Merge remote-tracking branch 'origin/main' into feature/designer

tests/unit/python/plugins/filter/test_native_metrics_target.py

@@ -1,111 +0,0 @@
-from __future__ import annotations
-
-import unittest
-from unittest.mock import patch
-
-from ansible.errors import AnsibleFilterError
-
-from plugins.filter.native_metrics_target import native_metrics_target
-
-
-def _make_applications(
-    app_id: str,
-    container: str,
-    port: int,
-    entity_name: str,
-    service_key: str | None = None,
-) -> dict:
-    native_metrics: dict = {"port": port}
-    if service_key is not None:
-        native_metrics["service_key"] = service_key
-    return {
-        app_id: {
-            "services": {
-                entity_name: {"name": container},
-                "prometheus": {"native_metrics": native_metrics},
-            }
-        }
-    }
-
-
-class TestNativeMetricsTargetSuccess(unittest.TestCase):
-    def test_returns_container_colon_port(self):
-        apps = _make_applications("web-app-gitea", "gitea", 3000, "gitea")
-        with patch(
-            "plugins.filter.native_metrics_target.get_entity_name", return_value="gitea"
-        ):
-            result = native_metrics_target("web-app-gitea", apps)
-        self.assertEqual(result, "gitea:3000")
-
-    def test_different_app(self):
-        apps = _make_applications(
-            "web-app-mattermost", "mattermost", 8067, "mattermost"
-        )
-        with patch(
-            "plugins.filter.native_metrics_target.get_entity_name",
-            return_value="mattermost",
-        ):
-            result = native_metrics_target("web-app-mattermost", apps)
-        self.assertEqual(result, "mattermost:8067")
-
-    def test_service_key_override(self):
-        apps = _make_applications(
-            "web-app-matrix", "matrix-synapse", 9000, "synapse", service_key="synapse"
-        )
-        with patch(
-            "plugins.filter.native_metrics_target.get_entity_name",
-            return_value="matrix",
-        ):
-            result = native_metrics_target("web-app-matrix", apps)
-        self.assertEqual(result, "matrix-synapse:9000")
-
-
-class TestNativeMetricsTargetErrors(unittest.TestCase):
-    def test_raises_when_container_name_missing(self):
-        apps = {
-            "web-app-gitea": {
-                "services": {
-                    "prometheus": {"native_metrics": {"port": 3000}},
-                }
-            }
-        }
-        with (
-            patch(
-                "plugins.filter.native_metrics_target.get_entity_name",
-                return_value="gitea",
-            ),
-            self.assertRaises(AnsibleFilterError),
-        ):
-            native_metrics_target("web-app-gitea", apps)
-
-    def test_raises_when_port_missing(self):
-        apps = {
-            "web-app-gitea": {
-                "services": {
-                    "gitea": {"name": "gitea"},
-                    "prometheus": {"native_metrics": {}},
-                }
-            }
-        }
-        with (
-            patch(
-                "plugins.filter.native_metrics_target.get_entity_name",
-                return_value="gitea",
-            ),
-            self.assertRaises(AnsibleFilterError),
-        ):
-            native_metrics_target("web-app-gitea", apps)
-
-    def test_raises_when_app_not_in_applications(self):
-        with (
-            patch(
-                "plugins.filter.native_metrics_target.get_entity_name",
-                return_value="gitea",
-            ),
-            self.assertRaises(AnsibleFilterError),
-        ):
-            native_metrics_target("web-app-gitea", {})
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/unit/python/plugins/lookup/test_engine_redis_session_path.py

@@ -0,0 +1,51 @@
+"""phpredis reads ``auth[user]``/``auth[pass]`` and ``prefix`` from the query of
+``session.save_path``; a password with a reserved character that is not
+percent-encoded splits the query and the handler authenticates with a fragment.
+"""
+
+from __future__ import annotations
+
+import importlib
+import unittest
+from urllib.parse import parse_qs, urlsplit
+
+plugin_module = importlib.import_module("plugins.lookup.engine")
+redis_session_path = plugin_module.redis_session_path
+
+
+class TestRedisSessionPath(unittest.TestCase):
+    def test_an_embedded_sidecar_gets_no_credentials(self) -> None:
+        self.assertEqual(
+            "tcp://redis:6379?prefix=suitecrm:session:",
+            redis_session_path("redis", 6379, "suitecrm", "", ""),
+        )
+
+    def test_a_shared_redis_gets_user_and_password(self) -> None:
+        query = parse_qs(
+            urlsplit(
+                redis_session_path("redis-central", 6379, "suitecrm", "default", "pw")
+            ).query
+        )
+        self.assertEqual(["default"], query["auth[user]"])
+        self.assertEqual(["pw"], query["auth[pass]"])
+
+    def test_a_password_with_reserved_characters_survives_the_query(self) -> None:
+        password = "a&b=c?d#e/f+g h"
+        query = parse_qs(
+            urlsplit(
+                redis_session_path(
+                    "redis-central", 6379, "suitecrm", "default", password
+                )
+            ).query
+        )
+        self.assertEqual([password], query["auth[pass]"])
+        self.assertEqual(["suitecrm:session:"], query["prefix"])
+
+    def test_a_user_without_a_password_is_not_sent(self) -> None:
+        self.assertNotIn(
+            "auth", redis_session_path("redis", 6379, "suitecrm", "default", "")
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/plugins/lookup/test_native_metrics_target.py

@@ -0,0 +1,119 @@
+"""Tests for the native_metrics_target lookup.
+
+The lookup delegates host resolution to scrape_target, so these run the real
+scrape_target rather than a stub: the regression being guarded is that swarm
+must not receive a compose container name, and only the delegation proves it.
+"""
+
+from __future__ import annotations
+
+import unittest
+from typing import Any
+from unittest.mock import MagicMock, patch
+
+from ansible.errors import AnsibleError
+
+from plugins.lookup.native_metrics_target import LookupModule
+from plugins.lookup.scrape_target import LookupModule as ScrapeTargetLookup
+
+ENTITIES = {"web-app-matrix": "matrix", "web-app-gitea": "gitea"}
+
+
+class _Templar:
+    def __init__(self, vars_=None):
+        self.available_variables = vars_ or {}
+
+    def template(self, value, **_):
+        return value
+
+
+def _apps(native_metrics: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "web-app-matrix": {
+            "services": {
+                "prometheus": {"native_metrics": native_metrics},
+                "synapse": {
+                    "name": "matrix-synapse",
+                    "ports": {"internal": {"http": 8008}},
+                },
+            },
+        },
+    }
+
+
+def _run(terms, *, mode, apps):
+    variables = {"DEPLOYMENT_MODE": mode}
+    lookup = LookupModule()
+    lookup._templar = _Templar(variables)
+    lookup._loader = MagicMock()
+
+    def _dispatch(name, **_kwargs):
+        if name == "applications":
+            return MagicMock(run=lambda *_a, **_k: [apps])
+        scrape = ScrapeTargetLookup()
+        scrape._templar = _Templar(variables)
+        scrape._loader = MagicMock()
+        return scrape
+
+    with (
+        patch(
+            "plugins.lookup.native_metrics_target.lookup_loader"
+        ) as native_loader_mock,
+        patch("plugins.lookup.scrape_target.lookup_loader") as scrape_loader_mock,
+        patch(
+            "plugins.lookup.native_metrics_target.get_entity_name",
+            side_effect=lambda app_id: ENTITIES.get(app_id, ""),
+        ),
+        patch(
+            "plugins.lookup.scrape_target.get_entity_name",
+            side_effect=lambda app_id: ENTITIES.get(app_id, ""),
+        ),
+    ):
+        native_loader_mock.get.side_effect = _dispatch
+        scrape_loader_mock.get.return_value = MagicMock(run=lambda *_a, **_k: [apps])
+        return lookup.run(terms, variables=variables)
+
+
+class TestNativeMetricsTargetLookup(unittest.TestCase):
+    def test_swarm_uses_per_task_dns_not_the_container_name(self):
+        apps = _apps({"port": 9000, "service_key": "synapse"})
+        result = _run(["web-app-matrix"], mode="swarm", apps=apps)
+        self.assertEqual(result, ["tasks.matrix_synapse:9000"])
+
+    def test_compose_uses_the_container_name(self):
+        apps = _apps({"port": 9000, "service_key": "synapse"})
+        result = _run(["web-app-matrix"], mode="compose", apps=apps)
+        self.assertEqual(result, ["matrix-synapse:9000"])
+
+    def test_service_key_defaults_to_the_entity_name(self):
+        apps = {
+            "web-app-gitea": {
+                "services": {
+                    "prometheus": {"native_metrics": {"port": 3000}},
+                    "gitea": {
+                        "name": "gitea",
+                        "ports": {"internal": {"http": 3000}},
+                    },
+                },
+            },
+        }
+        result = _run(["web-app-gitea"], mode="swarm", apps=apps)
+        self.assertEqual(result, ["tasks.gitea_gitea:3000"])
+
+    def test_native_metrics_port_takes_precedence_over_the_internal_port(self):
+        apps = _apps({"port": 9000, "service_key": "synapse"})
+        result = _run(["web-app-matrix"], mode="compose", apps=apps)
+        self.assertNotIn("8008", result[0])
+
+    def test_missing_port_raises(self):
+        apps = _apps({"service_key": "synapse"})
+        with self.assertRaises(AnsibleError):
+            _run(["web-app-matrix"], mode="compose", apps=apps)
+
+    def test_missing_application_id_raises(self):
+        with self.assertRaises(AnsibleError):
+            _run([], mode="compose", apps=_apps({"port": 9000}))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/roles/web-app-prometheus/test_blackbox_ready_module.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import unittest
+
+from jinja2 import Environment, FileSystemLoader, StrictUndefined, select_autoescape
+
+from utils.cache.files import PROJECT_ROOT
+from utils.cache.yaml import load_yaml_str
+
+TEMPLATE_DIR = PROJECT_ROOT / "roles/web-app-prometheus/templates/configuration"
+
+
+def ready_module(*, tls_mode: str, prometheus_tls: bool, ca_injected: bool) -> dict:
+    def lookup(name, *terms):
+        if name == "tls" and terms[1] == "enabled":
+            return prometheus_tls
+        if name == "ca_injected":
+            return ca_injected
+        raise AssertionError(f"the template calls an unexpected lookup: {name!r}")
+
+    env = Environment(
+        loader=FileSystemLoader(str(TEMPLATE_DIR)),
+        undefined=StrictUndefined,
+        autoescape=select_autoescape(),
+    )
+    env.filters["bool"] = bool
+    rendered = env.get_template("blackbox.yml.j2").render(
+        lookup=lookup,
+        application_id="web-app-prometheus",
+        TLS_MODE=tls_mode,
+    )
+    return load_yaml_str(rendered)["modules"]["http_ready"]["http"]
+
+
+class TestBlackboxReadyModule(unittest.TestCase):
+    def test_an_http_target_passes_while_prometheus_itself_uses_tls(self):
+        module = ready_module(
+            tls_mode="letsencrypt", prometheus_tls=True, ca_injected=False
+        )
+        self.assertIs(module["fail_if_not_ssl"], False)
+
+    def test_certificates_are_verified_while_prometheus_itself_has_no_tls(self):
+        module = ready_module(
+            tls_mode="letsencrypt", prometheus_tls=False, ca_injected=False
+        )
+        self.assertIs(module["tls_config"]["insecure_skip_verify"], False)
+
+    def test_certificates_are_verified_once_the_private_ca_is_mounted(self):
+        module = ready_module(
+            tls_mode="self_signed", prometheus_tls=True, ca_injected=True
+        )
+        self.assertIs(module["tls_config"]["insecure_skip_verify"], False)
+
+    def test_verification_is_skipped_only_without_the_private_ca(self):
+        module = ready_module(
+            tls_mode="self_signed", prometheus_tls=False, ca_injected=False
+        )
+        self.assertIs(module["tls_config"]["insecure_skip_verify"], True)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/python/roles/web-app-prometheus/test_blackbox_targets.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+import unittest
+
+from jinja2 import Environment, FileSystemLoader, StrictUndefined, select_autoescape
+
+from utils.cache.files import PROJECT_ROOT
+from utils.cache.yaml import load_yaml_str
+
+TEMPLATE_DIR = PROJECT_ROOT / "roles/web-app-prometheus/templates/configuration"
+ONION = "a" * 56 + ".onion"
+
+DOMAINS = {
+    "web-app-prometheus": [f"prometheus.{ONION}"],
+    "web-app-nextcloud": {"nextcloud": f"next.cloud.{ONION}"},
+    "web-app-gitea": ["git.infinito.test"],
+    "web-svc-cdn": ["cdn.infinito.test"],
+    "svc-db-postgres": ["postgres.infinito.test"],
+}
+ROLES_WITH_THE_PROMETHEUS_SERVICE = ["web-app-nextcloud", "web-app-gitea"]
+
+
+def lookup(name, *terms, **_kwargs):
+    if name == "domains":
+        return DOMAINS
+    if name == "roles_with_service":
+        return [{"id": role} for role in ROLES_WITH_THE_PROMETHEUS_SERVICE]
+    if name == "tls":
+        term, want = terms
+        scheme = "http" if term.endswith(".onion") else "https"
+        return {
+            "url.base": f"{scheme}://{term}/",
+            "protocols.web": "http",
+            "enabled": False,
+        }[want]
+    if name == "domain":
+        return DOMAINS[terms[0]][0]
+    if name == "scrape_target":
+        return f"{terms[1]}:9000"
+    if name == "native_metrics_apps":
+        return []
+    raise AssertionError(f"the template calls an unexpected lookup: {name!r}")
+
+
+def probed_targets() -> dict[str, list[str]]:
+    env = Environment(
+        loader=FileSystemLoader(str(TEMPLATE_DIR)),
+        undefined=StrictUndefined,
+        autoescape=select_autoescape(),
+    )
+    env.filters["bool"] = bool
+    rendered = env.get_template("prometheus.yml.j2").render(
+        lookup=lookup,
+        application_id="web-app-prometheus",
+        CURRENT_PLAY_APPLICATIONS=list(DOMAINS),
+        DOMAIN_PRIMARY="infinito.test",
+        ALERT_RULES_CONFIG_DOCKER="/etc/prometheus/alert_rules.yml",
+    )
+    jobs = {job["job_name"]: job for job in load_yaml_str(rendered)["scrape_configs"]}
+    return {
+        group["labels"]["app"]: group["targets"]
+        for group in jobs["blackbox-healthz"]["static_configs"]
+    }
+
+
+class TestBlackboxTargets(unittest.TestCase):
+    def test_an_onion_app_is_probed_under_its_onion_name_over_http(self):
+        self.assertEqual(
+            probed_targets()["web-app-nextcloud"],
+            [f"http://next.cloud.{ONION}/healthz/ready"],
+        )
+
+    def test_a_clearnet_app_is_probed_under_its_own_scheme(self):
+        self.assertEqual(
+            probed_targets()["web-app-gitea"],
+            ["https://git.infinito.test/healthz/ready"],
+        )
+
+    def test_only_the_roles_the_service_lookup_names_are_probed(self):
+        self.assertEqual(set(probed_targets()), set(ROLES_WITH_THE_PROMETHEUS_SERVICE))
+
+
+if __name__ == "__main__":
+    unittest.main()