empeira 0.1.0.pre.alpha.1

data/lib/empeira/node/container_preparation.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    # rubocop:disable-next Metrics/ModuleLength -- Container preparation shares its ownership transaction.
+    module ContainerPreparation
+      private
+
+      def network_gateway
+        Network::Gateway.new(context: context, runtime: @runtime, state: @state)
+      end
+
+      def finish_network_bootstrap(record)
+        @bootstrap_proxy.cleanup(@state)
+        record['network_phase'] = 'runtime'
+        save
+        network_gateway.phase(record, bootstrap: false)
+        refresh_dns
+      end
+
+      def ready_server
+        raise Error, 'Control plane is down; run empeira up first' unless @state&.dig('resources', 'network', 'id')
+
+        ready_network!
+        plan = ControlPlane::Plan.new(context: context)
+        expected = @state.dig('control_plane', 'services', 'server', 'id')
+        server = @runtime.inspect_service(plan.definitions.fetch('server'), expected_id: expected)
+        unless current_server?(server, plan) &&
+               ControlPlane::Health.new(runtime: @runtime, plan: plan).ready?('server', 'server' => server)
+          raise Error, 'Configuration server is not ready; run empeira up first'
+        end
+
+        server
+      end
+
+      def ready_network!
+        definition = Infrastructure::Definition.new(context: context).network
+        expected = @state&.dig('resources', 'network', 'id')
+        raise Error, 'Control plane is down; run empeira up first' unless expected
+
+        @runtime.verify_isolated_network(definition, expected_id: expected)
+      end
+
+      def current_server?(server, plan)
+        server&.dig('labels', 'io.empeira.definition') == plan.definitions.fetch('server').fingerprint
+      end
+
+      def reserve(request)
+        reject_name!(request.hostname.downcase)
+        plan = ControlPlane::Plan.new(context: context)
+
+        image = Image.new(config: context.configuration, request: request, architecture: @runtime.architecture)
+        definition = node_definition(request, image, plan)
+        record = node_record(request, definition, image)
+        @nodes[record.fetch('hostname')] = record
+        save
+        [record, definition, image]
+      end
+
+      def node_record(request, definition, image)
+        request.to_h.transform_keys(&:to_s).merge(
+          'hostname' => request.hostname.downcase, 'runtime' => context.container_engine,
+          'architecture' => @runtime.architecture, **ssh_record,
+          'image' => image.reference, 'id' => nil, 'network_phase' => 'bootstrap', 'provisioned' => false,
+          'created_at' => Time.now.utc.iso8601,
+          'definition' => definition.options
+        )
+      end
+
+      def ssh_record
+        publication = @runtime.node_ssh_publication?
+        { 'ssh_host' => '127.0.0.1', 'ssh_port' => publication ? nil : 22,
+          'ssh_transport' => publication ? 'loopback' : 'tunnel' }
+      end
+
+      def reject_name!(hostname)
+        reserved = Network::Naming.new.reserved(context.configuration)
+        aliases = [hostname, hostname.delete_suffix('.empeira.internal')]
+        taken = @nodes.keys.any? { |key| aliases.include?(key.delete_suffix('.empeira.internal')) }
+        return unless aliases.intersect?(reserved) || taken
+
+        raise Providers::AlreadyExists, 'Hostname is reserved or already exists in this workspace'
+      end
+
+      def node_definition(request, image, plan)
+        init = node_init
+        Definition.new(hostname: request.hostname.downcase, workspace: context.workspace,
+                       network: plan.network, dns: dns_address(plan), image: image.reference,
+                       memory: request.memory, cpus: request.cpus, init: init,
+                       **peer_options,
+                       command: init == 'systemd' ? ['/sbin/init'] : %w[/usr/sbin/sshd -D -e],
+                       **ssh_options(request),
+                       environment: plan.node_proxy_environment)
+      end
+
+      def peer_options
+        layout = Network::Peer::Layout.new(@state.fetch('peer_network').fetch('subnet'))
+        { ip: layout.container_lease(@nodes), mac_address: "02:#{SecureRandom.hex(5).scan(/../).join(':')}",
+          sysctls: { 'net.ipv6.conf.all.disable_ipv6' => '1', 'net.ipv6.conf.default.disable_ipv6' => '1' } }
+      end
+
+      def node_init
+        init = context.configuration.dig('node_defaults', 'init')
+        @runtime.require_systemd! if init == 'systemd'
+        init
+      end
+
+      def ssh_options(request)
+        ssh_credentials(request.hostname.downcase).prepare_hosts
+        { entrypoint: '/usr/local/libexec/empeira-node-start',
+          ports: @runtime.node_ssh_publication? ? ['127.0.0.1::22/tcp'] : [],
+          mounts: [] }
+      end
+
+      def dns_address(plan)
+        dns = @runtime.inspect_service(plan.definitions.fetch('dns'),
+                                       expected_id: @state.dig('control_plane', 'services', 'dns', 'id'))
+        address = dns&.dig('networks', plan.network, 'IPAddress')
+        raise Error, 'Empeira DNS is unavailable; run empeira up first' if address.to_s.empty?
+
+        address
+      end
+
+      def ssh_credentials(hostname)
+        SSHCredentials.new(context: context, runner: @runner, provider: 'container', hostname: hostname)
+      end
+
+      def configure(resource, record)
+        { 'certname' => record.fetch('hostname'), 'server' => 'server.empeira.internal',
+          'environment' => context.configuration.dig('server', 'environment') }.each do |key, value|
+          result = @runtime.service_exec(resource,
+                                         [Certificates::PUPPET, 'config', 'set', key, value, '--section', 'main'])
+          raise Error, 'Node agent configuration failed; node retained for diagnosis' unless result.success?
+        end
+        refresh_dns
+      end
+
+      def refresh_dns
+        plan = ControlPlane::Plan.new(context: context)
+        ControlPlane::Discovery.new(plan: plan, runtime: @runtime, state: @state).refresh
+      end
+    end
+  end
+end

data/lib/empeira/node/container_state.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    module ContainerState
+      def list
+        load_state
+        records = container_records
+        return [] if records.empty?
+
+        check_runtime!
+        definitions = records.transform_values { |record| definition(record) }
+        resources = @runtime.inspect_services(definitions, expected_ids: records.transform_values do |record|
+          record['id']
+        end)
+        records.map { |name, record| inventory_row(record, resources[name]) }
+      end
+
+      def inspect_resource(name:)
+        load_state
+        record = @nodes[name.downcase]
+        return unless record
+
+        check_runtime!
+        resource = observed(record)
+        return unless resource
+
+        state = record['provisioned'] && resource['state'] == 'running' ? :running : :stopped
+        Providers::Resource.new(name: record.fetch('hostname'), owner: context.workspace.id, state: state)
+      end
+
+      private
+
+      def inventory_row(record, resource)
+        verify_network!(resource, record) if resource
+        record.slice('hostname', 'provider', 'runtime', 'os', 'version', 'last_puppet_exit').merge(
+          'state' => state_of(record, resource)
+        )
+      end
+
+      def container_records
+        @nodes.select { |_, record| record['provider'] == 'container' }
+      end
+
+      def lifecycle_result(name, state, changed:)
+        resource = Providers::Resource.new(name: name, owner: context.workspace.id, state: state)
+        Providers::Result.new(resource: resource, changed: changed)
+      end
+
+      def mutate(availability: true)
+        @build_info.require_compatible!(context.configuration.dig('requirements', 'empeira'))
+        @store.with_lock do
+          load_state
+          check_runtime!(availability: availability)
+          yield
+        end
+      end
+
+      def load_state
+        @state = @store.load
+        @nodes = @state&.fetch('nodes', {}) || {}
+      end
+
+      def save
+        @state['nodes'] = @nodes
+        @store.write(@state)
+      end
+
+      def check_runtime!(availability: true)
+        if @state && @state.fetch('runtime') != context.container_engine
+          raise Error, 'Node runtime differs from workspace ownership; restore runtime.container_engine'
+        end
+
+        @runtime.check_available! if availability
+      end
+
+      def fetch(name)
+        @nodes.fetch(name.downcase) { raise Providers::NotFound, 'Node does not exist in this workspace' }
+      end
+
+      def definition(record)
+        Definition.new(hostname: record.fetch('hostname'), workspace: context.workspace,
+                       **record.fetch('definition').except('hostname').transform_keys(&:to_sym))
+      end
+
+      def observed(record)
+        resource = @runtime.inspect_service(definition(record), expected_id: record['id'])
+        verify_network!(resource, record) if resource
+        resource
+      end
+
+      def verify_network!(resource, record)
+        network = Network::Definition.new(workspace: context.workspace, policy: Network::Policy.new).backend_name
+        return if resource.fetch('networks').keys == [network] && SSHEndpoint.valid?(resource, record)
+
+        raise Providers::OwnershipError, 'Node has unexpected network membership or published ports'
+      end
+
+      def running(record)
+        resource = observed(record)
+        raise Error, 'Node is missing; destroy its reservation before recreating it' unless resource
+        unless resource['state'] == 'running'
+          raise Error,
+                "Node #{record.fetch('hostname')} is stopped; " \
+                "start it with: empeira node start #{record.fetch('hostname')}"
+        end
+
+        resource
+      end
+
+      def state_of(record, resource)
+        return 'missing' unless resource
+        return 'incomplete' unless record['provisioned']
+        return 'stale' unless resource.dig('labels', 'io.empeira.definition') == definition(record).fingerprint
+        return 'stale' unless Image.new(config: context.configuration, request: request_for(record),
+                                        architecture: record['architecture']).reference == record['image']
+
+        resource['state'] == 'exited' ? 'stopped' : resource['state']
+      rescue ConfigurationError
+        'stale'
+      end
+
+      def request_for(record)
+        RunRequest.new(**record.slice('hostname', 'provider', 'os', 'version', 'memory', 'cpus')
+          .transform_keys(&:to_sym))
+      end
+    end
+  end
+end

data/lib/empeira/node/definition.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    class Definition < Services::Definition
+      attr_reader :hostname
+
+      def initialize(hostname:, workspace:, **)
+        @hostname = hostname
+        super(key: "node-#{Digest::SHA256.hexdigest(hostname)[0, 24]}", workspace: workspace,
+              hostname: hostname, **)
+      end
+
+      def ownership_labels
+        super.merge('io.empeira.purpose' => 'node', 'io.empeira.hostname' => hostname,
+                    'io.empeira.provider' => 'container')
+      end
+    end
+  end
+end

data/lib/empeira/node/diagnostic_command.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    module DiagnosticCommand
+      def self.validate!(arguments, timeout)
+        raise ConfigurationError, 'Provide a guest command and arguments after --' unless valid_arguments?(arguments)
+        return if timeout.nil? || (timeout.is_a?(Numeric) && timeout.finite? && timeout.positive? && timeout <= 86_400)
+
+        raise ConfigurationError, 'Command timeout must be positive and at most 86400 seconds'
+      end
+
+      def self.valid_arguments?(arguments)
+        arguments.is_a?(Array) && !arguments.empty? && !arguments.first.to_s.empty? &&
+          arguments.all? { |argument| argument.is_a?(String) && !argument.include?("\0") }
+      end
+    end
+  end
+end

data/lib/empeira/node/dnf_agent_repository.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+# rubocop:disable Style/FormatStringToken -- RPM and DNF use their native query-format tokens.
+
+module Empeira
+  module Node
+    # DNF metadata is queried against the isolated source directory only.
+    # rubocop:disable-next Metrics/ClassLength -- DNF and RPM share one isolated source and its temporary trusted keys.
+    class DnfAgentRepository < AgentRepository
+      REPO_PATH = '/var/tmp/empeira-agent-repos/agent.repo'
+      KEY_PATH = '/var/tmp/empeira-agent-rpm-key.gpg'
+      CONFIG_PATH = '/var/tmp/empeira-agent-dnf.conf'
+      PACKAGE_PATH = '/var/tmp/empeira-agent-package.rpm'
+      QUERY_FORMAT = '%{name}|%{epoch}|%{version}|%{release}|%{arch}|%{reponame}'
+
+      def resolve
+        @release_package = nil
+        @release_sources = {}
+        @repository_ids = []
+        install_source
+        result = native!([*dnf_command, 'repoquery', "--archlist=#{@target.native_architecture},noarch",
+                          '--qf', QUERY_FORMAT, @package], 'DNF package resolution')
+        candidates = result.stdout.lines.filter_map { |line| dnf_candidate(line) }
+        candidate = Agent::Versions.select(candidates, @version, suffix: @source['suffix'])
+        candidate.merge('url' => package_url(candidate))
+      ensure
+        remove_release_package if @release_package
+      end
+
+      def prepare_keys
+        key = super
+        execute!(['rpmkeys', '--import', key], 'RPM signing key import') if key
+        key
+      end
+
+      def inspect_package(path)
+        @copy.call(path, PACKAGE_PATH, '0600')
+        result = execute!(['rpm', '-qp', '--qf', '%{NAME}|%{EPOCHNUM}:%{VERSION}-%{RELEASE}|%{ARCH}', PACKAGE_PATH],
+                          'RPM package inspection')
+        name, version, architecture = result.stdout.strip.split('|')
+        version = version.delete_prefix('0:') if version
+        metadata = validate_metadata(name, version, architecture)
+        verify_signature unless @source['verify_signatures'] == false
+        metadata
+      end
+
+      private
+
+      def install_source
+        execute!(['mkdir', '-p', File.dirname(REPO_PATH)], 'source preparation')
+        if @source['url'].end_with?('.rpm')
+          install_release(@source)
+          collect_release_sources
+          prepare_keys
+        else
+          @repository_ids = ['empeira-agent']
+          prepare_keys
+          copy_text(repo_content, REPO_PATH, mode: '0600')
+        end
+        copy_text("[main]\ngpgcheck=1\nsslverify=1\nlogfilelevel=0\nreposdir=#{File.dirname(REPO_PATH)}\n",
+                  CONFIG_PATH, mode: '0600')
+      end
+
+      def install_release(artifact)
+        path = download_artifact(artifact, 'release.rpm')
+        destination = '/var/tmp/empeira-agent-release.rpm'
+        @copy.call(path, destination, '0600')
+        name = execute!(['rpm', '-qp', '--qf', '%{NAME}', destination], 'release metadata').stdout.strip
+        require_absent_release!(name)
+        @release_package = name
+        execute!(['rpm', '-i', destination], 'release package installation')
+      end
+
+      def collect_release_sources
+        files = execute!(['rpm', '-ql', @release_package], 'release source discovery').stdout.lines.map(&:strip)
+        files = files.select { |file| file.start_with?('/etc/yum.repos.d/') && file.end_with?('.repo') }
+        raise Error, 'Agent release package provides no native DNF source' if files.empty?
+
+        files.each_with_index do |file, index|
+          content = execute!(['cat', file], 'release repository configuration').stdout
+          import_release_keys(content)
+          store_release_source(content, index)
+        end
+      end
+
+      def store_release_source(content, index)
+        path = "#{File.dirname(REPO_PATH)}/#{index}.repo"
+        scoped = Agent::ReleaseSources.dnf(content, target: @target, source: @source, package: @package)
+        @repository_ids.concat(scoped.scan(/^\[([^\]]+)\]/).flatten)
+        @release_sources[path] = scoped
+        copy_text(scoped, path, mode: '0600')
+      end
+
+      def import_release_keys(content)
+        content.scan(/^\s*gpgkey\s*=\s*(.+)$/).flatten.flat_map(&:split).each_with_index do |url, index|
+          path = release_key(url, index)
+          @public_keys << Base64.strict_encode64(File.binread(path))
+          guest_path = "#{KEY_PATH}-#{index}"
+          @copy.call(path, guest_path, '0600')
+          execute!(['rpmkeys', '--import', guest_path], 'RPM signing key import')
+        end
+      end
+
+      def release_key(url, index)
+        path = File.join(@directory, "release-key-#{index}")
+        if url.start_with?('file:///')
+          key = execute!(['cat', URI(url).path], 'release signing key').stdout
+          File.write(path, key, perm: 0o600)
+        else
+          @download.fetch(url, path, operation: 'Download agent release signing key')
+        end
+        path
+      end
+
+      def repo_content
+        credentials = @authentication.credentials
+        lines = ['[empeira-agent]', 'name=Empeira temporary agent source', "baseurl=#{@source.fetch('url')}",
+                 'enabled=1', "gpgcheck=#{@source['verify_signatures'] == false ? 0 : 1}",
+                 'sslverify=1', 'skip_if_unavailable=0', "includepkgs=#{@package}"]
+        lines.push("username=#{credentials.first}", "password=#{credentials.last}") if credentials
+        "#{lines.join("\n")}\n"
+      end
+
+      def install_auth
+        if @release_package
+          @release_sources.each do |path, content|
+            copy_text(authenticated_release_content(content), path, mode: '0600')
+          end
+          return
+        end
+
+        copy_text(repo_content, REPO_PATH, mode: '0600')
+      end
+
+      def authenticated_release_content(content)
+        credentials = @authentication.credentials
+        return content unless credentials
+
+        content.gsub(/^(\s*baseurl\s*=\s*)(\S+)$/) do
+          line = Regexp.last_match(0)
+          url = @target.expand(Regexp.last_match(2))
+          if @authentication.credentials(url)
+            "#{line}\nusername=#{credentials.first}\npassword=#{credentials.last}"
+          else
+            line
+          end
+        end
+      end
+
+      def dnf_command
+        # --quiet also hides HTTP status details needed for the one authentication retry.
+        ['dnf', "--config=#{CONFIG_PATH}", "--releasever=#{@target.release}"]
+      end
+
+      def package_url(candidate)
+        spec = "#{@package}-#{candidate.fetch('version')}.#{candidate.fetch('architecture')}"
+        urls = native!([*dnf_command, 'repoquery', "--repoid=#{candidate.fetch('repository')}", '--location', spec],
+                       'DNF artifact location').stdout.lines
+               .map(&:strip).select { |line| line.start_with?('https://') }.uniq
+        raise Error, 'Selected agent source did not provide one HTTPS package location' unless urls.size == 1
+
+        Configuration::AgentSchema.https_url!(urls.first, 'agent resolved package URL')
+        urls.first
+      end
+
+      def dnf_candidate(line)
+        name, epoch, version, release, architecture, repository = line.strip.split('|')
+        return unless name == @package && [@target.native_architecture, 'noarch'].include?(architecture) &&
+                      @repository_ids.include?(repository)
+
+        native = "#{epoch}:#{version}-#{release}".delete_prefix('0:')
+        { 'version' => native, 'architecture' => architecture, 'repository' => repository }
+      end
+
+      def validate_metadata(name, version, architecture)
+        unless name == @package && [@target.native_architecture, 'noarch'].include?(architecture) &&
+               Agent::Versions.match?(version.to_s, @version, suffix: @source['suffix'])
+          raise Error, 'Agent package name, native version or architecture differs from the requested target'
+        end
+
+        { 'version' => version, 'architecture' => architecture }
+      end
+
+      def verify_signature
+        result = execute!(['rpmkeys', '--checksig', '--verbose', PACKAGE_PATH], 'RPM package signature verification')
+        return if result.stdout.match?(/Signature[^\n]*:\s*OK/i) && !result.stdout.match?(/NOKEY|NOT OK/i)
+
+        raise Error, 'Agent RPM package has no verifiable trusted signature'
+      end
+
+      def release_inventory_arguments
+        ['rpm', '-qa', '--qf', "%{NAME}\n"]
+      end
+
+      def release_removal_arguments
+        ['rpm', '-e', '--', @release_package]
+      end
+    end
+  end
+end
+
+# rubocop:enable Style/FormatStringToken

data/lib/empeira/node/external_fact.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    # Logical provider and the fixed native Hiera selector are present before the first catalog.
+    module ExternalFact
+      PATH = '/etc/puppetlabs/facter/facts.d/empeira.yaml'
+      PROVIDERS = %w[container vm].freeze
+
+      def self.content(provider)
+        raise ConfigurationError, 'Unknown Empeira node provider' unless PROVIDERS.include?(provider)
+
+        "empeira:\n  provider: #{provider}\n  hierarchy: empeira\n"
+      end
+
+      def self.fingerprint(provider)
+        Digest::SHA256.hexdigest(content(provider))
+      end
+    end
+  end
+end

data/lib/empeira/node/image.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    class Image
+      attr_reader :reference, :recipe, :build_files
+
+      def initialize(config:, request:, architecture:)
+        image = config.dig('images', 'nodes', request.os, request.version)
+        raise ConfigurationError, 'node_defaults.os/version must select a configured images.nodes entry' unless image
+        unless image.fetch('architectures', []).include?(architecture.to_s)
+          raise Error, 'Node image does not support runtime architecture; configure images.nodes without emulation'
+        end
+
+        @build_files = {}
+        @reference = Images::Configuration.reference(image, registry: config.dig('images', 'registry'))
+        return if image['reference'] || !image['build']
+
+        prepare_recipe(config, image)
+        @reference = Images::Configuration.local_image(recipe, purpose: "node-#{architecture}")
+      end
+
+      private
+
+      def prepare_recipe(config, image)
+        root = Pathname(Images::Configuration::ROOT).join('nodes/ssh')
+        @build_files = { 'node-start' => root.join('start').read, 'sshd_config' => root.join('sshd_config').read,
+                         'node-connect' => root.join('../../network/ssh_connect.rb').read }
+        @recipe = build_recipe(config, image) + "\n# SSH resources: #{Infrastructure::Definition.fingerprint(@build_files)}\n"
+      end
+
+      def build_recipe(config, image)
+        template = Images::Configuration.recipe(image, registry: config.dig('images', 'registry'))
+        template.gsub('@BASE_IMAGE@', reference)
+      end
+    end
+  end
+end

data/lib/empeira/node/interactive_tools.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    # Agent tools are exposed through owned interactive OS startup fragments.
+    class InteractiveTools
+      def initialize(record:, execute:, persist:)
+        @record = record
+        @execute = execute
+        @persist = persist
+      end
+
+      def self.valid_inventory?(entry)
+        entry == { 'version' => 1 }
+      end
+
+      def reconcile
+        helper = Pathname(__dir__).join('../../../resources/nodes/interactive_tools.rb').read
+        @record['interactive_tools'] = { 'version' => 1 }
+        @persist.call
+        result = @execute.call([Certificates::RUBY, '-e', helper, JSON.generate('puppet' => Certificates::PUPPET)])
+        unless result.success?
+          details = Execution::Diagnostics.command(result, operation: 'Interactive agent tool PATH', tool: 'ruby')
+          raise Error, "Cannot configure interactive agent tools; node retained for diagnosis\n#{details}", cause: nil
+        end
+
+        JSON.parse(result.stdout).fetch('changed')
+      rescue JSON::ParserError, KeyError
+        raise Error, 'Cannot verify interactive agent tool PATH; node retained for diagnosis', cause: nil
+      end
+    end
+  end
+end

data/lib/empeira/node/interface.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Node
+    class Interface < Providers::Lifecycle
+      attr_reader :backend
+
+      def initialize(backend:, **dependencies)
+        super(**dependencies)
+        @backend = backend
+      end
+
+      def run(request)
+        super(name: request.hostname, request: request)
+      end
+    end
+  end
+end