diff --git a/.github/workflows/call-test-deploy.yml b/.github/workflows/call-test-deploy.yml index b928c85221..e5510f8cf3 100644 --- a/.github/workflows/call-test-deploy.yml +++ b/.github/workflows/call-test-deploy.yml @@ -342,7 +342,6 @@ jobs: variant: ${{ matrix.variant }} disable: ${{ matrix.disable || inputs.disable }} INFINITO_SWARM_VPN: ${{ matrix.vpn }} - INFINITO_SWARM_SSH_UNDERLAY: ${{ vars.INFINITO_SWARM_SSH_UNDERLAY }} run: ./scripts/tests/deploy/distros.sh "${{ env.SCRIPTS }}/00_one.sh" 2>&1 | tee "/tmp/ansible-${{ matrix.apps }}.log" - name: 🚀 Deploy app diff --git a/cli/administration/inventory/mesh/transport.py b/cli/administration/inventory/mesh/transport.py index 06b44dca8e..89a5f97146 100644 --- a/cli/administration/inventory/mesh/transport.py +++ b/cli/administration/inventory/mesh/transport.py @@ -91,17 +91,9 @@ def switch_to_mesh( user: str, private_key_file: str, application_id: str = DEFAULT_APPLICATION_ID, - addresses: dict[str, str] | None = None, ) -> dict[str, str]: """Point every member of *mesh_name* at its mesh address over SSH. - Args: - addresses: dial these addresses instead of the mesh ones, so a run can - separate the cost of leaving the local connection from the cost of - the tunnel. A member missing from the mapping raises rather than - falling back to its mesh address, which would silently produce the - meshed arm under the other arm's name. - Returns: Host to the address it was switched to. A host with no address on this mesh is left alone -- it is not a member, and rewriting it would @@ -112,10 +104,6 @@ def switch_to_mesh( address = mesh_address(host_vars_dir, host, mesh_name, application_id) if address is None: continue - if addresses is not None: - if host not in addresses: - raise KeyError(f"no address given for mesh member {host!r}") - address = addresses[host] path = host_vars_path(host_vars_dir, host) document = load_document(path) document["ansible_host"] = address diff --git a/default.env b/default.env index ca77fdd8db..d3b590c4eb 100644 --- a/default.env +++ b/default.env @@ -362,9 +362,6 @@ INFINITO_SWARM_NFS_NAME=nfs-server # Process ceiling per DinD node. INFINITO_SWARM_NODE_PIDS_LIMIT=8192 -# 'true' moves a meshed deploy to SSH but keeps the underlay addresses, so a sweep measures the transport apart from the tunnel. -INFINITO_SWARM_SSH_UNDERLAY= - # Ceiling in minutes for one distro's swarm matrix deploy in scripts/tests/deploy/swarm/routine/00_one.sh; swarm's step level. INFINITO_SWARM_STEP_TIMEOUT_MINUTES=350 diff --git a/docs/contributing/tools/github/actions/configuration.md b/docs/contributing/tools/github/actions/configuration.md index a38abc859e..066759cbf0 100644 --- a/docs/contributing/tools/github/actions/configuration.md +++ b/docs/contributing/tools/github/actions/configuration.md @@ -17,7 +17,6 @@ Repository variables are set under **Settings → Secrets and variables → Acti | `API_OPENROUTER_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | The gateway publishes no `openrouter/auto` model | An OpenRouter key | | `INFINITO_MAIL_PRODUCTION_HOST` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | The read-only production mail assertions are skipped, because the task that runs them is gated on this host being set | The public hostname of a deployed mail server, to assert its MX, SPF, DKIM, DMARC and PTR records and its SMTP greeting after a deploy; nothing is sent and nothing is mutated | | `INFINITO_MAIL_PRODUCTION_RESOLVER` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | Those assertions resolve through the runner's own resolver | A DNS server address, to resolve the records against it instead; ignored while `INFINITO_MAIL_PRODUCTION_HOST` is unset | -| `INFINITO_SWARM_SSH_UNDERLAY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | A meshed row moves its transport onto the mesh addresses, so the deploy runs through the tunnel | `true` to move the transport to SSH while leaving `ansible_host` on the underlay. The mesh still comes up and the gate still runs; the tunnel simply carries no deploy traffic, which separates the cost of leaving the local connection from the cost of the tunnel. Set it for a measurement sweep and clear it afterwards; it is not an axis and no row sets it per-row | ## Provider keys: variable or secret? 🔑 diff --git a/scripts/tests/deploy/swarm/routine/00_one.sh b/scripts/tests/deploy/swarm/routine/00_one.sh index dbad2a16c4..be215fdda2 100755 --- a/scripts/tests/deploy/swarm/routine/00_one.sh +++ b/scripts/tests/deploy/swarm/routine/00_one.sh @@ -177,7 +177,6 @@ if [ "$(id -u)" -ne 0 ]; then "variant=${variant:-}" "disable=${disable:-}" "INFINITO_SWARM_VPN=${INFINITO_SWARM_VPN:-}" - "INFINITO_SWARM_SSH_UNDERLAY=${INFINITO_SWARM_SSH_UNDERLAY:-}" "${matrix_cmd[@]}" ) fi diff --git a/tests/unit/python/cli/administration/inventory/mesh/test_transport.py b/tests/unit/python/cli/administration/inventory/mesh/test_transport.py index 7672b36cbe..5a1469e4fd 100644 --- a/tests/unit/python/cli/administration/inventory/mesh/test_transport.py +++ b/tests/unit/python/cli/administration/inventory/mesh/test_transport.py @@ -155,42 +155,6 @@ class TestSwitchingTheTransport(MeshOnDisk, unittest.TestCase): """The first pass is what creates the mesh; there is nothing to move to.""" self.assertEqual(self._switch(), {}) - def test_given_addresses_are_dialled_instead_of_the_mesh_ones(self): - mesh = self._write_swarm() - given = {member.host: f"192.168.244.{index + 10}" for index, member in - enumerate(mesh.members)} - switched = switch_to_mesh( - self.host_vars, - list(HOSTS), - "swarm", - user="administrator", - private_key_file="/tmp/key", - addresses=given, - ) - for host, address in switched.items(): - with self.subTest(host=host): - self.assertEqual(address, given[host]) - text = ( - self.host_vars / "swarm-wrk-01.yml" - ).read_text( # nocheck: cache-read tempdir fixture rewritten between reads in one test - encoding="utf-8" - ) - self.assertIn(f"ansible_host: {given['swarm-wrk-01']}", text) - self.assertIn("ansible_connection: ssh", text) - - def test_a_member_missing_from_the_given_addresses_raises(self): - """Falling back would hand back the meshed arm under the other's name.""" - self._write_swarm() - with self.assertRaises(KeyError): - switch_to_mesh( - self.host_vars, - list(HOSTS), - "swarm", - user="administrator", - private_key_file="/tmp/key", - addresses={}, - ) - def test_the_address_is_only_read_from_the_host_that_owns_it(self): """The swarm reset mirrors one node's host_vars over every other.""" self._write_swarm() diff --git a/utils/env/handlers/passthrough.py b/utils/env/handlers/passthrough.py index 085a096f3c..30561f6881 100644 --- a/utils/env/handlers/passthrough.py +++ b/utils/env/handlers/passthrough.py @@ -43,7 +43,6 @@ STATIC_KEYS = ( "INFINITO_KEEP_SWARM_NODES", "INFINITO_SWARM_TEST_LABEL", "INFINITO_SWARM_VPN", - "INFINITO_SWARM_SSH_UNDERLAY", "INFINITO_VPN", "INFINITO_SWARM_MGR_NAME", "INFINITO_SWARM_STEP_TIMEOUT_MINUTES", diff --git a/utils/tests/swarm/mesh.py b/utils/tests/swarm/mesh.py index 9b55a97f66..78d075b79d 100644 --- a/utils/tests/swarm/mesh.py +++ b/utils/tests/swarm/mesh.py @@ -24,22 +24,14 @@ _LAB_ADDRESSES = { } -def _lab_address_map() -> dict[str, str]: - """Underlay address per lab node name, from the topology default.env names.""" - mapping: dict[str, str] = {} +def _lab_endpoints() -> list[str]: + """`--endpoint` argument per lab node, from the topology default.env names.""" + arguments: list[str] = [] for name_var, address_var in _LAB_ADDRESSES.items(): name = os.environ.get(name_var, "").strip() address = os.environ.get(address_var, "").strip() if name and address: - mapping[name] = address - return mapping - - -def _lab_endpoints() -> list[str]: - """`--endpoint` argument per lab node, from the topology default.env names.""" - arguments: list[str] = [] - for name, address in _lab_address_map().items(): - arguments += ["--endpoint", f"{name}={address}"] + arguments += ["--endpoint", f"{name}={address}"] return arguments @@ -137,17 +129,6 @@ def mesh_controller(*, inv_dir: str) -> int: ) -def ssh_underlay() -> bool: - """Whether this run moves to SSH but stays on the underlay addresses. - - The third arm of the transport comparison: the mesh is up and gated, the - connection is SSH, and the tunnel carries nothing. Against the other two - arms it separates the cost of leaving ``ansible_connection: docker`` from - the cost of the tunnel itself. - """ - return (os.environ.get("INFINITO_SWARM_SSH_UNDERLAY") or "").strip().lower() == "true" - - def switch_to_mesh_transport(*, inv_dir: str) -> int: """Point the inventory at the mesh before the pass that must use it.""" if not mesh_enabled(): @@ -158,17 +139,13 @@ def switch_to_mesh_transport(*, inv_dir: str) -> int: hosts = sorted( path.stem for path in host_vars.glob("*.yml") if path.stem != _CONTROLLER ) - underlay = ssh_underlay() switched = switch_to_mesh( host_vars, hosts, _MESH_NAME, user="administrator", private_key_file=os.environ.get("KEY_PATH") or _DEFAULT_ADMIN_KEY, - addresses=_lab_address_map() if underlay else None, ) - if underlay: - print("[INFO] SSH on the underlay: the tunnel carries no deploy traffic", flush=True) for host, address in sorted(switched.items()): print(f"[INFO] {host}: ansible now connects over {address}", flush=True) if not switched: