mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-02 07:34:45 +08:00
Drew Newberry
a67567e583
* fix(snap): require mTLS for the snap gateway Replace the installer opt-in with an authenticated snap gateway. The wrapper no longer forces plaintext, so the gateway serves TLS from the bundle it already generates in $SNAP_COMMON/tls. The install hook writes a config that enables mTLS user auth instead of unauthenticated access, and a new post-refresh hook migrates the exact legacy default on existing installs. install.sh waits for the gateway, detects whether it serves TLS, copies the client bundle into the target user's snap state directory, and registers the gateway over HTTPS. Older plaintext snap revisions still register over HTTP with a warning. The release canary asserts mTLS auth and HTTPS registration. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): pass config preflight and detect the mTLS gateway reliably An explicit [openshell.gateway.mtls_auth] table fails config preflight, which validates mTLS auth before the local TLS bundle supplies the client CA. Write a default that pins the Docker driver instead; with the wrapper's TLS bundle the gateway requires client certificates and enables mTLS user auth automatically, as the native packages do. The mTLS gateway rejects TLS handshakes without a client certificate, and it still answers plaintext loopback HTTP for sandbox service routing, so the installer could misdetect it as a legacy plaintext gateway. Probe HTTPS with the root-owned client bundle, and treat a gateway as legacy only when a plaintext gRPC Health call succeeds. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * chore(snap): simplify install hook comment Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): migrate insecure gateway configs on refresh Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(snap): simplify mTLS detection and config migration Detect the mTLS snap from the installed revision's post-refresh hook instead of probing plaintext gRPC, and drop the scheme global. Remove the installer's pre-hook config fallback, which is dead now that every channel ships the install hook and which wrote the insecure default. Give the install hook a single write path with a simple backup name, and shorten the manual client certificate steps. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): stop keeping a copy of replaced insecure configs Signed-off-by: Drew Newberry <anewberry@nvidia.com> * feat(install): make the snap an opt-in install method Stop selecting the OpenShell snap just because the snap command exists. Linux installs default to the Debian or RPM package; OPENSHELL_INSTALL_METHOD=snap (or deb, rpm) selects the package explicitly. Hosts that already have the OpenShell snap keep refreshing it rather than gaining a second gateway on the same port. The release canary and snap repro script opt in explicitly. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): let the gateway auto-detect its compute driver Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(snap): restart the gateway after refresh Published revisions use refresh-mode: endure, and snapd honors the old revision's setting during a refresh, so the plaintext gateway kept running with the migrated config unused until a manual restart. Restart the gateway from the post-refresh hook so the mTLS config takes effect immediately. Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(snap): drop refresh notes from the snap description Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(snap): trim snap refresh notes from installation docs Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
143 lines
4.0 KiB
Bash
Executable File
143 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -euo pipefail
|
|
|
|
hook_input=${1:?Usage: test-snap-install-hook.sh <install-hook>}
|
|
hook_dir=$(cd "$(dirname "$hook_input")" && pwd)
|
|
hook="${hook_dir}/$(basename "$hook_input")"
|
|
work=$(mktemp -d "${TMPDIR:-/tmp}/openshell snap install hook.XXXXXX")
|
|
trap 'rm -rf "$work"' EXIT
|
|
|
|
expected="${work}/expected.toml"
|
|
cat >"$expected" <<'EOF'
|
|
[openshell]
|
|
version = 2
|
|
|
|
[openshell.gateway]
|
|
EOF
|
|
|
|
legacy="${work}/legacy.toml"
|
|
cat >"$legacy" <<'EOF'
|
|
[openshell]
|
|
version = 2
|
|
|
|
[openshell.gateway]
|
|
|
|
[openshell.gateway.auth]
|
|
allow_unauthenticated_users = true
|
|
EOF
|
|
|
|
common="${work}/fresh"
|
|
SNAP_COMMON="$common" "$hook"
|
|
cmp -s "$expected" "$common/gateway.toml"
|
|
if [[ -z $(find "$common/gateway.toml" -perm 600) ]]; then
|
|
echo "FAIL: install hook config must be mode 0600" >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf '\noperator setting = true\n' >>"$common/gateway.toml"
|
|
cp "$common/gateway.toml" "${work}/operator-before"
|
|
SNAP_COMMON="$common" "$hook"
|
|
cmp -s "${work}/operator-before" "$common/gateway.toml"
|
|
|
|
common="${work}/legacy"
|
|
mkdir -p "$common"
|
|
cp "$legacy" "$common/gateway.toml"
|
|
chmod 644 "$common/gateway.toml"
|
|
SNAP_COMMON="$common" "$hook"
|
|
if ! cmp -s "$expected" "$common/gateway.toml"; then
|
|
echo "FAIL: install hook must migrate the legacy unauthenticated config" >&2
|
|
exit 1
|
|
fi
|
|
if [[ -z $(find "$common/gateway.toml" -perm 600) ]]; then
|
|
echo "FAIL: migrated config must be mode 0600" >&2
|
|
exit 1
|
|
fi
|
|
|
|
common="${work}/legacy-edited"
|
|
mkdir -p "$common"
|
|
cp "$legacy" "$common/gateway.toml"
|
|
printf '\n# operator note\n' >>"$common/gateway.toml"
|
|
cp "$common/gateway.toml" "${work}/legacy-edited-before"
|
|
SNAP_COMMON="$common" "$hook"
|
|
cmp -s "$expected" "$common/gateway.toml"
|
|
|
|
common="${work}/custom-insecure"
|
|
mkdir -p "$common"
|
|
cat >"$common/gateway.toml" <<'EOF'
|
|
[openshell]
|
|
version = 2
|
|
|
|
[openshell.gateway]
|
|
compute_driver = "docker"
|
|
disable_tls = true # old local override
|
|
|
|
[openshell.gateway.auth]
|
|
allow_unauthenticated_users = true # old local override
|
|
EOF
|
|
cp "$common/gateway.toml" "${work}/custom-insecure-before"
|
|
SNAP_COMMON="$common" "$hook"
|
|
cmp -s "$expected" "$common/gateway.toml"
|
|
|
|
common="${work}/custom-secure"
|
|
mkdir -p "$common"
|
|
cat >"$common/gateway.toml" <<'EOF'
|
|
[openshell]
|
|
version = 2
|
|
|
|
[openshell.gateway]
|
|
compute_driver = "docker"
|
|
# allow_unauthenticated_users = true
|
|
EOF
|
|
cp "$common/gateway.toml" "${work}/custom-secure-before"
|
|
SNAP_COMMON="$common" "$hook"
|
|
cmp -s "${work}/custom-secure-before" "$common/gateway.toml"
|
|
|
|
common="${work}/post-refresh"
|
|
mkdir -p "$common" "${work}/snap/meta/hooks"
|
|
cp "$hook" "${work}/snap/meta/hooks/install"
|
|
cp "${work}/legacy-edited-before" "$common/gateway.toml"
|
|
mkdir -p "${work}/bin"
|
|
cat >"${work}/bin/snapctl" <<EOF
|
|
#!/bin/sh
|
|
printf '%s\\n' "\$*" >>"${work}/snapctl.log"
|
|
EOF
|
|
chmod 755 "${work}/bin/snapctl"
|
|
PATH="${work}/bin:$PATH" SNAP="${work}/snap" SNAP_COMMON="$common" \
|
|
SNAP_INSTANCE_NAME=openshell "${hook_dir}/post-refresh"
|
|
if ! cmp -s "$expected" "$common/gateway.toml"; then
|
|
echo "FAIL: post-refresh hook must migrate an edited insecure config" >&2
|
|
exit 1
|
|
fi
|
|
if [[ $(cat "${work}/snapctl.log") != "restart openshell.gateway" ]]; then
|
|
echo "FAIL: post-refresh hook must restart the gateway" >&2
|
|
cat "${work}/snapctl.log" >&2
|
|
exit 1
|
|
fi
|
|
|
|
common="${work}/broken-link"
|
|
mkdir -p "$common"
|
|
ln -s "${work}/missing-target" "$common/gateway.toml"
|
|
SNAP_COMMON="$common" "$hook"
|
|
if [[ $(readlink "$common/gateway.toml") != "${work}/missing-target" ]]; then
|
|
echo "FAIL: install hook replaced a broken operator symlink" >&2
|
|
exit 1
|
|
fi
|
|
|
|
common="${work}/directory"
|
|
mkdir -p "$common/gateway.toml"
|
|
SNAP_COMMON="$common" "$hook"
|
|
if [[ ! -d "$common/gateway.toml" ]]; then
|
|
echo "FAIL: install hook replaced an operator-owned directory" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -n $(find "$work" -name 'gateway.toml.pre-mtls*') ]]; then
|
|
echo "FAIL: install hook must not keep copies of replaced configs" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Snap install hook tests passed"
|