From b597830360fbe44b018a9202b73edaf3e6eebd14 Mon Sep 17 00:00:00 2001 From: claude Date: Tue, 13 Oct 2026 15:53:59 +0200 Subject: [PATCH] =?UTF-8?q?engine,=20pve=20:=20s=C3=A9lection=20d'objets,?= =?UTF-8?q?=20empreinte=20de=20plan,=20journal=20d'apply,=20CA=20en=20lign?= =?UTF-8?q?e?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_015a8P6WMRPeqdpd5VCh6jAy --- go.mod | 20 ++++- go.sum | 50 ++++++++++++ internal/engine/apply.go | 13 ++- internal/engine/select.go | 144 +++++++++++++++++++++++++++++++++ internal/engine/select_test.go | 92 +++++++++++++++++++++ internal/pve/client.go | 15 ++-- 6 files changed, 326 insertions(+), 8 deletions(-) create mode 100644 internal/engine/select.go create mode 100644 internal/engine/select_test.go diff --git a/go.mod b/go.mod index 61040e3..507796d 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,21 @@ module pve-confsync -go 1.24 +go 1.24.0 -require gopkg.in/yaml.v3 v3.0.1 +require ( + gopkg.in/yaml.v3 v3.0.1 + modernc.org/sqlite v1.40.0 +) + +require ( + github.com/dustin/go-humanize v1.0.1 // indirect + github.com/google/uuid v1.6.0 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect + github.com/ncruces/go-strftime v0.1.9 // indirect + github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect + golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect + golang.org/x/sys v0.36.0 // indirect + modernc.org/libc v1.66.10 // indirect + modernc.org/mathutil v1.7.1 // indirect + modernc.org/memory v1.11.0 // indirect +) diff --git a/go.sum b/go.sum index 4bc0337..d2d5d13 100644 --- a/go.sum +++ b/go.sum @@ -1,3 +1,53 @@ +github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= +github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= +github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs= +github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4= +github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls= +github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= +github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o= +golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8= +golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ= +golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc= +golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= +golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= +golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg= +golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +modernc.org/cc/v4 v4.26.5 h1:xM3bX7Mve6G8K8b+T11ReenJOT+BmVqQj0FY5T4+5Y4= +modernc.org/cc/v4 v4.26.5/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0= +modernc.org/ccgo/v4 v4.28.1 h1:wPKYn5EC/mYTqBO373jKjvX2n+3+aK7+sICCv4Fjy1A= +modernc.org/ccgo/v4 v4.28.1/go.mod h1:uD+4RnfrVgE6ec9NGguUNdhqzNIeeomeXf6CL0GTE5Q= +modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA= +modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc= +modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI= +modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito= +modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks= +modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI= +modernc.org/libc v1.66.10 h1:yZkb3YeLx4oynyR+iUsXsybsX4Ubx7MQlSYEw4yj59A= +modernc.org/libc v1.66.10/go.mod h1:8vGSEwvoUoltr4dlywvHqjtAqHBaw0j1jI7iFBTAr2I= +modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU= +modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg= +modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI= +modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw= +modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8= +modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns= +modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w= +modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE= +modernc.org/sqlite v1.40.0 h1:bNWEDlYhNPAUdUdBzjAvn8icAs/2gaKlj4vM+tQ6KdQ= +modernc.org/sqlite v1.40.0/go.mod h1:9fjQZ0mB1LLP0GYrp39oOJXx/I2sxEnZtzCmEQIKvGE= +modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0= +modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A= +modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y= +modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM= diff --git a/internal/engine/apply.go b/internal/engine/apply.go index c5630de..38d54ff 100644 --- a/internal/engine/apply.go +++ b/internal/engine/apply.go @@ -24,6 +24,8 @@ type Result struct { Client string `json:"client"` Steps []Step `json:"steps"` Err error `json:"-"` + + notify func(Step) } func (r *Result) log(action string, err error) { @@ -32,6 +34,9 @@ func (r *Result) log(action string, err error) { s.Error = err.Error() } r.Steps = append(r.Steps, s) + if r.notify != nil { + r.notify(s) + } } // TaskPoll is the poll interval of the SDN reload task. @@ -42,9 +47,15 @@ var TaskPoll = 2 * time.Second // committed with PUT /cluster/sdn. Any failure before the commit rolls the // pending SDN changes back (POST /cluster/sdn/rollback). func Apply(ctx context.Context, c *pve.Client, plan Plan) Result { - res := Result{Client: plan.Client} + return ApplyWithLog(ctx, c, plan, nil) +} + +// ApplyWithLog is Apply calling notify after each step (live journal of the web UI). +func ApplyWithLog(ctx context.Context, c *pve.Client, plan Plan, notify func(Step)) Result { + res := Result{Client: plan.Client, notify: notify} if len(plan.Errors) > 0 { res.Err = fmt.Errorf("plan has %d error(s), nothing applied", len(plan.Errors)) + res.log("plan check", res.Err) return res } if _, err := c.CheckVersion(ctx); err != nil { diff --git a/internal/engine/select.go b/internal/engine/select.go new file mode 100644 index 0000000..912db30 --- /dev/null +++ b/internal/engine/select.go @@ -0,0 +1,144 @@ +package engine + +import ( + "crypto/sha256" + "encoding/hex" + "encoding/json" + "sort" + "strings" + + "pve-confsync/internal/model" +) + +// Key is the identity of a planned change ("kind/id"), as model.Object.Key. +func (c Change) Key() string { return string(c.Kind) + "/" + c.ID } + +// Filter keeps the changes of the given objects, plus the ones they depend on: +// creating a vnet needs its zone when the zone is created too, a subnet needs its +// vnet; deleting a zone needs the deletion of its vnets and their subnets first. +// The execution order of the plan is kept. An empty key list keeps everything. +func Filter(p Plan, keys []string) Plan { + if len(keys) == 0 { + return p + } + byKey := map[string]Change{} + for _, c := range p.Changes { + byKey[c.Key()] = c + } + want := map[string]bool{} + for _, k := range keys { + if _, ok := byKey[k]; ok { + want[k] = true + } + } + for changed := true; changed; { + changed = false + add := func(k string) { + if _, ok := byKey[k]; ok && !want[k] { + want[k] = true + changed = true + } + } + for k := range want { + c := byKey[k] + switch c.Op { + case OpCreate, OpUpdate: + // parents written in the same plan must exist first + if z, ok := c.Set["zone"].(string); ok && byKey[string(model.KindZone)+"/"+z].Op == OpCreate { + add(string(model.KindZone) + "/" + z) + } + if v, ok := c.Set["vnet"].(string); ok && byKey[string(model.KindVNet)+"/"+v].Op == OpCreate { + add(string(model.KindVNet) + "/" + v) + } + case OpDelete: + // children deleted in the same plan must go first + for _, d := range p.Changes { + if d.Op != OpDelete { + continue + } + switch { + case c.Kind == model.KindZone && d.Kind == model.KindVNet && d.Old["zone"] == c.ID, + c.Kind == model.KindVNet && d.Kind == model.KindSubnet && d.Old["vnet"] == c.ID: + add(d.Key()) + } + } + } + } + } + // an error on the parent of a selected object blocks it too (a vnet whose + // zone cannot be created) + blocking := map[string]bool{} + for k := range want { + c := byKey[k] + if c.Op == OpDelete { + continue + } + if z, ok := c.Set["zone"].(string); ok { + blocking[string(model.KindZone)+"/"+z] = true + } + if v, ok := c.Set["vnet"].(string); ok { + blocking[string(model.KindVNet)+"/"+v] = true + } + } + out := Plan{Client: p.Client, Warnings: p.Warnings} + // errors about other objects ("kind/id: ...") do not block this selection + for _, e := range p.Errors { + if k, ok := ErrorKey(e); !ok || want[k] || blocking[k] || contains(keys, k) { + out.Errors = append(out.Errors, e) + } + } + for _, c := range p.Changes { + if want[c.Key()] { + out.Changes = append(out.Changes, c) + } + } + return out +} + +// ErrorKey returns the object an error of MakePlan is about ("kind/id: ..."; +// ": " and not ":" because IPv6 subnet ids hold colons). +func ErrorKey(e string) (string, bool) { + for _, k := range model.Kinds { + if strings.HasPrefix(e, string(k)+"/") { + if i := strings.Index(e, ": "); i > 0 { + return e[:i], true + } + } + } + return "", false +} + +func contains(l []string, s string) bool { + for _, x := range l { + if x == s { + return true + } + } + return false +} + +// Digest identifies the content of a plan: the web UI shows a dry-run, then applies +// only if the plan computed again just before the apply has the same digest, so +// that what is written is exactly what the user reviewed. +func (p Plan) Digest() string { + type ch struct { + Op Op `json:"op"` + Key string `json:"key"` + Set map[string]any `json:"set,omitempty"` + Unset []string `json:"unset,omitempty"` + } + l := make([]ch, 0, len(p.Changes)) + for _, c := range p.Changes { + l = append(l, ch{c.Op, c.Key(), c.Set, c.Unset}) + } + errs := append([]string(nil), p.Errors...) + sort.Strings(errs) + // map keys are sorted by encoding/json: the digest is stable + b, _ := json.Marshal(struct { + Client string `json:"client"` + Changes []ch `json:"changes"` + Errors []string `json:"errors"` + }{p.Client, l, errs}) + sum := sha256.Sum256(b) + return hex.EncodeToString(sum[:12]) +} diff --git a/internal/engine/select_test.go b/internal/engine/select_test.go new file mode 100644 index 0000000..8df8ae7 --- /dev/null +++ b/internal/engine/select_test.go @@ -0,0 +1,92 @@ +package engine + +import ( + "testing" + + "pve-confsync/internal/model" +) + +func keys(p Plan) []string { + var out []string + for _, c := range p.Changes { + out = append(out, c.Key()) + } + return out +} + +func TestFilterDependencies(t *testing.T) { + p := Plan{Client: "c", Changes: []Change{ + {Kind: model.KindZone, ID: "z1", Op: OpCreate, Set: map[string]any{"type": "vlan"}}, + {Kind: model.KindZone, ID: "z2", Op: OpUpdate, Set: map[string]any{"mtu": 1500}}, + {Kind: model.KindVNet, ID: "v1", Op: OpCreate, Set: map[string]any{"zone": "z1"}}, + {Kind: model.KindVNet, ID: "v2", Op: OpCreate, Set: map[string]any{"zone": "z2"}}, + {Kind: model.KindSubnet, ID: "z1-10.0.0.0-24", Op: OpCreate, Set: map[string]any{"vnet": "v1"}}, + }} + got := keys(Filter(p, []string{"sdn-subnet/z1-10.0.0.0-24"})) + want := []string{"sdn-zone/z1", "sdn-vnet/v1", "sdn-subnet/z1-10.0.0.0-24"} + if len(got) != len(want) { + t.Fatalf("got %v, want %v", got, want) + } + for i := range want { + if got[i] != want[i] { + t.Fatalf("got %v, want %v (plan order kept)", got, want) + } + } + // an update of the parent zone is not pulled in + if got := keys(Filter(p, []string{"sdn-vnet/v2"})); len(got) != 1 { + t.Fatalf("got %v, want only the vnet", got) + } + // unknown keys select nothing; no keys select everything + if got := Filter(p, []string{"sdn-vnet/nope"}); len(got.Changes) != 0 { + t.Fatalf("unknown key selected %v", keys(got)) + } + if got := Filter(p, nil); len(got.Changes) != len(p.Changes) { + t.Fatal("empty selection must keep the whole plan") + } +} + +func TestFilterDeleteChildrenFirst(t *testing.T) { + p := Plan{Changes: []Change{ + {Kind: model.KindSubnet, ID: "z-10.0.0.0-24", Op: OpDelete, Old: map[string]any{"vnet": "v"}}, + {Kind: model.KindVNet, ID: "v", Op: OpDelete, Old: map[string]any{"zone": "z"}}, + {Kind: model.KindVNet, ID: "other", Op: OpDelete, Old: map[string]any{"zone": "y"}}, + {Kind: model.KindZone, ID: "z", Op: OpDelete}, + }} + got := keys(Filter(p, []string{"sdn-zone/z"})) + if len(got) != 3 || got[2] != "sdn-zone/z" { + t.Fatalf("got %v", got) + } +} + +func TestFilterErrors(t *testing.T) { + p := Plan{ + Changes: []Change{ + {Kind: model.KindVNet, ID: "ceph", Op: OpCreate, Set: map[string]any{"zone": "stor"}}, + {Kind: model.KindVNet, ID: "vx1", Op: OpCreate, Set: map[string]any{"zone": "vxz"}}, + }, + Errors: []string{`sdn-zone/stor: field "bridge" required`, "sdn-subnet/z-fd00::-64: bad", "global problem"}, + } + if got := Filter(p, []string{"sdn-vnet/vx1"}); len(got.Errors) != 1 || got.Errors[0] != "global problem" { + t.Fatalf("vx1: errors %v", got.Errors) + } + // the zone of ceph cannot be created: its error blocks ceph + if got := Filter(p, []string{"sdn-vnet/ceph"}); len(got.Errors) != 2 { + t.Fatalf("ceph: errors %v", got.Errors) + } + if k, ok := ErrorKey("sdn-subnet/z-fd00::-64: bad"); !ok || k != "sdn-subnet/z-fd00::-64" { + t.Fatalf("ErrorKey IPv6: %q %v", k, ok) + } +} + +func TestDigest(t *testing.T) { + a := Plan{Client: "c", Changes: []Change{{Kind: model.KindZone, ID: "z", Op: OpUpdate, Set: map[string]any{"mtu": 1500}}}} + b := Plan{Client: "c", Changes: []Change{{Kind: model.KindZone, ID: "z", Op: OpUpdate, Set: map[string]any{"mtu": 9000}}}} + if a.Digest() == b.Digest() { + t.Fatal("different plans, same digest") + } + a2 := a + a2.Warnings = []string{"w"} + if a.Digest() != a2.Digest() { + t.Fatal("warnings must not change the digest") + } +} diff --git a/internal/pve/client.go b/internal/pve/client.go index 3125a13..085608a 100644 --- a/internal/pve/client.go +++ b/internal/pve/client.go @@ -29,6 +29,7 @@ type Options struct { TokenID string // user@realm!tokenname TokenSecret string // never logged CAFile string // PEM bundle to trust (optional) + CAPEM []byte // PEM bundle given inline (web UI); CAFile wins when both are set Fingerprint string // SHA-256 of the leaf certificate, "AA:BB:..." (optional, pinning) Insecure bool // skip TLS verification (lab only) Timeout time.Duration @@ -93,14 +94,18 @@ func New(o Options) (*Client, error) { } return nil } - case o.CAFile != "": - pem, err := os.ReadFile(o.CAFile) - if err != nil { - return nil, fmt.Errorf("cluster %s: %w", o.Name, err) + case o.CAFile != "" || len(o.CAPEM) > 0: + pem, src := o.CAPEM, "the CA certificate" + if o.CAFile != "" { + var err error + if pem, err = os.ReadFile(o.CAFile); err != nil { + return nil, fmt.Errorf("cluster %s: %w", o.Name, err) + } + src = o.CAFile } pool := x509.NewCertPool() if !pool.AppendCertsFromPEM(pem) { - return nil, fmt.Errorf("cluster %s: no certificate in %s", o.Name, o.CAFile) + return nil, fmt.Errorf("cluster %s: no certificate in %s", o.Name, src) } tlsCfg.RootCAs = pool case o.Insecure: