mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
15bba26ef3
The readiness module http_ready rendered insecure_skip_verify from
TLS_MODE and lookup('ca_injected', application_id) (#851). The lookup is
true only when Prometheus itself has a domain, TLS and the self-signed
mode, so in a self-signed deployment where Prometheus runs in another
mode the exporter had no CA file and skipped verification. All targets
share the module, so a target with a publicly trusted certificate was
probed without verification too, and anyone on the probe's path could
answer for a failed application.
http_ready now always verifies. A second module, http_ready_private_ca,
skips verification, and only the targets that need it select it: those
in the self-signed mode while the CA is not mounted into Prometheus,
through the __param_module label, which overrides the job's module for
that target. The default self-signed deployment mounts the CA and keeps
every target on the verifying module.
Verified on a local self-signed Tor round, where the CA is mounted:
the rendered blackbox.yml holds http_ready with insecure_skip_verify:
false and http_ready_private_ca with true, and no target of the scrape
configuration carries the module label. All targets of that round are
http onion names, so the https path itself ran only in the unit tests:
tests/unit/python/roles/web-app-prometheus pass, among them a publicly
trusted target that keeps the verifying module while the CA is missing,
a self-signed target that switches to the private-CA module, and the
verifying module rendering insecure_skip_verify: false without the CA.
Against the templates of main the three new cases fail.
Closes #851
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
87 lines
2.8 KiB
Python
87 lines
2.8 KiB
Python
from __future__ import annotations
|
|
|
|
import unittest
|
|
|
|
from jinja2 import Environment, FileSystemLoader, StrictUndefined, select_autoescape
|
|
|
|
from utils.cache.files import PROJECT_ROOT
|
|
from utils.cache.yaml import load_yaml_str
|
|
|
|
TEMPLATE_DIR = PROJECT_ROOT / "roles/web-app-prometheus/templates/configuration"
|
|
|
|
|
|
def ready_module(
|
|
*, name: str, tls_mode: str, prometheus_tls: bool, ca_injected: bool
|
|
) -> dict:
|
|
def lookup(name, *terms):
|
|
if name == "tls" and terms[1] == "enabled":
|
|
return prometheus_tls
|
|
if name == "ca_injected":
|
|
return ca_injected
|
|
raise AssertionError(f"the template calls an unexpected lookup: {name!r}")
|
|
|
|
env = Environment(
|
|
loader=FileSystemLoader(str(TEMPLATE_DIR)),
|
|
undefined=StrictUndefined,
|
|
autoescape=select_autoescape(),
|
|
)
|
|
env.filters["bool"] = bool
|
|
rendered = env.get_template("blackbox.yml.j2").render(
|
|
lookup=lookup,
|
|
application_id="web-app-prometheus",
|
|
TLS_MODE=tls_mode,
|
|
)
|
|
return load_yaml_str(rendered)["modules"][name]["http"]
|
|
|
|
|
|
class TestBlackboxReadyModule(unittest.TestCase):
|
|
def test_an_http_target_passes_while_prometheus_itself_uses_tls(self):
|
|
module = ready_module(
|
|
name="http_ready",
|
|
tls_mode="letsencrypt",
|
|
prometheus_tls=True,
|
|
ca_injected=False,
|
|
)
|
|
self.assertIs(module["fail_if_not_ssl"], False)
|
|
|
|
def test_certificates_are_verified_while_prometheus_itself_has_no_tls(self):
|
|
module = ready_module(
|
|
name="http_ready",
|
|
tls_mode="letsencrypt",
|
|
prometheus_tls=False,
|
|
ca_injected=False,
|
|
)
|
|
self.assertIs(module["tls_config"]["insecure_skip_verify"], False)
|
|
|
|
def test_certificates_are_verified_once_the_private_ca_is_mounted(self):
|
|
module = ready_module(
|
|
name="http_ready",
|
|
tls_mode="self_signed",
|
|
prometheus_tls=True,
|
|
ca_injected=True,
|
|
)
|
|
self.assertIs(module["tls_config"]["insecure_skip_verify"], False)
|
|
|
|
def test_certificates_are_verified_even_without_the_private_ca(self):
|
|
module = ready_module(
|
|
name="http_ready",
|
|
tls_mode="self_signed",
|
|
prometheus_tls=False,
|
|
ca_injected=False,
|
|
)
|
|
self.assertIs(module["tls_config"]["insecure_skip_verify"], False)
|
|
|
|
def test_only_the_private_ca_module_skips_verification(self):
|
|
module = ready_module(
|
|
name="http_ready_private_ca",
|
|
tls_mode="self_signed",
|
|
prometheus_tls=False,
|
|
ca_injected=False,
|
|
)
|
|
self.assertIs(module["tls_config"]["insecure_skip_verify"], True)
|
|
self.assertIs(module["fail_if_not_ssl"], False)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|