Resolve endpoint-local object dependencies
This commit is contained in:
Lyncoln
+267
-27
@@ -1,35 +1,28 @@
|
||||
from collections.abc import Iterable
|
||||
from dataclasses import dataclass
|
||||
from dataclasses import dataclass, replace
|
||||
from datetime import datetime, timezone
|
||||
from typing import Protocol
|
||||
|
||||
from .adapters import (
|
||||
CERTIFICATES,
|
||||
DNS_RECORDS,
|
||||
PROXY_HOSTS,
|
||||
ApplyResult,
|
||||
Capability,
|
||||
CapabilityOperation,
|
||||
Endpoint,
|
||||
EndpointPlan,
|
||||
NormalizedObject,
|
||||
ObjectReference,
|
||||
PlanAction,
|
||||
PlanOperation,
|
||||
)
|
||||
from .dependencies import order_plan_actions
|
||||
from .persistence import SQLiteStateStore
|
||||
|
||||
|
||||
_OBJECT_TYPE_ORDER = {
|
||||
CERTIFICATES: 0,
|
||||
PROXY_HOSTS: 1,
|
||||
DNS_RECORDS: 2,
|
||||
}
|
||||
|
||||
|
||||
class ExecutionAdapter(Protocol):
|
||||
endpoint: Endpoint
|
||||
capabilities: frozenset[Capability]
|
||||
|
||||
def apply(self, action: PlanAction) -> str | None: ...
|
||||
def apply(self, action: PlanAction) -> ApplyResult | None: ...
|
||||
|
||||
def verify(self, object: NormalizedObject) -> bool: ...
|
||||
|
||||
@@ -48,19 +41,238 @@ class ExecutionResult:
|
||||
skipped: tuple[PlanAction, ...]
|
||||
|
||||
|
||||
def _action_sort_key(
|
||||
@dataclass
|
||||
class _LocalReferenceIndex:
|
||||
by_logical: dict[
|
||||
tuple[str, str],
|
||||
set[str],
|
||||
]
|
||||
by_local: set[tuple[str, str]]
|
||||
|
||||
|
||||
def _remember_local_object(
|
||||
index: _LocalReferenceIndex,
|
||||
object: NormalizedObject,
|
||||
*,
|
||||
authoritative: bool = False,
|
||||
) -> None:
|
||||
local_key = object.local_key
|
||||
if local_key is None:
|
||||
return
|
||||
|
||||
identity = (
|
||||
object.object_type,
|
||||
object.logical_key,
|
||||
)
|
||||
|
||||
if authoritative:
|
||||
previous = index.by_logical.get(identity, set())
|
||||
for previous_local_key in previous:
|
||||
index.by_local.discard(
|
||||
(
|
||||
object.object_type,
|
||||
previous_local_key,
|
||||
)
|
||||
)
|
||||
index.by_logical[identity] = {local_key}
|
||||
else:
|
||||
index.by_logical.setdefault(
|
||||
identity,
|
||||
set(),
|
||||
).add(local_key)
|
||||
|
||||
index.by_local.add(
|
||||
(
|
||||
object.object_type,
|
||||
local_key,
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
def _local_reference_index(
|
||||
store: SQLiteStateStore,
|
||||
endpoint_id: str,
|
||||
) -> _LocalReferenceIndex:
|
||||
index = _LocalReferenceIndex(
|
||||
by_logical={},
|
||||
by_local=set(),
|
||||
)
|
||||
observed_identities: set[
|
||||
tuple[str, str]
|
||||
] = set()
|
||||
|
||||
for observation in store.load_observations():
|
||||
if observation.endpoint_id != endpoint_id:
|
||||
continue
|
||||
|
||||
object = observation.object
|
||||
if object.local_key is None:
|
||||
continue
|
||||
|
||||
identity = (
|
||||
object.object_type,
|
||||
object.logical_key,
|
||||
)
|
||||
observed_identities.add(identity)
|
||||
_remember_local_object(index, object)
|
||||
|
||||
for applied in store.load_applied_state(
|
||||
endpoint_id=endpoint_id,
|
||||
):
|
||||
if not applied.is_verified:
|
||||
continue
|
||||
|
||||
object = applied.object
|
||||
if object.local_key is None:
|
||||
continue
|
||||
|
||||
identity = (
|
||||
object.object_type,
|
||||
object.logical_key,
|
||||
)
|
||||
|
||||
# Endpoint observations are authoritative when present.
|
||||
# Verified applied state is only a fallback when this
|
||||
# logical identity is absent from the observation snapshot.
|
||||
if identity in observed_identities:
|
||||
continue
|
||||
|
||||
_remember_local_object(index, object)
|
||||
|
||||
return index
|
||||
|
||||
|
||||
def _resolved_reference(
|
||||
endpoint_id: str,
|
||||
reference: ObjectReference,
|
||||
local_references: _LocalReferenceIndex,
|
||||
) -> ObjectReference:
|
||||
if reference.local_key is not None:
|
||||
local_identity = (
|
||||
reference.object_type,
|
||||
reference.local_key,
|
||||
)
|
||||
|
||||
if local_identity not in local_references.by_local:
|
||||
raise RuntimeError(
|
||||
"Unresolved endpoint-local reference for "
|
||||
f"{endpoint_id}: "
|
||||
f"{reference.relation} -> "
|
||||
f"{reference.object_type} "
|
||||
f"local key {reference.local_key!r}"
|
||||
)
|
||||
|
||||
return reference
|
||||
|
||||
identity = (
|
||||
reference.object_type,
|
||||
reference.logical_key,
|
||||
)
|
||||
candidates = local_references.by_logical.get(
|
||||
identity,
|
||||
set(),
|
||||
)
|
||||
|
||||
if not candidates:
|
||||
raise RuntimeError(
|
||||
"Unresolved endpoint-local reference for "
|
||||
f"{endpoint_id}: "
|
||||
f"{reference.relation} -> "
|
||||
f"{reference.object_type} "
|
||||
f"{reference.logical_key!r}"
|
||||
)
|
||||
|
||||
if len(candidates) > 1:
|
||||
raise RuntimeError(
|
||||
"Ambiguous endpoint-local reference for "
|
||||
f"{endpoint_id}: "
|
||||
f"{reference.relation} -> "
|
||||
f"{reference.object_type} "
|
||||
f"{reference.logical_key!r}: "
|
||||
f"{', '.join(sorted(candidates))}"
|
||||
)
|
||||
|
||||
local_key = next(iter(candidates))
|
||||
|
||||
return ObjectReference(
|
||||
relation=reference.relation,
|
||||
object_type=reference.object_type,
|
||||
local_key=local_key,
|
||||
)
|
||||
|
||||
|
||||
def _resolve_action_references(
|
||||
action: PlanAction,
|
||||
) -> tuple[int, str, str]:
|
||||
local_references: _LocalReferenceIndex,
|
||||
) -> PlanAction:
|
||||
desired = action.desired
|
||||
if desired is None:
|
||||
return (999, action.endpoint_id, "")
|
||||
raise RuntimeError(
|
||||
"Executable plan action requires desired state"
|
||||
)
|
||||
|
||||
return (
|
||||
_OBJECT_TYPE_ORDER.get(desired.object_type, 100),
|
||||
action.endpoint_id,
|
||||
desired.logical_key,
|
||||
if not desired.references:
|
||||
return action
|
||||
|
||||
references = tuple(
|
||||
_resolved_reference(
|
||||
action.endpoint_id,
|
||||
reference,
|
||||
local_references,
|
||||
)
|
||||
for reference in desired.references
|
||||
)
|
||||
|
||||
resolved_desired = replace(
|
||||
desired,
|
||||
references=references,
|
||||
)
|
||||
|
||||
return replace(
|
||||
action,
|
||||
desired=resolved_desired,
|
||||
)
|
||||
|
||||
|
||||
def _validated_apply_result(
|
||||
action: PlanAction,
|
||||
result: ApplyResult | None,
|
||||
) -> ApplyResult:
|
||||
desired = action.desired
|
||||
if desired is None:
|
||||
raise RuntimeError(
|
||||
"Executable plan action requires desired state"
|
||||
)
|
||||
|
||||
if not isinstance(result, ApplyResult):
|
||||
raise RuntimeError(
|
||||
f"{action.endpoint_id} "
|
||||
f"{desired.object_type} "
|
||||
f"{desired.logical_key}: "
|
||||
"adapter apply did not return ApplyResult"
|
||||
)
|
||||
|
||||
applied = result.object
|
||||
|
||||
if applied.object_type != desired.object_type:
|
||||
raise RuntimeError(
|
||||
"Applied object type does not match desired object type"
|
||||
)
|
||||
|
||||
if applied.logical_key != desired.logical_key:
|
||||
raise RuntimeError(
|
||||
"Applied object logical key does not match desired "
|
||||
"logical key"
|
||||
)
|
||||
|
||||
if applied.references != desired.references:
|
||||
raise RuntimeError(
|
||||
"Applied object references do not match resolved "
|
||||
"desired references"
|
||||
)
|
||||
|
||||
return result
|
||||
|
||||
|
||||
def _required_capability(
|
||||
adapter: ExecutionAdapter,
|
||||
@@ -164,25 +376,46 @@ def execute_endpoint_plans(
|
||||
plans,
|
||||
)
|
||||
applied: list[ExecutedAction] = []
|
||||
local_references: dict[
|
||||
str,
|
||||
_LocalReferenceIndex,
|
||||
] = {}
|
||||
|
||||
for action in sorted(executable, key=_action_sort_key):
|
||||
for endpoint_id in adapters_by_endpoint:
|
||||
local_references[endpoint_id] = (
|
||||
_local_reference_index(
|
||||
store,
|
||||
endpoint_id,
|
||||
)
|
||||
)
|
||||
|
||||
for action in order_plan_actions(executable):
|
||||
adapter = adapters_by_endpoint[action.endpoint_id]
|
||||
desired = action.desired
|
||||
resolved_action = _resolve_action_references(
|
||||
action,
|
||||
local_references[action.endpoint_id],
|
||||
)
|
||||
desired = resolved_action.desired
|
||||
|
||||
result = _validated_apply_result(
|
||||
resolved_action,
|
||||
adapter.apply(resolved_action),
|
||||
)
|
||||
applied_object = result.object
|
||||
|
||||
adapter.apply(action)
|
||||
store.record_applied(
|
||||
action.endpoint_id,
|
||||
desired,
|
||||
applied_object,
|
||||
timestamp,
|
||||
)
|
||||
|
||||
try:
|
||||
verified = adapter.verify(desired)
|
||||
verified = adapter.verify(applied_object)
|
||||
except Exception as exc:
|
||||
error = str(exc)
|
||||
store.record_verification_failure(
|
||||
action.endpoint_id,
|
||||
desired,
|
||||
applied_object,
|
||||
error,
|
||||
timestamp,
|
||||
)
|
||||
@@ -196,7 +429,7 @@ def execute_endpoint_plans(
|
||||
error = "adapter returned false"
|
||||
store.record_verification_failure(
|
||||
action.endpoint_id,
|
||||
desired,
|
||||
applied_object,
|
||||
error,
|
||||
timestamp,
|
||||
)
|
||||
@@ -208,9 +441,16 @@ def execute_endpoint_plans(
|
||||
|
||||
store.record_verification_success(
|
||||
action.endpoint_id,
|
||||
desired,
|
||||
applied_object,
|
||||
timestamp,
|
||||
)
|
||||
|
||||
_remember_local_object(
|
||||
local_references[action.endpoint_id],
|
||||
applied_object,
|
||||
authoritative=True,
|
||||
)
|
||||
|
||||
applied.append(
|
||||
ExecutedAction(
|
||||
endpoint_id=action.endpoint_id,
|
||||
|
||||
Reference in New Issue
Block a user