Bind daemon to Pacemaker resource identity

daemon/server.py

@@ -16,6 +16,7 @@ SOCKET_PATH = os.environ.get(
 
 server_socket = None
 registry = None
+pacemaker_resource_id = None
 
 PROTOCOL_VERSION = 1
 
@@ -32,6 +33,38 @@ def protocol_response(payload):
     return response
 
 
+def load_pacemaker_resource_binding(
+    current_registry,
+    environ=None,
+):
+    """
+    Load and validate the Pacemaker resource identity accepted by this
+    daemon instance.
+
+    RESOURCE_ID identifies the registry entry. PACEMAKER_RESOURCE_ID is a
+    separate control-plane binding and must resolve to that registry.
+    """
+    if environ is None:
+        environ = os.environ
+
+    resource_id = environ.get(
+        "PACEMAKER_RESOURCE_ID"
+    )
+
+    if not resource_id:
+        raise RegistryError(
+            "PACEMAKER_RESOURCE_ID is not configured"
+        )
+
+    if resource_id not in current_registry.resources:
+        raise RegistryError(
+            "PACEMAKER_RESOURCE_ID does not identify "
+            f"a registered resource: {resource_id}"
+        )
+
+    return resource_id
+
+
 def handle_request(req):
     if not isinstance(req, dict):
         return protocol_response({
@@ -65,11 +98,17 @@ def handle_request(req):
         return protocol_response({
             "ok": True,
             "daemon": "managed-containerd",
+            "pacemaker_resource": (
+                pacemaker_resource_id
+            ),
         })
 
     if action == "registry.list":
         return protocol_response({
             "ok": True,
+            "pacemaker_resource": (
+                pacemaker_resource_id
+            ),
             "resources": registry.list_resources(),
         })
 
@@ -82,6 +121,18 @@ def handle_request(req):
             "error": "resource is required",
         })
 
+    if resource != pacemaker_resource_id:
+        return protocol_response({
+            "ok": False,
+            "error_code": "resource_binding_mismatch",
+            "error": (
+                "requested resource does not match "
+                "the configured Pacemaker binding"
+            ),
+            "resource": resource,
+            "action": action,
+        })
+
     return protocol_response(
         registry.execute(
             resource,
@@ -118,8 +169,12 @@ def shutdown(signum, frame):
 def serve():
     global server_socket
     global registry
+    global pacemaker_resource_id
 
     registry = Registry()
+    pacemaker_resource_id = (
+        load_pacemaker_resource_binding(registry)
+    )
 
     os.makedirs(
         os.path.dirname(SOCKET_PATH),
@@ -151,6 +206,12 @@ def serve():
         flush=True,
     )
 
+    print(
+        "Pacemaker resource binding: "
+        + pacemaker_resource_id,
+        flush=True,
+    )
+
     try:
         while True:
             conn, _ = server_socket.accept()