@forgezero/agent 0.1.41 → 0.1.42

package/dist/metal-provision.js

@@ -339,45 +339,70 @@ var yamlFile = (path, content, permissions) => `  - path: ${JSON.stringify(path)
     encoding: b64
     content: ${base64(content)}
 `;
-function guestBootstrapScript(profile, attested = Boolean(profile.confidential), hasEnrolment = true, nodeLabel = "compute") {
+function guestBootstrapOperations(profile, attested = Boolean(profile.confidential), hasEnrolment = true, nodeLabel = "compute") {
   validateMetalProfile(profile);
   const agentBun = "/usr/local/lib/forgezero/bun";
-  const telemetryEndpoint = `'${profile.agentTelemetryEndpoint.replace(/'/g, `'\\''`)}'`;
-  const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
-# healthy and encrypted while attestation is silently impossible. Install and
-# load the driver shipped by the one pinned image before the agent starts. Do
-# not ask an evolving apt repository for an exact old kernel package: the image
-# can keep booting after Canonical removes that package from the mirror.
-if [[ ! -c /dev/sev-guest ]]; then modprobe sev-guest; fi
-test -c /dev/sev-guest
-printf 'sev-guest
-' >/etc/modules-load.d/sev-guest.conf
-` : "";
-  return `#!/usr/bin/env bash
-set -Eeuo pipefail
-${attestationSetup}if [[ ! -x /usr/local/bin/bun ]]; then
-  curl -fsSL https://bun.sh/install -o /run/fz-bun-install
-  printf '%s  %s
-' '${profile.bunInstallerSha256}' /run/fz-bun-install | sha256sum -c -
-  HOME=/root BUN_INSTALL=${agentBun} BUN_VERSION=${profile.bunVersion} bash /run/fz-bun-install
-  install -m 0755 ${agentBun}/bin/bun /usr/local/bin/bun
-  rm -f /run/fz-bun-install
-fi
-if [[ ! -x /usr/local/lib/forgezero/agent/fz-agent ]] || [[ "$(/usr/local/lib/forgezero/agent/fz-agent --version 2>/dev/null || true)" != "${profile.agentVersion}" ]]; then
-  env BUN_INSTALL=${agentBun} /usr/local/bin/bun add -g --no-cache --force @forgezero/agent@${profile.agentVersion}
-fi
-env   FZ_API=${profile.apiUrl}   OTEL_EXPORTER_OTLP_ENDPOINT=${telemetryEndpoint}   FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent   FZ_AGENT_USER=forgezero-agent   FZ_SOCKET_PATH=/run/forgezero/vault.sock   FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred   FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred   FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub   FZ_DEPLOY_ROOT=/opt/forgezero   FZ_DEPLOY_PULL=${hasEnrolment ? "true" : "false"}   FZ_AGENT_EGRESS_ENFORCE=${hasEnrolment ? "true" : "false"}   FZ_NODE_LABEL=${nodeLabel}   ${agentBun}/bin/fz agent install --apply${hasEnrolment ? " --enrol" : ""}
-`;
+  return [
+    ...attested ? [
+      ["/usr/sbin/modprobe", "sev-guest"],
+      ["/usr/bin/test", "-c", "/dev/sev-guest"]
+    ] : [],
+    [
+      "/usr/bin/curl",
+      "--fail",
+      "--silent",
+      "--show-error",
+      "--location",
+      "https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-x64.zip",
+      "--output",
+      "/run/forgezero-bun.zip"
+    ],
+    ["/usr/bin/sha256sum", "--check", "/etc/forgezero/bun.sha256"],
+    ["/usr/bin/unzip", "-q", "/run/forgezero-bun.zip", "-d", "/run/forgezero-bun"],
+    ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/runtime", agentBun],
+    ["/usr/bin/install", "-m", "0755", "/run/forgezero-bun/bun-linux-x64/bun", "/usr/local/lib/forgezero/runtime/bun"],
+    ["/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"],
+    [
+      "/usr/bin/env",
+      `BUN_INSTALL=${agentBun}`,
+      "/usr/local/bin/bun",
+      "add",
+      "-g",
+      "--no-cache",
+      "--force",
+      `@forgezero/agent@${profile.agentVersion}`
+    ],
+    [
+      "/usr/bin/env",
+      `FZ_API=${profile.apiUrl}`,
+      `OTEL_EXPORTER_OTLP_ENDPOINT=${profile.agentTelemetryEndpoint}`,
+      "FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent",
+      "FZ_AGENT_USER=forgezero-agent",
+      "FZ_SOCKET_PATH=/run/forgezero/vault.sock",
+      "FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred",
+      "FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred",
+      "FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub",
+      "FZ_DEPLOY_ROOT=/opt/forgezero",
+      `FZ_DEPLOY_PULL=${hasEnrolment}`,
+      `FZ_AGENT_EGRESS_ENFORCE=${hasEnrolment}`,
+      `FZ_NODE_LABEL=${nodeLabel}`,
+      `${agentBun}/bin/fz`,
+      "agent",
+      "install",
+      "--apply",
+      ...hasEnrolment ? ["--enrol"] : []
+    ]
+  ];
 }
 function cloudInit(profile, claim, manifest) {
   const enrolled = Boolean(claim.enrolment);
-  const bootstrap = guestBootstrapScript(profile, claim.spec.confidential, enrolled, manifest.name);
+  const bootstrap = guestBootstrapOperations(profile, claim.spec.confidential, enrolled, manifest.name);
   const access = claim.access;
   const users = access ? `users:
   - default
   - name: ${access.sshUser}
     groups: [sudo]
-    shell: /bin/bash
+    shell: /bin/dash
     sudo: ALL=(ALL) NOPASSWD:ALL
     ssh_authorized_keys:
 ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
@@ -385,6 +410,10 @@ ${access.sshPublicKeys.map((key) => `      - ${JSON.stringify(key)}`).join(`
 ` : "";
   const enrolmentFiles = enrolled ? yamlFile("/run/forgezero-enrol-token", `${claim.enrolment.token}
 `, "0600") : "";
+  const attestationFile = claim.spec.confidential ? yamlFile("/etc/modules-load.d/sev-guest.conf", `sev-guest
+`, "0644") : "";
+  const bunChecksum = yamlFile("/etc/forgezero/bun.sha256", `${profile.bunReleaseSha256}  /run/forgezero-bun.zip
+`, "0600");
   return {
     userData: `#cloud-config
 package_update: true
@@ -393,8 +422,9 @@ ${users}disable_root: true
 # every dynamically claimed repository must be cloneable on a clean image.
 packages: [curl, ca-certificates, openssl, openssh-client, git, unzip${claim.spec.confidential ? ", python3" : ""}]
 write_files:
-${enrolmentFiles}${yamlFile("/usr/local/sbin/forgezero-guest-bootstrap", bootstrap, "0700")}runcmd:
-  - [ bash, /usr/local/sbin/forgezero-guest-bootstrap ]
+${enrolmentFiles}${attestationFile}${bunChecksum}runcmd:
+${bootstrap.map((argv) => `  - ${JSON.stringify(argv)}`).join(`
+`)}
 `,
     metaData: `instance-id: ${manifest.name}-${claim.attempt}
 local-hostname: ${manifest.name}
@@ -629,7 +659,7 @@ export {
   provisionMetalGuest,
   macForAddress,
   guestNameFor,
-  guestBootstrapScript,
+  guestBootstrapOperations,
   cloudInit,
   allocateCpuPool,
   allocateAddress,

package/dist/operator-bootstrap.d.ts

@@ -0,0 +1,90 @@
+import { type PlatformGenesisEnvironment } from './platform-genesis';
+export interface OperatorSshHop {
+    address: string;
+    port: number;
+    user: string;
+    hostKey: string;
+    hostKeySha256: string;
+}
+export interface OperatorPlatformBootstrapRequest {
+    kind: 'platform-remote';
+    target: OperatorSshHop & {
+        identityPublicKeyFile: string;
+        agentSocket: string;
+        jump?: OperatorSshHop;
+    };
+    platformConfigFile: string;
+}
+export interface OperatorMetalBootstrapRequest {
+    kind: 'metal-remote';
+    target: OperatorPlatformBootstrapRequest['target'];
+    metalConfigFile: string;
+    genesis: {
+        environment: PlatformGenesisEnvironment;
+        sshPublicKeyFiles: string[];
+    };
+}
+export type OperatorPlatformBootstrapMode = 'prepare' | 'apply' | 'status';
+export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'status';
+export interface OperatorPlatformBootstrapPlan {
+    kind: 'platform-remote';
+    mode: OperatorPlatformBootstrapMode;
+    mutation: boolean;
+    target: {
+        address: string;
+        port: number;
+        user: string;
+        via?: string;
+    };
+    steps: readonly string[];
+    secretInputs: readonly string[];
+}
+export interface OperatorMetalBootstrapPlan {
+    kind: 'metal-remote';
+    mode: OperatorMetalBootstrapMode;
+    mutation: boolean;
+    target: {
+        address: string;
+        port: number;
+        user: string;
+    };
+    steps: readonly string[];
+    genesisNodes: readonly string[];
+    secretInputs: readonly string[];
+}
+export interface OperatorCommandResult {
+    exitCode: number;
+    output: string;
+}
+export type OperatorCommand = (argv: readonly string[], options?: {
+    stdin?: string;
+    secret?: boolean;
+}) => Promise<OperatorCommandResult>;
+export interface OperatorPlatformBootstrapOptions {
+    exec?: OperatorCommand;
+    fetch?: typeof fetch;
+    fzCliPath?: string;
+    fzAgentPath?: string;
+    fzGitSshPath?: string;
+}
+export declare function readOperatorPlatformBootstrapRequest(path: string): OperatorPlatformBootstrapRequest;
+export declare function readOperatorMetalBootstrapRequest(path: string): OperatorMetalBootstrapRequest;
+export declare function planOperatorMetalBootstrap(request: OperatorMetalBootstrapRequest, mode: OperatorMetalBootstrapMode): OperatorMetalBootstrapPlan;
+export declare function planOperatorPlatformBootstrap(request: OperatorPlatformBootstrapRequest, mode: OperatorPlatformBootstrapMode): OperatorPlatformBootstrapPlan;
+/**
+ * Run one reviewed operator action. No private SSH key, credential value or
+ * management token is placed in argv; OpenSSH selects the matching private key
+ * from the caller's approved agent using only its public half.
+ */
+export declare function applyOperatorPlatformBootstrap(request: OperatorPlatformBootstrapRequest, mode: OperatorPlatformBootstrapMode, options?: OperatorPlatformBootstrapOptions): Promise<{
+    plan: OperatorPlatformBootstrapPlan;
+    output: string;
+}>;
+/**
+ * Install/bootstrap one blank metal host or provision its exact three-node
+ * platform seed through the same pinned SSH transport used for guest bootstrap.
+ */
+export declare function applyOperatorMetalBootstrap(request: OperatorMetalBootstrapRequest, mode: OperatorMetalBootstrapMode, options?: OperatorPlatformBootstrapOptions): Promise<{
+    plan: OperatorMetalBootstrapPlan;
+    output: string;
+}>;