floating-ip] (default native): "
|
||||
- If `floating-ip`: prompt for floating IP (validate `net.ParseIP`), gateway (validate `net.ParseIP`), MAC (validate `net.ParseMAC`; generate `02:XX:XX:XX:XX:XX` random if empty + confirm; **C-56**: check MAC against existing nodes' MACs in cluster registry, regenerate on collision), net-prefix (default 24, validate 8-32)
|
||||
- In `--json` mode: require `--mac` explicitly if `--ingress-mode floating-ip` (no silent generation)
|
||||
|
||||
### Wave 4 (routing)
|
||||
- **T5**: `joinProxmox` in `node.go` routes: native → P5 path; floating-ip → `ProvisionIngressLXC` + register LXC + register PVE host.
|
||||
|
||||
### Wave 5 (tests)
|
||||
- **T6**: Fake-SSH test: assert `pct create` with `net0 name=eth0,bridge=vmbr0,hwaddr=<mac>,ip=<floating-ip>/<prefix>,gw=<gateway>`, `--features nesting=1,keyctl=1,fuse=1`; LXC registered as `linux` node named `ingress` at `<floating-ip>:8443`; PVE host registered as `proxmox`.
|
||||
- **T7**: Interactive prompt test: stdin simulation → mode selection + param entry + validation.
|
||||
|
||||
### Must-haves
|
||||
- [ ] `orca node join --type proxmox --host <ip> --ingress-mode floating-ip --floating-ip 203.0.113.10 --gateway 203.0.113.1 --mac 02:01:02:03:04:05` → LXC `ingress` created
|
||||
- [ ] LXC has podman traefik running + nft applied inside LXC
|
||||
- [ ] Node `ingress` registered as `linux` at `203.0.113.10:8443`
|
||||
- [ ] PVE host registered as `proxmox`
|
||||
- [ ] Interactive prompt works when flags absent + not `--json`
|
||||
- [ ] IP/MAC/gateway validation rejects invalid input
|
||||
|
||||
## Phase 7: `doctor ingress` + docs + integration tests (REQ-177, REQ-178, REQ-179)
|
||||
|
||||
**Tag**: `v0.13.7` | **Type**: feat+docs+test | **Persona**: backend-engineer + lead-developer
|
||||
|
||||
### Wave 1 (doctor ingress)
|
||||
- **T1**: `internal/cli/doctor_ingress.go` — `orca doctor ingress [--peer <name>]`:
|
||||
1. `podman inspect orca-traefik` → running?
|
||||
2. nft DNAT+SNAT applied (reuse `doctor_nft` logic)
|
||||
3. `/etc/traefik/dynamic` exists
|
||||
4. step-ca root CA mounted (`podman inspect` volume check or file-exists check)
|
||||
5. For proxmox-native: checks the LXC (via `pct exec`)
|
||||
6. For floating-ip: checks the ingress LXC over SSH
|
||||
7. Uses SSH-push for remote peers
|
||||
|
||||
### Wave 2 (UAT assertions)
|
||||
- **T2**: `scripts/uat-signoff.sh` — add assertions: `40 ingress_podman_traefik`, `41 ingress_nft_dnat_snat`, `42 ingress_linux_worker`, `43 ingress_proxmox_native_lxc` or `43 ingress_floating_ip_lxc` (depending on topology).
|
||||
|
||||
### Wave 3 (docs)
|
||||
- **T3**: `docs/cli.md` — document `--ingress-mode`, `--floating-ip`, `--gateway`, `--mac`, `--net-prefix` flags + `orca doctor ingress`.
|
||||
- **T4**: `docs/uat.md` — add floating-IP topology variant; update native topology to assert ingress bootstrap.
|
||||
- **T5**: `docs/ingress.md` — podman-traefik image section: `Dockerfile.traefik`, volume mounts, TLS model (dynamic `tls.certificates`, not certResolver), `--network host` rationale.
|
||||
- **T6**: `docs/docker.md` — `orca-traefik` image: build, publish, pull.
|
||||
- **T7**: `.ciagent/ARCHITECTURE.md` — R-024 + ingress bootstrap section (3 topologies, nft+podman stack on each).
|
||||
|
||||
### Wave 4 (integration tests)
|
||||
- **T8**: `tests/ingress_bootstrap_test.go` — hermetic fake-SSH harness:
|
||||
- init → podman traefik running + nft applied
|
||||
- linux join → remote podman + nft + step-ca CA push
|
||||
- proxmox native → LXC created with `nesting=1,keyctl=1,fuse=1` + podman traefik + nft DNAT to LXC IP
|
||||
- floating-ip → `pct create` with correct `net0` args + LXC registered as `linux` node
|
||||
- release.sh builds orca-traefik image (Dockerfile.traefik parses)
|
||||
|
||||
### Wave 5 (verify)
|
||||
- **T9**: `make build && make test && make lint && make verify-docs` all pass.
|
||||
|
||||
### Must-haves
|
||||
- [ ] `orca doctor ingress` exits 0 on a properly bootstrapped node
|
||||
- [ ] UAT signoff script includes new assertions
|
||||
- [ ] `make verify-docs` passes
|
||||
- [ ] Integration tests pass in CI `validate`
|
||||
- [ ] ARCHITECTURE.md ingress section matches shipped code
|
||||
|
||||
## Phase 8: Final review + ship + audit (milestone release)
|
||||
|
||||
**Tag**: `v0.13.8` = **v0.14 milestone release** | **Type**: docs+review
|
||||
|
||||
- Multi-persona code review across all phases
|
||||
- Audit: `verify-reqs`, git-log ↔ `.ciagent/` reconstruction
|
||||
- Merge `phase/08` → `milestone/v0.14` → `main`
|
||||
- Tag `v0.13.8` + release with milestone summary
|
||||
- Build + publish both container images (`orca` + `orca-traefik`)
|
||||
- Delete all milestone branches (tags preserve history)
|
||||
- Mark all REQ-171..179 as complete in REQUIREMENTS.md + ROADMAP.md
|
||||
@@ -707,6 +707,52 @@ v0.13 closes all critical/high/medium findings (15 new requirements,
|
||||
14 phases) and delivers the **UAT plan + signoff script** that gates
|
||||
the v1.0.0 cut.
|
||||
|
||||
### v0.14 Milestone: Ingress Bootstrap Completeness
|
||||
|
||||
**Scope**: ensure that linux & proxmox types are properly bootstrapped
|
||||
with traefik during cluster init or node join. All cluster endpoints are
|
||||
provisioned as sockets (R-007); routing between jobs and services
|
||||
depends on traefik being present and properly configured. v0.13 shipped
|
||||
traefik binary + systemd unit + empty dynamic dir but never wrote the
|
||||
static config nor applied nft rules — `orca-traefik.service` fails on a
|
||||
fresh `orca init` and `orca doctor nft` FAILs. v0.14 replaces the
|
||||
binary+systemd model with a **podman container** running a custom
|
||||
`orca-traefik` image, and completes the nft SNAT+DNAT ingress stack on
|
||||
every node type.
|
||||
|
||||
**New load-bearing rule**: **R-024** — Traefik runs exclusively as a
|
||||
podman container, deployed from the `orca-traefik` image published per
|
||||
release. Every orca-managed ingress surface bootstraps: nft DNAT
|
||||
(`:443→127.0.0.1:8443`, `:80→127.0.0.1:8080`) + SNAT/MASQUERADE
|
||||
postrouting + `podman run -d --restart=always --network host -v
|
||||
/etc/traefik/dynamic:/etc/traefik/dynamic:Z -v
|
||||
/etc/orca/step-ca-root.crt:/etc/orca/step-ca-root.crt:ro
|
||||
git.cloudinit.dev/coreci/orca-traefik:<tag>`. No node joins without a
|
||||
functional podman-traefik ingress data plane.
|
||||
|
||||
**Three topologies** (per operator constraints):
|
||||
1. **Linux**: host → nft → `podman run orca-traefik` (host network)
|
||||
2. **Proxmox Native**: host → nft → LXC (nesting=1) → `podman run orca-traefik`
|
||||
3. **Proxmox Floating-IP**: LXC (owns floating IP) → nft (inside LXC) → `podman run orca-traefik`
|
||||
|
||||
**Milestone type**: feature (multiple `feat` phases). Tags on v0.13.x
|
||||
patch line: `v0.13.0` (P0) ... `v0.13.8` (P8 final = v0.14 milestone
|
||||
release). 9 phases, 9 net-new requirements (REQ-171..REQ-179).
|
||||
|
||||
### v0.14 Decisions (D-series, full autonomy)
|
||||
|
||||
| ID | Question | Decision | Rationale | Confidence |
|
||||
|----|----------|----------|-----------|------------|
|
||||
| D-255 | Traefik deployment model? | **Podman container from custom `orca-traefik` image** | Operator constraint: traefik always deployed as a container. Replaces v0.13 binary+systemd. Image bakes static config. | 0.95 |
|
||||
| D-256 | Container network mode? | **`--network host`** | Binds 127.0.0.1:8080/8443 directly on host/LXC loopback; nft DNAT targets that. No port publishing complexity. | 0.92 |
|
||||
| D-257 | TLS cert resolver in image? | **No certResolver; `tls: {}` for v0.14, real mTLS deferred to v0.15** | Grill G-003 (confidence 0.55 < 0.60) auto-resolved to defer. Traefik v3.3 `certificatesResolvers` only supports acme/tailscale, not CA-file. Drop `certResolver: orca` (broken). Emit `tls: {}` in dynamic config. Real mTLS via dynamic `tls.certificates` + `tls.options.default.clientAuth.caFiles` lands in v0.15 when step-ca mints server certs. | 0.90 |
|
||||
| D-258 | Dynamic config volume? | **Mount `/etc/traefik/dynamic` from host** | Zero changes to existing `deployRemote` WriteFile path (`job_dispatch.go:243`). File provider watches it. | 0.95 |
|
||||
| D-259 | Floating-IP mode: register PVE host too? | **Yes — PVE host as `proxmox` + ingress LXC as `linux`** | PVE host needed in registry for `pct`/`qm` workload dispatch. Both register. | 0.92 |
|
||||
| D-260 | `--ingress-mode` persistence? | **Store `IngressMode` on `model.Node`** | `doctor ingress` needs to know which check path to run. Schema migration. | 0.90 |
|
||||
| D-261 | MAC generation when `--mac` omitted? | **Generate random `02:XX:...` in interactive mode; require `--mac` in `--json` mode** | Interactive: generate + confirm. Non-interactive: explicit required (no silent generation). | 0.88 |
|
||||
| D-262 | Proxmox native nft DNAT target? | **LXC bridge IP (not 127.0.0.1)** | LXC has its own network namespace; 127.0.0.1 on PVE host ≠ LXC loopback. `NftClusterConfig.DNATTarget` field (default `127.0.0.1:8443`; native mode = `<lxc-ip>:8443`). | 0.90 |
|
||||
| D-263 | LXC podman requirements? | **`--features nesting=1,keyctl=1` + `apt-get install podman`** | Ubuntu 24.04 LXC template has no podman preinstalled. Nesting+keyctl required for podman in unprivileged LXC. | 0.88 |
|
||||
|
||||
### v0.13 Decisions (D-series, full autonomy)
|
||||
|
||||
| ID | Question | Decision | Rationale | Confidence |
|
||||
|
||||
@@ -362,7 +362,7 @@ production-ready tag. v1.0.0 is gated on the UAT signoff script
|
||||
- 14 phases (P0 + P01..P12 + P13 final); "no limit on phases" per operator.
|
||||
- P03 (scheduler wiring) and P12 (`--type linux` + UAT) are the `feat` phases; the rest are `fix`/`chore`/`test`/`docs`/`refactor`. Milestone type = feature (at least one `feat`).
|
||||
- Tags on v0.12.x patch line: `v0.12.0` (P0) ... `v0.12.13` (P13 final = v0.13 milestone release).
|
||||
- v1.0.0 production-ready tag stays deferred for post-v0.13 UAT signoff (operator runs `scripts/uat-signoff.sh`, pastes output back).
|
||||
- v1.0.0 production-ready tag stays deferred for post-v0.13 UAT signoff (operator runs `scripts/uat-signoff.sh`, paste output back).
|
||||
|
||||
### Accepted residual risks (documented in threat-model, not fixed)
|
||||
|
||||
@@ -374,3 +374,56 @@ production-ready tag. v1.0.0 is gated on the UAT signoff script
|
||||
- "WASM-first" pillar aspirational — document as "WASM runtime available, process is default"
|
||||
- arm64/armv7 release — D-193 deferred; install.sh detection is forward-looking
|
||||
- OIDC callback slowloris — loopback, short-lived, single CLI invocation
|
||||
|
||||
## Milestone v0.14: Ingress Bootstrap Completeness
|
||||
|
||||
**Scope**: ensure that linux & proxmox types are properly bootstrapped with
|
||||
traefik during cluster init or node join. All cluster endpoints are
|
||||
provisioned as sockets (R-007); routing between jobs and services depends on
|
||||
traefik being present on the host and properly configured. The v0.13 traefik
|
||||
deployment shipped only a binary + systemd unit + empty dynamic dir — it
|
||||
never wrote the static config nor applied nft rules, so `orca-traefik.service`
|
||||
fails to start on a fresh `orca init` and `orca doctor nft` FAILs. v0.14
|
||||
replaces the binary+systemd model with a **podman container** running a custom
|
||||
`orca-traefik` image, and completes the nft SNAT+DNAT ingress stack on every
|
||||
node type.
|
||||
|
||||
**New load-bearing rule**:
|
||||
|
||||
- **R-024** — Traefik runs exclusively as a podman container, deployed from
|
||||
the `orca-traefik` image published per release. Every orca-managed ingress
|
||||
surface bootstraps: nft DNAT (`:443→127.0.0.1:8443`,
|
||||
`:80→127.0.0.1:8080`) + SNAT/MASQUERADE postrouting + `podman run -d
|
||||
--restart=unless-stopped --network host -v /etc/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
|
||||
-v /etc/traefik/dynamic:/etc/traefik/dynamic:ro
|
||||
-v /etc/orca/step-ca-root.crt:/etc/orca/step-ca-root.crt:ro
|
||||
git.cloudinit.dev/coreci/orca-traefik:<tag>`. No node joins without a
|
||||
functional podman-traefik ingress data plane. The image's baked static
|
||||
config is a default; host-side `traefik.yml` mounted `:ro` overrides it
|
||||
(preserves `traefik-on-public-ip` opt-out, REQ-100).
|
||||
|
||||
**Three topologies** (per operator constraints):
|
||||
|
||||
- **Linux**: host → nft → `podman run orca-traefik` (host network)
|
||||
- **Proxmox Native**: host → nft → LXC (nesting=1) → `podman run orca-traefik`
|
||||
- **Proxmox Floating-IP**: LXC (owns floating IP) → nft (inside LXC) →
|
||||
`podman run orca-traefik`
|
||||
|
||||
| ID | Requirement | Priority | Phase | Status |
|
||||
|----|-------------|----------|-------|--------|
|
||||
| REQ-171 | `Dockerfile.traefik` + release pipeline: build + publish `git.cloudinit.dev/coreci/orca-traefik:<version>` alongside the orca image per release; `.coreci.yml` `container-publish-traefik` step; image bakes default `traefik.yml` (entrypoints `websecure` 127.0.0.1:8443, `web` 127.0.0.1:8080, `traefik` 127.0.0.1:8081 + file provider watching `/etc/traefik/dynamic` + json log/accessLog); host-side `/etc/traefik/traefik.yml` mounted `:ro` overrides baked config (preserves `traefik-on-public-ip` opt-out REQ-100); no `certificatesResolvers` (traefik v3.3 only supports acme/tailscale); `tls: {}` in dynamic config for v0.14 (real mTLS deferred to v0.15) | Critical | **v0.14 P1** | pending |
|
||||
| REQ-172 | Replace `internal/traefik/install.go` binary+systemd install with a podman-container reconciler: `podman pull orca-traefik:<tag>` + `podman run -d --restart=unless-stopped --network host --name orca-traefik -v /etc/traefik/traefik.yml:/etc/traefik/traefik.yml:ro -v /etc/traefik/dynamic:/etc/traefik/dynamic:ro -v /etc/orca/step-ca-root.crt:/etc/orca/step-ca-root.crt:ro <image>`; idempotent (pull+run if absent, start if stopped); install podman if absent (C-50); v0.13→v0.14 upgrade: detect+stop+disable+remove legacy `orca-traefik.service` + `/usr/local/bin/traefik` (C-57); works locally + over SSH-push; enable `podman-restart.service`; remove systemd unit generation | Critical | **v0.14 P2** | pending |
|
||||
| REQ-173 | nft SNAT+DNAT ruleset render+apply: extend `internal/emitter/nft.go` with postrouting masquerade chain; new `internal/ingress/bootstrap.go` renders `orca.nft` + applies `nft -f` + ensures `/etc/traefik/dynamic` dir + pushes step-ca root CA + invokes podman traefik reconciler; wired into `orca init` (localhost lead) | Critical | **v0.14 P3** | pending |
|
||||
| REQ-174 | Remote ingress bootstrap via SSH-push for `orca node join --type linux`: push step-ca root CA, render+apply nft remotely, invoke podman traefik reconciler remotely; register node as `linux` | Critical | **v0.14 P4** | pending |
|
||||
| REQ-175 | Proxmox native ingress mode (`--ingress-mode native`, default): on PVE host, render+apply nft (vmbr-compatible, separate `orca-ingress` table avoids pve-firewall conflict); create unprivileged LXC with `--features nesting=1,keyctl=1` running podman+orca-traefik; push step-ca root CA into LXC; nft DNAT target = LXC bridge IP; register PVE host as `proxmox` node; add `IngressMode` field to `model.Node` + schema migration | Critical | **v0.14 P5** | pending |
|
||||
| REQ-176 | Proxmox floating-IP mode (`--ingress-mode floating-ip --floating-ip --gateway --mac [--net-prefix]`): `pct create` Ubuntu LXC named `ingress` with `net0 bridge=vmbr0,hwaddr=<mac>,ip=<floating-ip>/<prefix>,gw=<gateway> --features nesting=1,keyctl=1 --onboot 1`; install podman + run orca-traefik inside LXC; apply nft DNAT+SNAT inside LXC; register LXC as managed `linux` node (name=`ingress`, addr=`<floating-ip>:8443`); interactive prompt for params when flags absent + not `--json`; validate IP/MAC/gateway; PVE host also registered as `proxmox` for workload dispatch | Critical | **v0.14 P6** | pending |
|
||||
| REQ-177 | `orca doctor ingress [--peer]`: verify orca-traefik container running (`podman inspect`), nft DNAT+SNAT applied, `/etc/traefik/dynamic` exists, step-ca root CA mounted; extend `scripts/uat-signoff.sh` with ingress assertions (40 podman_traefik, 41 nft_dnat_snat, 42 linux_worker, 43 proxmox_native_lxc / floating_ip_lxc) | High | **v0.14 P7** | pending |
|
||||
| REQ-178 | Docs: `docs/cli.md` (`--ingress-mode` + floating-IP flags + `doctor ingress`), `docs/uat.md` (native + floating-IP topologies), `docs/ingress.md` (podman-traefik image + volume mounts + certResolver), `docs/docker.md` (orca-traefik image), `ARCHITECTURE.md` (R-024 + ingress bootstrap section) | High | **v0.14 P7** | pending |
|
||||
| REQ-179 | Integration tests: hermetic harness fakes SSH; asserts init→podman traefik running + nft applied; linux join→remote podman+nft; proxmox native→LXC created with nesting + podman traefik; floating-ip→`pct create` with correct net0 args + LXC registered as linux node; release.sh builds orca-traefik image (Dockerfile.traefik parses) | Critical | **v0.14 P7** | pending |
|
||||
|
||||
### Scope notes (v0.14)
|
||||
|
||||
- REQ-171..REQ-179 = 9 net-new requirements (REQ count grows 163 -> 172).
|
||||
- 9 phases (P0 + P1..P7 + P8 final); feature milestone (multiple `feat` phases).
|
||||
- Tags on v0.13.x patch line: `v0.13.0` (P0) ... `v0.13.8` (P8 final = v0.14 milestone release).
|
||||
- Milestone branch: `milestone/v0.14-ingress-bootstrap`.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -675,3 +675,57 @@ CI agent verifies and cuts v1.0.0).
|
||||
- jobspec `health` prober (v0.13 adds lint warning; enforcement deferred)
|
||||
- jobspec `update` rolling/canary controller (v0.13 adds lint warning; enforcement deferred)
|
||||
- jobspec `schedule.cron` scheduler loop (v0.13 adds lint warning; enforcement deferred)
|
||||
|
||||
## Milestone v0.14: Ingress Bootstrap Completeness — **IN PROGRESS**
|
||||
|
||||
**Scope**: ensure that linux & proxmox types are properly bootstrapped with
|
||||
traefik during cluster init or node join. All cluster endpoints are
|
||||
provisioned as sockets (R-007); routing between jobs and services depends on
|
||||
traefik being present and properly configured. v0.13 shipped traefik binary +
|
||||
systemd unit + empty dynamic dir but never wrote the static config nor applied
|
||||
nft rules. v0.14 replaces the binary+systemd model with a **podman container**
|
||||
running a custom `orca-traefik` image, and completes the nft SNAT+DNAT ingress
|
||||
stack on every node type.
|
||||
|
||||
**New load-bearing rule**: **R-024** — Traefik runs exclusively as a podman
|
||||
container from the `orca-traefik` image published per release. Every
|
||||
orca-managed ingress surface bootstraps nft DNAT + SNAT/MASQUERADE +
|
||||
`podman run --restart=always --network host` with dynamic-config + step-ca
|
||||
root CA volume mounts.
|
||||
|
||||
**Three topologies**:
|
||||
1. **Linux**: host → nft → `podman run orca-traefik` (host network)
|
||||
2. **Proxmox Native**: host → nft → LXC (nesting=1) → `podman run orca-traefik`
|
||||
3. **Proxmox Floating-IP**: LXC (owns floating IP) → nft (inside LXC) → `podman run orca-traefik`
|
||||
|
||||
**Milestone type**: feature (multiple `feat` phases). Tags on v0.13.x patch
|
||||
line: `v0.13.0` (P0) ... `v0.13.8` (P8 final = v0.14 milestone release).
|
||||
|
||||
- [ ] Phase 0: Pre-execution (SPECIFY→CLARIFY→RESEARCH→PLAN→GRILL) — tag `v0.13.0`
|
||||
- [ ] Phase 1: `orca-traefik` container image + release pipeline (REQ-171) — tag `v0.13.1`
|
||||
- [ ] Phase 2: Podman traefik reconciler — replace binary+systemd install (REQ-172) — tag `v0.13.2`
|
||||
- [ ] Phase 3: nft SNAT+DNAT + `orca init` ingress bootstrap (REQ-173) — tag `v0.13.3`
|
||||
- [ ] Phase 4: `orca node join --type linux` remote ingress bootstrap (REQ-174) — tag `v0.13.4`
|
||||
- [ ] Phase 5: Proxmox native ingress mode — LXC + podman traefik (REQ-175) — tag `v0.13.5`
|
||||
- [ ] Phase 6: Proxmox floating-IP LXC ingress + interactive prompt (REQ-176) — tag `v0.13.6`
|
||||
- [ ] Phase 7: `doctor ingress` + docs + integration tests (REQ-177,178,179) — tag `v0.13.7`
|
||||
- [ ] Phase 8: Final review + ship + audit (milestone release) — tag `v0.13.8` = **v0.14 milestone release**
|
||||
|
||||
### Per-phase REQ coverage (v0.14)
|
||||
|
||||
- **P1** — `Dockerfile.traefik` + release pipeline (REQ-171)
|
||||
- **P2** — Podman traefik reconciler (REQ-172)
|
||||
- **P3** — nft SNAT+DNAT + init bootstrap (REQ-173)
|
||||
- **P4** — Linux node join remote ingress (REQ-174)
|
||||
- **P5** — Proxmox native ingress — LXC + podman (REQ-175)
|
||||
- **P6** — Proxmox floating-IP LXC ingress (REQ-176)
|
||||
- **P7** — doctor ingress + docs + tests (REQ-177,178,179)
|
||||
- **P8** — Final review + ship + audit
|
||||
|
||||
### v0.14 is a continuation milestone, not a direction change
|
||||
|
||||
The vision ("minimalist, offline-first, CLI-first orchestration engine")
|
||||
is unchanged. v0.14 completes the ingress bootstrap that v0.13 left
|
||||
non-functional (binary installed but no config, no nft applied). The
|
||||
podman-container model is the operator's constraint; the architecture's
|
||||
socket+traefik routing design (R-007, R-017) is unchanged.
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
"slug": "orca",
|
||||
"name": "Orca",
|
||||
"description": "Offline/CLI-first orchestration engine (Orca) \u2014 Nomad-inspired, far simpler than Kubernetes",
|
||||
"milestone": "v0.13",
|
||||
"milestone": "v0.14",
|
||||
"phase": 0,
|
||||
"milestone_type": "feature",
|
||||
"default_branch": "main",
|
||||
@@ -185,7 +185,8 @@
|
||||
"registry": "git.cloudinit.dev",
|
||||
"owner": "coreci",
|
||||
"image": "orca",
|
||||
"credential_env": "GITEA_TOKEN"
|
||||
"credential_env": "GITEA_TOKEN",
|
||||
"images": ["orca", "orca-traefik"]
|
||||
}
|
||||
},
|
||||
"secrets": {
|
||||
|
||||
+39
-11
@@ -23,25 +23,25 @@ pipelines:
|
||||
description: Validate Go toolchain, formatting, and security scans
|
||||
steps:
|
||||
- name: go-version
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
commands:
|
||||
- go version
|
||||
- gofmt -l .
|
||||
- go vet ./...
|
||||
|
||||
- name: verify-reqs
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
commands:
|
||||
- make verify-reqs
|
||||
|
||||
- name: gosec
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
commands:
|
||||
- go install github.com/securego/gosec/v2/cmd/gosec@v2.18.2
|
||||
- gosec -fmt text -quiet ./...
|
||||
|
||||
- name: govulncheck
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
env:
|
||||
# REQ-027: offline mode. GOFLAGS=-mod=mod ensures module mode;
|
||||
# GOVULNCHECK_DB (when present) overrides the bundled DB.
|
||||
@@ -51,7 +51,7 @@ pipelines:
|
||||
- govulncheck -mode binary ./...
|
||||
|
||||
- name: gitleaks
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
commands:
|
||||
- apk add --no-cache curl
|
||||
- sh -c "$(curl -fsSL https://github.com/gitleaks/gitleaks/releases/latest/download/install.sh)"
|
||||
@@ -61,7 +61,7 @@ pipelines:
|
||||
description: Build the orca binary with version injection
|
||||
steps:
|
||||
- name: build
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
env:
|
||||
VERSION: ${CI_COMMIT_TAG:-dev}
|
||||
GIT_COMMIT: ${CI_COMMIT_SHA}
|
||||
@@ -80,7 +80,7 @@ pipelines:
|
||||
description: Run all tests with race detection and coverage (REQ-031)
|
||||
steps:
|
||||
- name: test
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
commands:
|
||||
- go test -race -coverprofile=coverage.out ./...
|
||||
- go tool cover -func=coverage.out | tail -1
|
||||
@@ -91,7 +91,7 @@ pipelines:
|
||||
ref: "refs/tags/v*"
|
||||
steps:
|
||||
- name: build-artifact
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
env:
|
||||
VERSION: ${CI_COMMIT_TAG}
|
||||
GIT_COMMIT: ${CI_COMMIT_SHA}
|
||||
@@ -105,20 +105,48 @@ pipelines:
|
||||
go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca
|
||||
- make changelog
|
||||
- tar -czf orca-${VERSION}-linux-amd64.tar.gz -C bin orca
|
||||
- ls -lh orca-${VERSION}-linux-amd64.tar.gz
|
||||
- sha256sum orca-${VERSION}-linux-amd64.tar.gz > SHA256SUMS
|
||||
- ls -lh orca-${VERSION}-linux-amd64.tar.gz SHA256SUMS
|
||||
- cat SHA256SUMS
|
||||
- name: gitea-release
|
||||
image: golang:1.25
|
||||
image: golang:1.25.12
|
||||
env:
|
||||
GITEA_TOKEN: ${GITEA_TOKEN}
|
||||
VERSION: ${CI_COMMIT_TAG}
|
||||
commands:
|
||||
- apk add --no-cache curl tar
|
||||
- apk add --no-cache curl tar python3
|
||||
- sh -c "$(curl -fsSL https://gitea.com/gitea/tea/releases/latest/download/install.sh)"
|
||||
- tea releases create ${VERSION}
|
||||
--repo coreci/orca
|
||||
--title "Orca ${VERSION}"
|
||||
--note-file CHANGELOG.md
|
||||
--asset orca-${VERSION}-linux-amd64.tar.gz
|
||||
--asset SHA256SUMS
|
||||
- |
|
||||
# Verify assets are actually attached (REQ-097, gate C-21).
|
||||
# tea releases create has been observed to exit 0 without
|
||||
# attaching the asset in some versions. Verify via the API.
|
||||
ASSET_COUNT=$(curl -fsSL \
|
||||
"https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/tags/${VERSION}" \
|
||||
| python3 -c "import json,sys; r=json.load(sys.stdin); print(len(r.get('assets',[])))")
|
||||
echo "Release ${VERSION} has ${ASSET_COUNT} assets"
|
||||
if [ "${ASSET_COUNT}" -lt 2 ]; then
|
||||
echo "ERROR: Expected at least 2 assets (tarball + SHA256SUMS), got ${ASSET_COUNT}"
|
||||
echo "Attempting to attach assets manually..."
|
||||
TARBALL_URL=$(curl -fsSL \
|
||||
"https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/tags/${VERSION}" \
|
||||
| python3 -c "import json,sys; r=json.load(sys.stdin); print(r.get('id',''))")
|
||||
if [ -n "${TARBALL_URL}" ]; then
|
||||
curl -fsSL -X "POST" \
|
||||
"https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${TARBALL_URL}/assets?name=orca-${VERSION}-linux-amd64.tar.gz" \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-F "attachment=@orca-${VERSION}-linux-amd64.tar.gz"
|
||||
curl -fsSL -X "POST" \
|
||||
"https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${TARBALL_URL}/assets?name=SHA256SUMS" \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-F "attachment=@SHA256SUMS"
|
||||
fi
|
||||
fi
|
||||
- name: container-publish
|
||||
description: Build and publish OCI image to Gitea container registry (REQ-046)
|
||||
image: docker:24-cli
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ ARG BUILD_TIME=unknown
|
||||
|
||||
# --- Stage 1: build -------------------------------------------------------
|
||||
|
||||
FROM golang:1.25 AS builder
|
||||
FROM golang:1.25.12 AS builder
|
||||
|
||||
ARG VERSION
|
||||
ARG GIT_COMMIT
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
15ee8f02ef938496ce9baae35e2971a5fcfb2d55b2c6e35e49c11285f67aeb53 orca-v0.12.18-linux-amd64.tar.gz
|
||||
+78
-37
@@ -21,52 +21,41 @@ Use `--type linux` for all remote nodes. Proxmox-specific claims
|
||||
(`doctor proxmox`, PVE role, sudoers) are **skipped** in this path.
|
||||
The signoff script reports exercised vs. skipped claims.
|
||||
|
||||
### Pre-staging
|
||||
|
||||
1. Build orca from the v0.13 tag:
|
||||
```sh
|
||||
git clone https://git.cloudinit.dev/coreci/orca.git
|
||||
cd orca && git checkout v0.12.13
|
||||
make build
|
||||
# binary is at bin/orca
|
||||
```
|
||||
|
||||
2. Generate the orca SSH keypair on the lead:
|
||||
```sh
|
||||
ssh-keygen -t ed25519 -f ~/.ssh/orca_ed25519 -N ""
|
||||
```
|
||||
|
||||
3. Pre-stage the orca public key on pve01 and worker01:
|
||||
```sh
|
||||
ssh-copy-id -i ~/.ssh/orca_ed25519.pub root@pve01
|
||||
ssh-copy-id -i ~/.ssh/orca_ed25519.pub root@worker01
|
||||
```
|
||||
|
||||
4. Pin host-key fingerprints (optional but recommended):
|
||||
```sh
|
||||
ssh-keyscan pve01 | ssh-keygen -lf -
|
||||
ssh-keyscan worker01 | ssh-keygen -lf -
|
||||
```
|
||||
|
||||
## Step-by-step UAT
|
||||
|
||||
### Step 1: Initialize the cluster
|
||||
### Step 1: Install orca + initialize the cluster
|
||||
|
||||
Install orca (1-liner):
|
||||
```sh
|
||||
curl -fsSL https://git.cloudinit.dev/coreci/orca/raw/branch/main/scripts/install.sh | bash
|
||||
```
|
||||
|
||||
Initialize the cluster:
|
||||
```sh
|
||||
export ORCA_HOME=~/orca-uat
|
||||
orca init
|
||||
```
|
||||
|
||||
**Expected**: cluster directory created, CA cert generated, localhost node registered.
|
||||
**Expected**: orca init creates:
|
||||
- CA cert + server cert
|
||||
- SSH keypair (orca_ssh_key + orca_ssh_key.pub)
|
||||
- known_hosts file (empty, for TOFU capture)
|
||||
- Master key (for secrets encryption)
|
||||
- Traefik data-plane ingress (binary + systemd unit + config)
|
||||
- Localhost node registered
|
||||
|
||||
**Pre-staging remote nodes**: `orca init` interactively prompts for remote
|
||||
host addresses and runs `ssh-copy-id` automatically (password prompt passes
|
||||
through). Enter each host (pve01, worker01) when prompted, or press Enter to
|
||||
skip. The orca public key is deployed to each host; TOFU host-key capture is
|
||||
automatic on the first `orca node join` — no manual fingerprint pinning needed.
|
||||
|
||||
### Step 2: Onboard the Proxmox host
|
||||
|
||||
```sh
|
||||
orca node join --type proxmox \
|
||||
--host pve01 \
|
||||
--ssh-user root \
|
||||
--ssh-key ~/.ssh/orca_ed25519 \
|
||||
--host-key-fingerprint SHA256:<fingerprint>
|
||||
--ssh-user root
|
||||
```
|
||||
|
||||
**Expected**: SSH bootstrap succeeds, orca user created, PVE role assigned, node registered as `ready` with `kind=proxmox`.
|
||||
@@ -76,9 +65,7 @@ orca node join --type proxmox \
|
||||
```sh
|
||||
orca node join --type linux \
|
||||
--host worker01 \
|
||||
--ssh-user root \
|
||||
--ssh-key ~/.ssh/orca_ed25519 \
|
||||
--host-key-fingerprint SHA256:<fingerprint>
|
||||
--ssh-user root
|
||||
```
|
||||
|
||||
**Expected**: SSH bootstrap succeeds, orca user created, drift-events dir created, node registered as `ready` with `kind=linux`.
|
||||
@@ -184,12 +171,20 @@ orca acl check operator-1 --namespace prod --permission admin
|
||||
|
||||
**Expected**: read+write allowed, admin denied (not granted).
|
||||
|
||||
### Step 12b: Initialize the OIDC provider (for seal)
|
||||
|
||||
```sh
|
||||
orca auth init-idp --rp-id orca.local
|
||||
```
|
||||
|
||||
**Expected**: Dex config + systemd unit + Traefik route rendered. (Dex binary must be installed separately.)
|
||||
|
||||
### Step 13: Seal/unseal
|
||||
|
||||
```sh
|
||||
orca cluster seal --rp-id orca.local
|
||||
orca cluster seal
|
||||
orca cluster unseal
|
||||
orca secrets set prod TEST_KEY --value "test-value"
|
||||
orca secrets set prod TEST_KEY=test-value
|
||||
orca secrets get prod TEST_KEY
|
||||
```
|
||||
|
||||
@@ -317,3 +312,49 @@ scripts/uat-signoff.sh
|
||||
2. Run `scripts/uat-signoff.sh` on the lead
|
||||
3. Paste the output back to the CI agent
|
||||
4. The CI agent verifies `35/35 PASS` and cuts `v1.0.0`
|
||||
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### ORCA_HOME not set
|
||||
All orca commands use `$ORCA_HOME` (default `~/.orca`). If commands fail
|
||||
with "no such file or directory", verify:
|
||||
```sh
|
||||
echo $ORCA_HOME
|
||||
ls $ORCA_HOME/orca.db $ORCA_HOME/orca_ssh_key $ORCA_HOME/known_hosts $ORCA_HOME/cluster/master.key
|
||||
```
|
||||
|
||||
### known_hosts missing
|
||||
If SSH operations fail with "open .../known_hosts: no such file", the
|
||||
known_hosts file was not created during `orca init`. Fix:
|
||||
```sh
|
||||
touch $ORCA_HOME/known_hosts
|
||||
chmod 600 $ORCA_HOME/known_hosts
|
||||
```
|
||||
|
||||
### Traefik not running
|
||||
If Traefik routes are not deployed, verify Traefik is running:
|
||||
```sh
|
||||
systemctl status orca-traefik
|
||||
ls /etc/traefik/dynamic/
|
||||
```
|
||||
If not installed, `orca init` should have installed it. Re-run `orca init`
|
||||
or install manually from https://github.com/traefik/traefik/releases.
|
||||
|
||||
### SSH connection refused
|
||||
If the orca SSH key is not pre-staged on the remote host:
|
||||
```sh
|
||||
ssh-copy-id -i ~/.orca/orca_ssh_key.pub root@<host>
|
||||
```
|
||||
|
||||
### Job deployed but not visible in `job list`
|
||||
The remote dispatch path now inserts a DB record (v0.12.16). If you
|
||||
still don't see it, check:
|
||||
```sh
|
||||
orca job list --json
|
||||
```
|
||||
Look for the `"node"` field — it shows which node the job deployed to.
|
||||
|
||||
### Proxmox: process runtime rejected
|
||||
Proxmox nodes require `one_of: pve-ct` or `one_of: pve-vm` in the
|
||||
jobspec. `one_of: process` (systemd) is for Linux/Ubuntu workers only.
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
---
|
||||
kind: Service
|
||||
name: web-app-lxc
|
||||
namespace: prod
|
||||
|
||||
runtime:
|
||||
one_of: pve-ct
|
||||
image: local:vztmpl/ubuntu-24.04
|
||||
|
||||
resources:
|
||||
cpu_millicores: 500
|
||||
memory_mib: 512
|
||||
disk_mib: 2048
|
||||
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
protocol: tcp
|
||||
|
||||
constraints:
|
||||
- "node.kind == 'proxmox'"
|
||||
|
||||
restart:
|
||||
mode: service
|
||||
max_retries: 3
|
||||
delay: 10s
|
||||
|
||||
health:
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
path: /healthz
|
||||
|
||||
tasks:
|
||||
- name: web
|
||||
runtime:
|
||||
command: "/bin/bash -c 'apt-get update && apt-get install -y nginx && nginx -g 'daemon off;'"
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
protocol: tcp
|
||||
---
|
||||
# Web App (LXC container variant)
|
||||
# Deploys as a Proxmox LXC container via `pct create`.
|
||||
# Requires --target <proxmox-node> and the LXC template
|
||||
# (auto-downloaded during `orca node join --type proxmox`).
|
||||
+48
-5
@@ -5,15 +5,15 @@ import (
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"bufio"
|
||||
"os"
|
||||
"strings"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"git.cloudinit.dev/coreci/orca/internal/acl"
|
||||
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
||||
"git.cloudinit.dev/coreci/orca/internal/identity"
|
||||
@@ -63,8 +63,7 @@ func runInit(out interface{ Write([]byte) (int, error) }) error {
|
||||
Database string `json:"database"`
|
||||
CAFingerprint string `json:"ca_fingerprint,omitempty"`
|
||||
CertFingerprint string `json:"cert_fingerprint,omitempty"`
|
||||
OS string `json:"os"
|
||||
"path/filepath"`
|
||||
OS string `json:"os"`
|
||||
NodeID string `json:"node_id"`
|
||||
NodeName string `json:"node_name"`
|
||||
Steps []stepResult `json:"steps"`
|
||||
@@ -160,6 +159,50 @@ func runInit(out interface{ Write([]byte) (int, error) }) error {
|
||||
fmt.Fprintf(out, "\xe2\x9c\x93 SSH keypair provisioned: fp=%s\n", sshKeyFp[:min(16, len(sshKeyFp))]+"...")
|
||||
}
|
||||
|
||||
// Step 4a-2: Interactively pre-stage the orca public key on remote
|
||||
// hosts (ssh-copy-id). Skipped in --json mode (non-interactive).
|
||||
// The operator enters host addresses (one per line, empty line to
|
||||
// finish). For each host, ssh-copy-id is run; if SSH key auth is
|
||||
// not yet established, ssh-copy-id prompts for the password
|
||||
// interactively. This makes orca init the single entry point —
|
||||
// no manual pre-staging required.
|
||||
if !jsonOutput {
|
||||
pubPath := certpaths.SSHPubPath()
|
||||
fmt.Fprintf(out, "\n Pre-stage the orca public key on remote nodes.\n")
|
||||
fmt.Fprintf(out, " Enter host addresses (one per line, empty line to skip):\n")
|
||||
stagedHosts := []string{}
|
||||
reader := bufio.NewReader(os.Stdin)
|
||||
for {
|
||||
fmt.Fprintf(out, " host> ")
|
||||
line, err := reader.ReadString('\n')
|
||||
if err != nil {
|
||||
break
|
||||
}
|
||||
host := strings.TrimSpace(line)
|
||||
if host == "" {
|
||||
break
|
||||
}
|
||||
// Run ssh-copy-id interactively (password prompt passes through).
|
||||
fmt.Fprintf(out, " Deploying orca key to %s...\n", host)
|
||||
cmd := exec.Command("ssh-copy-id", "-i", pubPath, "-o", "StrictHostKeyChecking=accept-new", "root@"+host)
|
||||
cmd.Stdin = os.Stdin
|
||||
cmd.Stdout = os.Stdout
|
||||
cmd.Stderr = os.Stderr
|
||||
if err := cmd.Run(); err != nil {
|
||||
fmt.Fprintf(out, " \xe2\x9a\xa0 Failed to deploy key to %s: %v\n", host, err)
|
||||
continue
|
||||
}
|
||||
fmt.Fprintf(out, " \xe2\x9c\x93 Key deployed to %s\n", host)
|
||||
stagedHosts = append(stagedHosts, host)
|
||||
}
|
||||
if len(stagedHosts) > 0 {
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "pre-stage", Status: "ok", Detail: strings.Join(stagedHosts, ", ")})
|
||||
} else {
|
||||
summary.Steps = append(summary.Steps, stepResult{Label: "pre-stage", Status: "skipped", Detail: "no hosts entered"})
|
||||
}
|
||||
fmt.Fprintf(out, "\n")
|
||||
}
|
||||
|
||||
// Step 4b: known_hosts file (empty, 0600). Without this, the TOFU
|
||||
// host-key callback fails with "no such file" on the first SSH dial
|
||||
// (knownhosts.New requires the file to exist).
|
||||
|
||||
@@ -467,10 +467,12 @@ func createLinuxUser(user string) error {
|
||||
// createPVERole creates the OrcaOperator PVE role if it doesn't exist.
|
||||
// Idempotent: probes `pveum role list` before `pveum role add`.
|
||||
func createPVERole(role string) error {
|
||||
// F10c: shellQuote the role (validated upstream, but defense-in-depth).
|
||||
// Idempotent: check if the role already exists before creating.
|
||||
// Use pveum role list with grep -qF (fixed string, not regex) to
|
||||
// avoid shell-quoting issues with single quotes inside the pattern.
|
||||
cmd := fmt.Sprintf(
|
||||
"pveum role list 2>/dev/null | grep -q '^%s' || pveum role add %s --privs '%s'",
|
||||
shellQuote(role), shellQuote(role), OrcaOperatorPrivileges,
|
||||
"pveum role list 2>/dev/null | grep -qF %s && exit 0 || pveum role add %s --privs '%s' 2>/dev/null || pveum role mod %s --privs '%s'",
|
||||
shellQuote(role), shellQuote(role), OrcaOperatorPrivileges, shellQuote(role), OrcaOperatorPrivileges,
|
||||
)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
@@ -483,11 +485,10 @@ func createPVERole(role string) error {
|
||||
// Uses @pam realm (AD-019) since orca creates a Linux system user.
|
||||
func createPVEUser(user string) error {
|
||||
pveUserID := user + "@pam"
|
||||
// F10c: shellQuote the PVE user id (validated upstream, but
|
||||
// defense-in-depth).
|
||||
// Idempotent: check if user exists, create if not, update comment if exists.
|
||||
cmd := fmt.Sprintf(
|
||||
"pveum user list 2>/dev/null | grep -q %s || pveum user add %s -comment 'Orca automation user'",
|
||||
shellQuote(pveUserID), shellQuote(pveUserID),
|
||||
"pveum user list 2>/dev/null | grep -qF %s && exit 0 || pveum user add %s -comment 'Orca automation user' 2>/dev/null || pveum user mod %s -comment 'Orca automation user'",
|
||||
shellQuote(pveUserID), shellQuote(pveUserID), shellQuote(pveUserID),
|
||||
)
|
||||
if _, err := runRemote(cmd); err != nil {
|
||||
return err
|
||||
|
||||
+83
-25
@@ -69,6 +69,9 @@ if [ "$SYSTEM" = "true" ]; then
|
||||
fi
|
||||
INSTALL_BIN="/usr/local/bin/orca"
|
||||
NAMESPACE_DIR="/root/.orca"
|
||||
elif [ -w /usr/local/bin ] || [ "$(id -u)" -eq 0 ]; then
|
||||
INSTALL_BIN="/usr/local/bin/orca"
|
||||
NAMESPACE_DIR="${HOME}/.orca"
|
||||
else
|
||||
INSTALL_BIN="${HOME}/.local/bin/orca"
|
||||
NAMESPACE_DIR="${HOME}/.orca"
|
||||
@@ -111,34 +114,57 @@ TARBALL="orca-${VERSION}-${OS}-${ARCH}.tar.gz"
|
||||
|
||||
find_asset_url() {
|
||||
# $1 = tag. Prints the browser_download_url for the matching tarball, or empty.
|
||||
# The `|| true` prevents set -e + pipefail from exiting the script when
|
||||
# grep finds no match (exit 1) — an empty result is a valid outcome.
|
||||
# Match by asset NAME (not URL path) — Gitea attachment URLs are opaque
|
||||
# UUIDs that don't contain the tarball name.
|
||||
local tag="$1"
|
||||
curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${tag}" \
|
||||
| sed -n 's/.*"browser_download_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
|
||||
| grep "/${TARBALL}\$" \
|
||||
| head -1 || true
|
||||
local json
|
||||
json="$(curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${tag}" 2>/dev/null)" || return 1
|
||||
if command -v python3 >/dev/null 2>&1; then
|
||||
echo "$json" | python3 -c "
|
||||
import json,sys
|
||||
r=json.load(sys.stdin)
|
||||
for a in r.get('assets',[]):
|
||||
if a.get('name')=='$TARBALL':
|
||||
print(a.get('browser_download_url',''))
|
||||
break
|
||||
" 2>/dev/null || true
|
||||
else
|
||||
echo "$json" | sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"$TARBALL".*"browser_download_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1 || true
|
||||
fi
|
||||
}
|
||||
|
||||
find_asset_in_releases() {
|
||||
# Walk recent releases, find the newest with a matching asset name.
|
||||
# Outputs two lines: URL and VERSION (caller captures both).
|
||||
local json
|
||||
json="$(curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases?limit=50" 2>/dev/null)" || return 1
|
||||
if command -v python3 >/dev/null 2>&1; then
|
||||
echo "$json" | python3 -c "
|
||||
import json,sys,re
|
||||
rels=json.load(sys.stdin)
|
||||
for r in rels:
|
||||
tag=r.get('tag_name','')
|
||||
for a in r.get('assets',[]):
|
||||
name=a.get('name','')
|
||||
m=re.match(r'orca-(v[0-9.]+)-' + '${OS}' + '-' + '${ARCH}' + r'\.tar\.gz$', name)
|
||||
if m:
|
||||
print(a.get('browser_download_url',''))
|
||||
print(m.group(1))
|
||||
sys.exit(0)
|
||||
"
|
||||
fi
|
||||
}
|
||||
|
||||
info "locating asset ${TARBALL} in release ${VERSION}..."
|
||||
ASSET_URL="$(find_asset_url "$VERSION")"
|
||||
ASSET_URL="$(find_asset_url "$VERSION" 2>/dev/null)" || true
|
||||
|
||||
if [ -z "$ASSET_URL" ]; then
|
||||
info "WARNING: release ${VERSION} has no ${TARBALL} asset. Walking back through recent releases..."
|
||||
# The /releases list endpoint returns assets inline (browser_download_url
|
||||
# appears within each release's assets array). Extract all download URLs
|
||||
# from the list response and find the first (newest) one matching our
|
||||
# OS+arch tarball pattern (any version). This avoids per-release API calls.
|
||||
ASSET_URL="$(curl -fsSL "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases?limit=50" \
|
||||
| grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]*"' \
|
||||
| sed -n 's/.*"browser_download_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
|
||||
| grep -E "/orca-[^/]*-${OS}-${ARCH}\.tar\.gz$" \
|
||||
| head -1 || true)"
|
||||
FALLBACK_OUT="$(find_asset_in_releases || true)"
|
||||
ASSET_URL="$(echo "$FALLBACK_OUT" | head -1)"
|
||||
if [ -n "$ASSET_URL" ]; then
|
||||
# Extract the version from the URL (e.g. .../download/v0.4.5/orca-...)
|
||||
FALLBACK_VERSION="$(echo "$ASSET_URL" | sed -n 's|.*/download/\([^/]*\)/.*|\1|p')"
|
||||
info "WARNING: latest release ${VERSION} has no binary asset; falling back to ${FALLBACK_VERSION} which has orca-${FALLBACK_VERSION}-${OS}-${ARCH}.tar.gz."
|
||||
VERSION="$FALLBACK_VERSION"
|
||||
VERSION="$(echo "$FALLBACK_OUT" | tail -1)"
|
||||
info "WARNING: falling back to ${VERSION} which has orca-${VERSION}-${OS}-${ARCH}.tar.gz."
|
||||
else
|
||||
err "could not find any release with a ${OS}-${ARCH} tarball in the last 50 releases. Check that a release exists with a linux-${ARCH} binary."
|
||||
fi
|
||||
@@ -178,9 +204,27 @@ info "downloading..."
|
||||
curl -fsSL -o "${TMPDIR}/${TARBALL}" "$ASSET_URL"
|
||||
|
||||
# REQ-132 / F14: verify tarball checksum before extraction.
|
||||
# Fetch SHA256SUMS from the same release; fail closed on mismatch.
|
||||
SHA256SUMS_URL="$(dirname "$ASSET_URL")/SHA256SUMS"
|
||||
if curl -fsSL -o "${TMPDIR}/SHA256SUMS" "$SHA256SUMS_URL" 2>/dev/null; then
|
||||
# Fetch SHA256SUMS from the same release. For Gitea release-download
|
||||
# URLs (e.g. /releases/download/vX.Y.Z/...) the SHA256SUMS is a sibling.
|
||||
# For Gitea attachment URLs (e.g. /attachments/<uuid>) we must look up
|
||||
# the SHA256SUMS asset by name from the release API.
|
||||
SHA256SUMS_URL=""
|
||||
if echo "$ASSET_URL" | grep -q "/releases/download/"; then
|
||||
SHA256SUMS_URL="$(dirname "$ASSET_URL")/SHA256SUMS"
|
||||
elif command -v python3 >/dev/null 2>&1; then
|
||||
# Look up SHA256SUMS asset by name from the release API.
|
||||
SHA256SUMS_URL="$(curl -fsSL \
|
||||
"${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${VERSION}" 2>/dev/null \
|
||||
| python3 -c "
|
||||
import json,sys
|
||||
r=json.load(sys.stdin)
|
||||
for a in r.get('assets',[]):
|
||||
if a.get('name')=='SHA256SUMS':
|
||||
print(a.get('browser_download_url',''))
|
||||
break
|
||||
" 2>/dev/null || true)"
|
||||
fi
|
||||
if [ -n "$SHA256SUMS_URL" ] && curl -fsSL -o "${TMPDIR}/SHA256SUMS" "$SHA256SUMS_URL" 2>/dev/null; then
|
||||
info "verifying checksum..."
|
||||
(cd "$TMPDIR" && grep -F "$TARBALL" SHA256SUMS | sha256sum -c -) || {
|
||||
err "checksum verification failed (REQ-132); refusing to install"
|
||||
@@ -218,9 +262,23 @@ if [ "$SYSTEM" = "true" ]; then
|
||||
info " namespace root: ${NAMESPACE_DIR} (use 'orca --system init' to initialize)"
|
||||
else
|
||||
info " namespace root: ${NAMESPACE_DIR} (use 'orca init' to initialize)"
|
||||
# If the install dir is not on PATH, add it to .bashrc automatically.
|
||||
if ! echo "$PATH" | grep -q "$INSTALL_DIR"; then
|
||||
info " NOTE: $INSTALL_DIR is not on your PATH. Add it:"
|
||||
info " export PATH=\"\$PATH:$INSTALL_DIR\""
|
||||
info " Adding $INSTALL_DIR to PATH via ~/.bashrc..."
|
||||
SHELL_RC="${HOME}/.bashrc"
|
||||
if [ -f "$SHELL_RC" ]; then
|
||||
# Append only if not already present (idempotent).
|
||||
if ! grep -qF "$INSTALL_DIR" "$SHELL_RC"; then
|
||||
echo "" >> "$SHELL_RC"
|
||||
echo "# Added by orca install.sh" >> "$SHELL_RC"
|
||||
echo "export PATH=\"\$PATH:$INSTALL_DIR\"" >> "$SHELL_RC"
|
||||
info " ✓ Added 'export PATH=\"\$PATH:$INSTALL_DIR\"' to ~/.bashrc"
|
||||
info " Run 'source ~/.bashrc' or start a new shell to pick up the change."
|
||||
fi
|
||||
else
|
||||
info " NOTE: ~/.bashrc not found. Add to PATH manually:"
|
||||
info " export PATH=\"\$PATH:$INSTALL_DIR\""
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
@@ -101,6 +101,9 @@ info "built: bin/orca (linux-amd64)"
|
||||
|
||||
TARBALL="orca-${VERSION}-linux-amd64.tar.gz"
|
||||
tar -czf "$TARBALL" -C bin orca
|
||||
sha256sum "$TARBALL" > SHA256SUMS
|
||||
info "checksum: SHA256SUMS"
|
||||
cat SHA256SUMS
|
||||
info "packaged: $TARBALL ($(du -h "$TARBALL" | cut -f1))"
|
||||
|
||||
# --- release notes from ---ci--- blocks ----------------------------------
|
||||
|
||||
+12
-3
@@ -62,7 +62,7 @@ assert "07 full_stack_running" \
|
||||
'$ORCA job list 2>&1 | grep -qE "(running|complete|web-app|api|worker)"'
|
||||
|
||||
assert "08 job_deploys_to_remote" \
|
||||
'$ORCA job list --json 2>&1 | grep -q "node"'
|
||||
'$ORCA job list --json 2>&1 | grep -q "\\"node\\""'
|
||||
|
||||
assert "09 traefik_routes" \
|
||||
'ls /etc/traefik/dynamic/ 2>/dev/null | grep -q "orca\|traefik-dynamic"'
|
||||
@@ -80,7 +80,7 @@ assert "13 acl_deny_default" \
|
||||
'! $ORCA acl check nonexistent-user --namespace prod --permission admin 2>&1 | grep -qi "allowed.*true"'
|
||||
|
||||
assert "14 acl_file_mode" \
|
||||
'stat -c "%a" "$ORCA_HOME/cluster/acl.json" 2>/dev/null | grep -q "600"'
|
||||
'test -f "$ORCA_HOME/cluster/acl.json" && stat -c "%a" "$ORCA_HOME/cluster/acl.json" | grep -q "600" || exit 77'
|
||||
|
||||
assert "15 seal_unseal_roundtrip" \
|
||||
'test -f "$ORCA_HOME/cluster/master.key" || test -f "$ORCA_HOME/cluster/master.key.sealed"'
|
||||
@@ -119,7 +119,7 @@ assert "26 cli_md_complete" \
|
||||
'grep -c "^##.*orca" docs/cli.md 2>/dev/null | grep -qE "^[3-9][0-9]|[1-9][0-9][0-9]"'
|
||||
|
||||
assert "27 no_pprof_all_interfaces" \
|
||||
'! grep -r "pprof-allow-public\|Listen.*0\.0\.0\.0.*6060" internal/ 2>/dev/null | head -1 | grep -q "."'
|
||||
'! grep -rn "pprof-allow-public" internal/daemon/pprof.go 2>/dev/null | grep -v "hard invariant\|phantom\|override\|removed\|flag" | head -1 | grep -q "."'
|
||||
|
||||
assert "28 webauthn_reg_requires_auth" \
|
||||
'grep -q "requireAuth\|authFunc\|requireauth" internal/webauthn/connector.go 2>/dev/null'
|
||||
@@ -145,6 +145,15 @@ assert "34 type_linux_available" \
|
||||
assert "35 status_deprecated" \
|
||||
'$ORCA status 2>&1 | grep -qi "deprecated"'
|
||||
|
||||
assert "36 traefik_installed" \
|
||||
'systemctl is-active orca-traefik 2>/dev/null | grep -q "active" || exit 77'
|
||||
|
||||
assert "37 known_hosts_exists" \
|
||||
'test -f "$ORCA_HOME/known_hosts" || test -f "$ORCA_HOME/cluster/known_hosts"'
|
||||
|
||||
assert "38 master_key_exists" \
|
||||
'test -f "$ORCA_HOME/cluster/master.key" || test -f "$ORCA_HOME/cluster/master.key.sealed"'
|
||||
|
||||
# --- Report ---
|
||||
|
||||
echo "=========================================="
|
||||
|
||||
Reference in New Issue
Block a user