mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5
f46c4d0bab
A swarm job lost every published port of the mail stack without anything reporting it. dockerd aborted the whole ingress program: Failed to add ingress: failed to program ingress ports: failed to bind host port 0.0.0.0:995/tcp: address already in use /proc/net/tcp named the squatter: 10.100.1.1:995 -> 10.100.1.11:2049, the node's own NFS client. The mount carries no noresvport, so the kernel drew a source port from the 665-1023 reserved window and landed on pop3s. Afterwards none of 25/465/993/995/4190/8095 was bound while a sibling service's port was, and stalwart still reported 1/1 healthy because its healthcheck runs inside the container. The e2e CLI probe found it two hours later as ECONNREFUSED on SMTP 25. 993 and 995 are the only published ports repository-wide inside that window, so this is luck of the draw on any NFS-backed swarm host that runs the mail role. insecure on the kernel export is not separate hygiene, it is the other half: kernel nfsd defaults to secure and answers a mount from an unprivileged source port with EACCES, so noresvport without it would break every kernel-flavor mount. It reaches the kernel flavor only, since templates/exports.j2 is reached from tasks/flavor/kernel/main.yml alone. The ganesha flavor needs nothing: ganesha.conf.j2 sets no Privileged_Port and the default already accepts unprivileged clients. What it costs: the next deploy of every existing NFS client sees a pending opts change and remounts the shared state. The role already anticipates that, releasing DIR_BACKUPS first when the check-mode probe reports a change. Nothing bind-mounts that path into a container, so the exposure is a host-side job holding it at that instant, which fails loudly rather than silently. Not yet proven in effect: a source port is chosen when the RPC connection is established, so a plain remount can leave a running mount on its old reserved port until the next real mount. Reading /proc/net/tcp after the first deploy on an existing client is what confirms it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
110 lines
3.7 KiB
Python
110 lines
3.7 KiB
Python
import importlib.util
|
|
import unittest
|
|
import unittest.mock as mock
|
|
|
|
from ansible.parsing.dataloader import DataLoader
|
|
from ansible.template import Templar
|
|
|
|
from utils.storage.nfs import client_src, state_path
|
|
|
|
|
|
def _run(name, variables):
|
|
"""Lookups must read resolved values from `variables`; templar.template('{{..}}')
|
|
no-ops on untrusted strings in ansible 2.19+ and emits literal Jinja into exports."""
|
|
spec = importlib.util.spec_from_file_location(name, f"plugins/lookup/{name}.py")
|
|
m = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(m)
|
|
lm = m.LookupModule()
|
|
lm._templar = Templar(loader=DataLoader(), variables=variables)
|
|
return lm.run([], variables=variables)[0]
|
|
|
|
|
|
BASE = {
|
|
"storage": {"nfs": {"server": "192.168.244.2"}},
|
|
"RUNTIME": "github",
|
|
}
|
|
|
|
|
|
class TestNfsLookups(unittest.TestCase):
|
|
def test_state_path_renders(self):
|
|
self.assertEqual(_run("nfs_state_path", BASE), "/srv/nfs/infinito-state")
|
|
|
|
def test_fstype_renders(self):
|
|
self.assertEqual(_run("nfs_fstype", BASE), "nfs4")
|
|
|
|
def test_mount_opts_github_soft(self):
|
|
self.assertEqual(
|
|
_run("nfs_mount_opts", BASE),
|
|
"vers=4,rw,noresvport,soft,timeo=50,retrans=3",
|
|
)
|
|
|
|
def test_mount_opts_host_hard(self):
|
|
self.assertEqual(
|
|
_run("nfs_mount_opts", {**BASE, "RUNTIME": "host"}),
|
|
"vers=4,rw,noresvport,hard,timeo=600",
|
|
)
|
|
|
|
def test_mount_opts_act_soft(self):
|
|
self.assertEqual(
|
|
_run("nfs_mount_opts", {**BASE, "RUNTIME": "act"}),
|
|
"vers=4,rw,noresvport,soft,timeo=50,retrans=3",
|
|
)
|
|
|
|
|
|
def _load(name, variables):
|
|
spec = importlib.util.spec_from_file_location(name, f"plugins/lookup/{name}.py")
|
|
m = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(m)
|
|
lm = m.LookupModule()
|
|
lm._templar = Templar(loader=DataLoader(), variables=variables)
|
|
lm._loader = DataLoader()
|
|
return m, lm
|
|
|
|
|
|
class TestNfsConfigBackedLookups(unittest.TestCase):
|
|
"""nfs_flavor / nfs_client_src reach the merged-config SPOT through
|
|
lookup('config') via lookup_loader, NOT a utils.cache import."""
|
|
|
|
def test_flavor_returns_config_lookup_result(self):
|
|
m, lm = _load("nfs_flavor", {})
|
|
with mock.patch.object(m, "lookup_loader") as loader:
|
|
loader.get.return_value = mock.MagicMock(run=lambda *a, **k: ["ganesha"])
|
|
self.assertEqual(lm.run([], variables={}), ["ganesha"])
|
|
|
|
def test_flavor_config_call_shape(self):
|
|
m, lm = _load("nfs_flavor", {})
|
|
calls = []
|
|
|
|
def _run(args, **kwargs):
|
|
calls.append((tuple(args), kwargs))
|
|
return ["kernel"]
|
|
|
|
with mock.patch.object(m, "lookup_loader") as loader:
|
|
loader.get.return_value = mock.MagicMock(run=_run)
|
|
lm.run([], variables={"RUNTIME": "github"})
|
|
(args, kwargs) = calls[0]
|
|
self.assertEqual(
|
|
args,
|
|
("svc-storage-nfs-server", "services.nfs-server.flavor", "kernel"),
|
|
)
|
|
self.assertEqual(kwargs.get("variables"), {"RUNTIME": "github"})
|
|
|
|
def test_client_src_kernel_v4_uses_root_mount(self):
|
|
nfs = {"server": "10.0.0.2"}
|
|
vars_ = {"storage": {"nfs": nfs}}
|
|
m, lm = _load("nfs_client_src", vars_)
|
|
with mock.patch.object(m, "lookup_loader") as loader:
|
|
loader.get.return_value = mock.MagicMock(run=lambda *a, **k: ["kernel"])
|
|
result = lm.run([], variables=vars_)
|
|
expected = client_src(
|
|
"10.0.0.2",
|
|
4,
|
|
"kernel",
|
|
state_path("/srv/nfs", "infinito-state"),
|
|
)
|
|
self.assertEqual(result, [expected])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|