From ff1db887537156fdb84f7be36701b8e3745ed7dc Mon Sep 17 00:00:00 2001 From: evangelostsak Date: Fri, 9 Oct 2026 12:12:03 +0200 Subject: [PATCH] revert(swarm-test): remove the SSH-on-underlay measurement arm The arm existed to answer one question: how much of the meshed arm's cost is the connection plugin and how much is the tunnel. Runs 37592061960 (docker), 37753506661 (SSH on the underlay) and 37621556682 (SSH over WireGuard) answered it on web-app-gitea#0, debian/ext4: pass 1 5964s / 8511s / 8832s pass 2 5319s / 7472s / 7705s Leaving ansible_connection: docker costs +4700s, the tunnel +554s - 89.5% against 10.5%. The answer is recorded; the scaffolding does not need to ship. Reverts d792519725, 1b28f87b37, 89b8a8c8d1, 0470491e1a, 529c5ace43, dd3d10a9a2, c20dd0e5f5, 458d8956e1, 63ade1e03b, d281555945 and 4adfb6e3d2. 95cfc8b7b7 is already superseded by bbfd82f89, which sets the profiling limit upstream. --- .github/workflows/call-test-deploy.yml | 1 - .../inventory/mesh/transport.py | 12 ------- default.env | 3 -- .../tools/github/actions/configuration.md | 1 - scripts/tests/deploy/swarm/routine/00_one.sh | 1 - .../inventory/mesh/test_transport.py | 36 ------------------- utils/env/handlers/passthrough.py | 1 - utils/tests/swarm/mesh.py | 31 +++------------- 8 files changed, 4 insertions(+), 82 deletions(-) diff --git a/.github/workflows/call-test-deploy.yml b/.github/workflows/call-test-deploy.yml index b928c85221..e5510f8cf3 100644 --- a/.github/workflows/call-test-deploy.yml +++ b/.github/workflows/call-test-deploy.yml @@ -342,7 +342,6 @@ jobs: variant: ${{ matrix.variant }} disable: ${{ matrix.disable || inputs.disable }} INFINITO_SWARM_VPN: ${{ matrix.vpn }} - INFINITO_SWARM_SSH_UNDERLAY: ${{ vars.INFINITO_SWARM_SSH_UNDERLAY }} run: ./scripts/tests/deploy/distros.sh "${{ env.SCRIPTS }}/00_one.sh" 2>&1 | tee "/tmp/ansible-${{ matrix.apps }}.log" - name: 🚀 Deploy app diff --git a/cli/administration/inventory/mesh/transport.py b/cli/administration/inventory/mesh/transport.py index 06b44dca8e..89a5f97146 100644 --- a/cli/administration/inventory/mesh/transport.py +++ b/cli/administration/inventory/mesh/transport.py @@ -91,17 +91,9 @@ def switch_to_mesh( user: str, private_key_file: str, application_id: str = DEFAULT_APPLICATION_ID, - addresses: dict[str, str] | None = None, ) -> dict[str, str]: """Point every member of *mesh_name* at its mesh address over SSH. - Args: - addresses: dial these addresses instead of the mesh ones, so a run can - separate the cost of leaving the local connection from the cost of - the tunnel. A member missing from the mapping raises rather than - falling back to its mesh address, which would silently produce the - meshed arm under the other arm's name. - Returns: Host to the address it was switched to. A host with no address on this mesh is left alone -- it is not a member, and rewriting it would @@ -112,10 +104,6 @@ def switch_to_mesh( address = mesh_address(host_vars_dir, host, mesh_name, application_id) if address is None: continue - if addresses is not None: - if host not in addresses: - raise KeyError(f"no address given for mesh member {host!r}") - address = addresses[host] path = host_vars_path(host_vars_dir, host) document = load_document(path) document["ansible_host"] = address diff --git a/default.env b/default.env index ca77fdd8db..d3b590c4eb 100644 --- a/default.env +++ b/default.env @@ -362,9 +362,6 @@ INFINITO_SWARM_NFS_NAME=nfs-server # Process ceiling per DinD node. INFINITO_SWARM_NODE_PIDS_LIMIT=8192 -# 'true' moves a meshed deploy to SSH but keeps the underlay addresses, so a sweep measures the transport apart from the tunnel. -INFINITO_SWARM_SSH_UNDERLAY= - # Ceiling in minutes for one distro's swarm matrix deploy in scripts/tests/deploy/swarm/routine/00_one.sh; swarm's step level. INFINITO_SWARM_STEP_TIMEOUT_MINUTES=350 diff --git a/docs/contributing/tools/github/actions/configuration.md b/docs/contributing/tools/github/actions/configuration.md index a38abc859e..066759cbf0 100644 --- a/docs/contributing/tools/github/actions/configuration.md +++ b/docs/contributing/tools/github/actions/configuration.md @@ -17,7 +17,6 @@ Repository variables are set under **Settings → Secrets and variables → Acti | `API_OPENROUTER_KEY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | The gateway publishes no `openrouter/auto` model | An OpenRouter key | | `INFINITO_MAIL_PRODUCTION_HOST` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | The read-only production mail assertions are skipped, because the task that runs them is gated on this host being set | The public hostname of a deployed mail server, to assert its MX, SPF, DKIM, DMARC and PTR records and its SMTP greeting after a deploy; nothing is sent and nothing is mutated | | `INFINITO_MAIL_PRODUCTION_RESOLVER` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | Those assertions resolve through the runner's own resolver | A DNS server address, to resolve the records against it instead; ignored while `INFINITO_MAIL_PRODUCTION_HOST` is unset | -| `INFINITO_SWARM_SSH_UNDERLAY` | [call-test-deploy.yml](../../../../../.github/workflows/call-test-deploy.yml) | A meshed row moves its transport onto the mesh addresses, so the deploy runs through the tunnel | `true` to move the transport to SSH while leaving `ansible_host` on the underlay. The mesh still comes up and the gate still runs; the tunnel simply carries no deploy traffic, which separates the cost of leaving the local connection from the cost of the tunnel. Set it for a measurement sweep and clear it afterwards; it is not an axis and no row sets it per-row | ## Provider keys: variable or secret? 🔑 diff --git a/scripts/tests/deploy/swarm/routine/00_one.sh b/scripts/tests/deploy/swarm/routine/00_one.sh index dbad2a16c4..be215fdda2 100755 --- a/scripts/tests/deploy/swarm/routine/00_one.sh +++ b/scripts/tests/deploy/swarm/routine/00_one.sh @@ -177,7 +177,6 @@ if [ "$(id -u)" -ne 0 ]; then "variant=${variant:-}" "disable=${disable:-}" "INFINITO_SWARM_VPN=${INFINITO_SWARM_VPN:-}" - "INFINITO_SWARM_SSH_UNDERLAY=${INFINITO_SWARM_SSH_UNDERLAY:-}" "${matrix_cmd[@]}" ) fi diff --git a/tests/unit/python/cli/administration/inventory/mesh/test_transport.py b/tests/unit/python/cli/administration/inventory/mesh/test_transport.py index 7672b36cbe..5a1469e4fd 100644 --- a/tests/unit/python/cli/administration/inventory/mesh/test_transport.py +++ b/tests/unit/python/cli/administration/inventory/mesh/test_transport.py @@ -155,42 +155,6 @@ class TestSwitchingTheTransport(MeshOnDisk, unittest.TestCase): """The first pass is what creates the mesh; there is nothing to move to.""" self.assertEqual(self._switch(), {}) - def test_given_addresses_are_dialled_instead_of_the_mesh_ones(self): - mesh = self._write_swarm() - given = {member.host: f"192.168.244.{index + 10}" for index, member in - enumerate(mesh.members)} - switched = switch_to_mesh( - self.host_vars, - list(HOSTS), - "swarm", - user="administrator", - private_key_file="/tmp/key", - addresses=given, - ) - for host, address in switched.items(): - with self.subTest(host=host): - self.assertEqual(address, given[host]) - text = ( - self.host_vars / "swarm-wrk-01.yml" - ).read_text( # nocheck: cache-read tempdir fixture rewritten between reads in one test - encoding="utf-8" - ) - self.assertIn(f"ansible_host: {given['swarm-wrk-01']}", text) - self.assertIn("ansible_connection: ssh", text) - - def test_a_member_missing_from_the_given_addresses_raises(self): - """Falling back would hand back the meshed arm under the other's name.""" - self._write_swarm() - with self.assertRaises(KeyError): - switch_to_mesh( - self.host_vars, - list(HOSTS), - "swarm", - user="administrator", - private_key_file="/tmp/key", - addresses={}, - ) - def test_the_address_is_only_read_from_the_host_that_owns_it(self): """The swarm reset mirrors one node's host_vars over every other.""" self._write_swarm() diff --git a/utils/env/handlers/passthrough.py b/utils/env/handlers/passthrough.py index 085a096f3c..30561f6881 100644 --- a/utils/env/handlers/passthrough.py +++ b/utils/env/handlers/passthrough.py @@ -43,7 +43,6 @@ STATIC_KEYS = ( "INFINITO_KEEP_SWARM_NODES", "INFINITO_SWARM_TEST_LABEL", "INFINITO_SWARM_VPN", - "INFINITO_SWARM_SSH_UNDERLAY", "INFINITO_VPN", "INFINITO_SWARM_MGR_NAME", "INFINITO_SWARM_STEP_TIMEOUT_MINUTES", diff --git a/utils/tests/swarm/mesh.py b/utils/tests/swarm/mesh.py index 9b55a97f66..78d075b79d 100644 --- a/utils/tests/swarm/mesh.py +++ b/utils/tests/swarm/mesh.py @@ -24,22 +24,14 @@ _LAB_ADDRESSES = { } -def _lab_address_map() -> dict[str, str]: - """Underlay address per lab node name, from the topology default.env names.""" - mapping: dict[str, str] = {} +def _lab_endpoints() -> list[str]: + """`--endpoint` argument per lab node, from the topology default.env names.""" + arguments: list[str] = [] for name_var, address_var in _LAB_ADDRESSES.items(): name = os.environ.get(name_var, "").strip() address = os.environ.get(address_var, "").strip() if name and address: - mapping[name] = address - return mapping - - -def _lab_endpoints() -> list[str]: - """`--endpoint` argument per lab node, from the topology default.env names.""" - arguments: list[str] = [] - for name, address in _lab_address_map().items(): - arguments += ["--endpoint", f"{name}={address}"] + arguments += ["--endpoint", f"{name}={address}"] return arguments @@ -137,17 +129,6 @@ def mesh_controller(*, inv_dir: str) -> int: ) -def ssh_underlay() -> bool: - """Whether this run moves to SSH but stays on the underlay addresses. - - The third arm of the transport comparison: the mesh is up and gated, the - connection is SSH, and the tunnel carries nothing. Against the other two - arms it separates the cost of leaving ``ansible_connection: docker`` from - the cost of the tunnel itself. - """ - return (os.environ.get("INFINITO_SWARM_SSH_UNDERLAY") or "").strip().lower() == "true" - - def switch_to_mesh_transport(*, inv_dir: str) -> int: """Point the inventory at the mesh before the pass that must use it.""" if not mesh_enabled(): @@ -158,17 +139,13 @@ def switch_to_mesh_transport(*, inv_dir: str) -> int: hosts = sorted( path.stem for path in host_vars.glob("*.yml") if path.stem != _CONTROLLER ) - underlay = ssh_underlay() switched = switch_to_mesh( host_vars, hosts, _MESH_NAME, user="administrator", private_key_file=os.environ.get("KEY_PATH") or _DEFAULT_ADMIN_KEY, - addresses=_lab_address_map() if underlay else None, ) - if underlay: - print("[INFO] SSH on the underlay: the tunnel carries no deploy traffic", flush=True) for host, address in sorted(switched.items()): print(f"[INFO] {host}: ansible now connects over {address}", flush=True) if not switched: