459 lines
17 KiB
Python
459 lines
17 KiB
Python
"""Contracts for the read-only leoclean GCP staging preflight."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import copy
|
|
import hashlib
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
from collections.abc import Callable
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from ops import check_gcp_leoclean_nosend_preflight as preflight
|
|
|
|
REVISION = "a" * 40
|
|
PRIVATE_IP = "10.61.0.3"
|
|
|
|
|
|
def live_fixtures() -> dict[str, object]:
|
|
return {
|
|
"project": {"lifecycleState": "ACTIVE", "projectId": "teleo-501523"},
|
|
"instance": {
|
|
"name": "teleo-staging-1",
|
|
"status": "RUNNING",
|
|
"zone": "https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a",
|
|
"machineType": (
|
|
"https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a/"
|
|
"machineTypes/e2-standard-4"
|
|
),
|
|
"cpuPlatform": "Intel Broadwell",
|
|
"serviceAccounts": [
|
|
{"email": "sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com"}
|
|
],
|
|
"disks": [
|
|
{
|
|
"boot": True,
|
|
"source": (
|
|
"https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a/"
|
|
"disks/teleo-staging-1"
|
|
),
|
|
}
|
|
],
|
|
"networkInterfaces": [
|
|
{
|
|
"network": (
|
|
"https://www.googleapis.com/compute/v1/projects/teleo-501523/global/networks/teleo-staging-net"
|
|
),
|
|
"subnetwork": (
|
|
"https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6/"
|
|
"subnetworks/teleo-staging-europe-west6"
|
|
),
|
|
"networkIP": "10.60.0.2",
|
|
"accessConfigs": [],
|
|
"ipv6AccessConfigs": [],
|
|
"stackType": "IPV4_ONLY",
|
|
}
|
|
],
|
|
"tags": {"items": ["teleo-staging-ssh"]},
|
|
},
|
|
"disk": {
|
|
"name": "teleo-staging-1",
|
|
"status": "READY",
|
|
"sizeGb": "80",
|
|
"zone": "https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a",
|
|
"architecture": "X86_64",
|
|
"users": [
|
|
"https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a/"
|
|
"instances/teleo-staging-1"
|
|
],
|
|
},
|
|
"subnet": {
|
|
"name": "teleo-staging-europe-west6",
|
|
"region": "https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6",
|
|
"network": "https://www.googleapis.com/compute/v1/projects/teleo-501523/global/networks/teleo-staging-net",
|
|
"ipCidrRange": "10.60.0.0/20",
|
|
"privateIpGoogleAccess": True,
|
|
},
|
|
"artifact": {
|
|
"name": "projects/teleo-501523/locations/europe-west6/repositories/teleo",
|
|
"format": "DOCKER",
|
|
"mode": "STANDARD_REPOSITORY",
|
|
"dockerConfig": {"immutableTags": True},
|
|
},
|
|
"cloudsql": {
|
|
"name": "teleo-pgvector-standby",
|
|
"state": "RUNNABLE",
|
|
"region": "europe-west6",
|
|
"databaseVersion": "POSTGRES_16",
|
|
"ipAddresses": [{"type": "PRIVATE", "ipAddress": PRIVATE_IP}],
|
|
"settings": {
|
|
"ipConfiguration": {
|
|
"ipv4Enabled": False,
|
|
"privateNetwork": "projects/teleo-501523/global/networks/teleo-staging-net",
|
|
"sslMode": "ENCRYPTED_ONLY",
|
|
}
|
|
},
|
|
},
|
|
"host": {
|
|
"architecture": "x86_64",
|
|
"project": "teleo-501523",
|
|
"instance": "teleo-staging-1",
|
|
"service_account": "sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com",
|
|
"docker_server_version": "29.4.0",
|
|
"docker_server_os": "linux",
|
|
"docker_server_arch": "amd64",
|
|
"docker_root_free_bytes": str(20 * 1024**3),
|
|
"unit_load_state": "not-found",
|
|
"container_collision_count": "0",
|
|
"cloudsql_tcp": "reachable",
|
|
},
|
|
}
|
|
|
|
|
|
def fixture_runner(
|
|
values: dict[str, object],
|
|
calls: list[list[str]] | None = None,
|
|
) -> Callable[[list[str]], subprocess.CompletedProcess[str]]:
|
|
def run(argv: list[str]) -> subprocess.CompletedProcess[str]:
|
|
if calls is not None:
|
|
calls.append(argv)
|
|
if argv[:3] == ["gcloud", "projects", "describe"]:
|
|
value: object = values["project"]
|
|
elif argv[:4] == ["gcloud", "compute", "instances", "describe"]:
|
|
value = values["instance"]
|
|
elif argv[:4] == ["gcloud", "compute", "disks", "describe"]:
|
|
value = values["disk"]
|
|
elif argv[:5] == ["gcloud", "compute", "networks", "subnets", "describe"]:
|
|
value = values["subnet"]
|
|
elif argv[:4] == ["gcloud", "artifacts", "repositories", "describe"]:
|
|
value = values["artifact"]
|
|
elif argv[:4] == ["gcloud", "sql", "instances", "describe"]:
|
|
value = values["cloudsql"]
|
|
elif argv[:3] == ["gcloud", "compute", "ssh"]:
|
|
host = values["host"]
|
|
assert isinstance(host, dict)
|
|
output = "".join(f"{key}={item}\n" for key, item in host.items())
|
|
return subprocess.CompletedProcess(argv, 0, stdout=output, stderr="")
|
|
else: # pragma: no cover - the assertion shows unexpected command drift
|
|
raise AssertionError(argv)
|
|
return subprocess.CompletedProcess(argv, 0, stdout=json.dumps(value), stderr="")
|
|
|
|
return run
|
|
|
|
|
|
def test_exact_read_only_preflight_passes_without_exposing_private_ip() -> None:
|
|
calls: list[list[str]] = []
|
|
payload = preflight.build_preflight(runner=fixture_runner(live_fixtures(), calls), source_revision=REVISION)
|
|
|
|
assert payload["status"] == "pass"
|
|
assert payload["source_revision"] == REVISION
|
|
assert payload["target"] == {
|
|
"project": "teleo-501523",
|
|
"zone": "europe-west6-a",
|
|
"instance": "teleo-staging-1",
|
|
"service": "leoclean-gcp-nosend.service",
|
|
"container": "livingip-leoclean-nosend",
|
|
"platform": "linux/amd64",
|
|
}
|
|
assert payload["authority"] == {
|
|
"mode": "bounded_observation_preflight",
|
|
"secret_values_read": False,
|
|
"database_credentials_used": False,
|
|
"database_queries_run": False,
|
|
"control_plane_observations_before_ssh_are_describe_only": True,
|
|
"remote_host_runtime_mutations": False,
|
|
"ssh_access_may_register_time_bounded_key": True,
|
|
"ssh_key_maximum_lifetime": "5m",
|
|
}
|
|
assert payload["host"]["cloudsql_private_tcp_5432"] == "reachable"
|
|
assert payload["control_plane"]["cloudsql"]["private_ip_sha256"] == hashlib.sha256(
|
|
PRIVATE_IP.encode("ascii")
|
|
).hexdigest()
|
|
assert PRIVATE_IP not in json.dumps(payload)
|
|
assert len(calls) == 7
|
|
assert calls[:-1] == [
|
|
[
|
|
"gcloud",
|
|
"sql",
|
|
"instances",
|
|
"describe",
|
|
"teleo-pgvector-standby",
|
|
"--project",
|
|
"teleo-501523",
|
|
"--format=json(name,state,region,databaseVersion,ipAddresses,settings.ipConfiguration)",
|
|
],
|
|
[
|
|
"gcloud",
|
|
"projects",
|
|
"describe",
|
|
"teleo-501523",
|
|
"--format=json(projectId,lifecycleState)",
|
|
],
|
|
[
|
|
"gcloud",
|
|
"compute",
|
|
"instances",
|
|
"describe",
|
|
"teleo-staging-1",
|
|
"--project",
|
|
"teleo-501523",
|
|
"--zone",
|
|
"europe-west6-a",
|
|
"--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts,disks,networkInterfaces,tags.items)",
|
|
],
|
|
[
|
|
"gcloud",
|
|
"compute",
|
|
"disks",
|
|
"describe",
|
|
"teleo-staging-1",
|
|
"--project",
|
|
"teleo-501523",
|
|
"--zone",
|
|
"europe-west6-a",
|
|
"--format=json(name,status,sizeGb,zone,architecture,users)",
|
|
],
|
|
[
|
|
"gcloud",
|
|
"compute",
|
|
"networks",
|
|
"subnets",
|
|
"describe",
|
|
"teleo-staging-europe-west6",
|
|
"--project",
|
|
"teleo-501523",
|
|
"--region",
|
|
"europe-west6",
|
|
"--format=json(name,region,network,ipCidrRange,privateIpGoogleAccess)",
|
|
],
|
|
[
|
|
"gcloud",
|
|
"artifacts",
|
|
"repositories",
|
|
"describe",
|
|
"teleo",
|
|
"--project",
|
|
"teleo-501523",
|
|
"--location",
|
|
"europe-west6",
|
|
"--format=json(name,format,mode,dockerConfig.immutableTags)",
|
|
],
|
|
]
|
|
ssh = calls[-1]
|
|
assert ssh == preflight._ssh_argv(PRIVATE_IP)
|
|
assert "--tunnel-through-iap" in ssh
|
|
assert "--ssh-key-expire-after=5m" in ssh
|
|
remote = next(item.removeprefix("--command=") for item in ssh if item.startswith("--command="))
|
|
assert remote.startswith("set -euo pipefail\n")
|
|
for forbidden in (
|
|
"docker run",
|
|
"docker pull",
|
|
"docker rm",
|
|
"secretmanager",
|
|
"secrets versions access",
|
|
"systemctl start",
|
|
"systemctl restart",
|
|
"systemctl enable",
|
|
):
|
|
assert forbidden not in remote.casefold()
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("path", "field", "unsafe", "message"),
|
|
[
|
|
(("instance", "serviceAccounts"), None, [{"email": "postgres-admin@example.com"}], "service account"),
|
|
(("disk",), "sizeGb", "40", "boot disk"),
|
|
(("disk",), "architecture", "ARM64", "architecture"),
|
|
(("disk",), "users", [], "attachment"),
|
|
(("instance", "networkInterfaces"), None, [], "network interface"),
|
|
(("instance", "networkInterfaces", 0), "accessConfigs", [{"natIP": "203.0.113.10"}], "public"),
|
|
(("instance", "networkInterfaces", 0), "ipv6AccessConfigs", [{"externalIpv6": "2001:db8::1"}], "IPv6"),
|
|
(("instance", "networkInterfaces", 0), "externalIpv6", "2001:db8::1", "IPv6"),
|
|
(("instance", "networkInterfaces", 0), "networkIP", "10.99.0.2", "reviewed subnet"),
|
|
(("subnet",), "privateIpGoogleAccess", False, "Private Google Access"),
|
|
(("subnet",), "ipCidrRange", "10.99.0.0/24", "CIDR drifted"),
|
|
(("artifact", "dockerConfig"), "immutableTags", False, "not immutable"),
|
|
(("cloudsql", "settings", "ipConfiguration"), "ipv4Enabled", True, "public IPv4"),
|
|
(("cloudsql",), "databaseVersion", "POSTGRES_160", "exactly PostgreSQL 16"),
|
|
(("host",), "container_collision_count", "1", "container name"),
|
|
(("host",), "unit_load_state", "loaded", "unit name"),
|
|
(("host",), "docker_root_free_bytes", "1024", "free space"),
|
|
(("host",), "cloudsql_tcp", "unreachable", "TCP/5432"),
|
|
],
|
|
)
|
|
def test_preflight_fails_closed_on_prerequisite_drift(
|
|
path: tuple[str | int, ...],
|
|
field: str | None,
|
|
unsafe: object,
|
|
message: str,
|
|
) -> None:
|
|
values = copy.deepcopy(live_fixtures())
|
|
target: object = values
|
|
for part in path:
|
|
if isinstance(part, int):
|
|
assert isinstance(target, list)
|
|
target = target[part]
|
|
else:
|
|
assert isinstance(target, dict)
|
|
target = target[part]
|
|
if field is None:
|
|
assert isinstance(target, list)
|
|
parent: object = values
|
|
for part in path[:-1]:
|
|
if isinstance(part, int):
|
|
assert isinstance(parent, list)
|
|
parent = parent[part]
|
|
else:
|
|
assert isinstance(parent, dict)
|
|
parent = parent[part]
|
|
assert isinstance(parent, dict)
|
|
last = path[-1]
|
|
assert isinstance(last, str)
|
|
parent[last] = unsafe
|
|
else:
|
|
assert isinstance(target, dict)
|
|
target[field] = unsafe
|
|
|
|
with pytest.raises(preflight.PreflightError, match=message):
|
|
preflight.build_preflight(runner=fixture_runner(values), source_revision=REVISION)
|
|
|
|
|
|
def test_authentication_failure_is_classified_without_echoing_error() -> None:
|
|
sentinel = "sensitive-browser-session-sentinel"
|
|
|
|
def fail(argv: list[str]) -> subprocess.CompletedProcess[str]:
|
|
return subprocess.CompletedProcess(
|
|
argv,
|
|
1,
|
|
stdout="",
|
|
stderr=f"Reauthentication failed. {sentinel}. Run gcloud auth login.",
|
|
)
|
|
|
|
with pytest.raises(preflight.PreflightError) as caught:
|
|
preflight.build_preflight(runner=fail, source_revision=REVISION)
|
|
|
|
assert caught.value.category == "authentication_required"
|
|
assert sentinel not in str(caught.value)
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("mutation", "message"),
|
|
[
|
|
({"ipAddresses": [{"type": "PRIVATE", "ipAddress": "10.99.0.2"}]}, "address drifted"),
|
|
(
|
|
{
|
|
"ipAddresses": [
|
|
{"type": "PRIVATE", "ipAddress": PRIVATE_IP},
|
|
{"type": "PRIMARY", "ipAddress": "203.0.113.10"},
|
|
]
|
|
},
|
|
"private-only",
|
|
),
|
|
(
|
|
{"settings": {"ipConfiguration": {"sslMode": "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"}}},
|
|
"TLS mode",
|
|
),
|
|
],
|
|
)
|
|
def test_cloudsql_endpoint_and_tls_are_exact(mutation: dict[str, object], message: str) -> None:
|
|
values = copy.deepcopy(live_fixtures())
|
|
cloudsql = values["cloudsql"]
|
|
assert isinstance(cloudsql, dict)
|
|
if "settings" in mutation:
|
|
settings = cloudsql["settings"]
|
|
assert isinstance(settings, dict)
|
|
ip_config = settings["ipConfiguration"]
|
|
assert isinstance(ip_config, dict)
|
|
changed = mutation["settings"]
|
|
assert isinstance(changed, dict)
|
|
changed_ip_config = changed["ipConfiguration"]
|
|
assert isinstance(changed_ip_config, dict)
|
|
ip_config.update(changed_ip_config)
|
|
else:
|
|
cloudsql.update(mutation)
|
|
with pytest.raises(preflight.PreflightError, match=message):
|
|
preflight.build_preflight(runner=fixture_runner(values), source_revision=REVISION)
|
|
|
|
|
|
def test_host_output_rejects_extra_duplicate_or_unbounded_fields() -> None:
|
|
valid = live_fixtures()["host"]
|
|
assert isinstance(valid, dict)
|
|
encoded = "".join(f"{key}={item}\n" for key, item in valid.items())
|
|
|
|
for unsafe in (
|
|
encoded + "unexpected=value\n",
|
|
encoded + "project=duplicate\n",
|
|
encoded.replace("docker_server_os=linux", "docker_server_os=linux value with spaces"),
|
|
):
|
|
with pytest.raises(preflight.PreflightError, match="host preflight"):
|
|
preflight._parse_host_output(unsafe)
|
|
|
|
|
|
def test_command_gate_rejects_mutating_or_unreviewed_gcloud_calls() -> None:
|
|
for command in (
|
|
["gcloud", "compute", "instances", "start", "teleo-staging-1"],
|
|
["gcloud", "secrets", "versions", "access", "latest"],
|
|
["gcloud", "compute", "scp", "file", "teleo-staging-1:/tmp/file"],
|
|
["gcloud", "compute", "ssh", "teleo-staging-1", "--command=sudo systemctl restart x"],
|
|
["gcloud", "compute", "ssh", "teleo-staging-1", "--command=touch /tmp/preflight-was-here"],
|
|
["bash", "-c", "true"],
|
|
):
|
|
with pytest.raises(preflight.PreflightError):
|
|
preflight._assert_read_only_command(command)
|
|
|
|
|
|
def test_source_revision_requires_clean_tracked_commit(tmp_path: Path) -> None:
|
|
subprocess.run(["git", "init", "--quiet", str(tmp_path)], check=True)
|
|
tracked = tmp_path / "tracked.txt"
|
|
tracked.write_text("committed\n", encoding="utf-8")
|
|
subprocess.run(["git", "-C", str(tmp_path), "add", "tracked.txt"], check=True)
|
|
subprocess.run(
|
|
[
|
|
"git",
|
|
"-C",
|
|
str(tmp_path),
|
|
"-c",
|
|
"user.name=Preflight Test",
|
|
"-c",
|
|
"user.email=preflight@example.invalid",
|
|
"commit",
|
|
"--quiet",
|
|
"-m",
|
|
"fixture",
|
|
],
|
|
check=True,
|
|
)
|
|
revision = subprocess.run(
|
|
["git", "-C", str(tmp_path), "rev-parse", "HEAD"],
|
|
text=True,
|
|
capture_output=True,
|
|
check=True,
|
|
).stdout.strip()
|
|
assert preflight._source_revision(tmp_path, critical_paths=("tracked.txt",)) == revision
|
|
|
|
(tmp_path / "untracked.txt").write_text("drift\n", encoding="utf-8")
|
|
with pytest.raises(preflight.PreflightError, match="clean tracked"):
|
|
preflight._source_revision(tmp_path, critical_paths=("tracked.txt",))
|
|
|
|
|
|
def test_preflight_rejects_an_unrelated_clean_repository(tmp_path: Path) -> None:
|
|
with pytest.raises(preflight.PreflightError, match="containing this script"):
|
|
preflight._validated_repo_root(tmp_path)
|
|
|
|
|
|
def test_direct_cli_imports_then_rejects_an_unrelated_repository(tmp_path: Path) -> None:
|
|
completed = subprocess.run(
|
|
[sys.executable, str(preflight.SOURCE_ROOT / "ops" / "check_gcp_leoclean_nosend_preflight.py"), "--repo-root", str(tmp_path)],
|
|
text=True,
|
|
capture_output=True,
|
|
check=False,
|
|
)
|
|
assert completed.returncode == 1
|
|
assert json.loads(completed.stdout) == {
|
|
"category": "invalid_source_root",
|
|
"schema": "livingip.leocleanNoSendGcpPreflight.v1",
|
|
"status": "blocked",
|
|
}
|