Run against a real OpenVox Server, and fix two bugs it found#7
Merged
Conversation
Adds the integration topology and the fixes that came out of running it. Deployed version directories were mode 0700. os.MkdirTemp creates 0700 and the agent renames that into place, so OpenVox Server — running as the puppet user while the agent runs as root — failed every catalog compile with EACCES on environment.conf. No same-user test can observe this, so the unit suite was blind to it. The directory is now widened before the rename, with a test asserting the deployed tree is traversable by other users. codavox no longer manages the stock /etc/puppetlabs/code/environments. A fresh OpenVox Server ships a populated skeleton at code/environments/production, and rename(2) cannot replace a real directory with a symlink, so managing that path would mean either refusing to start or moving an operator's directory aside on first run — and that directory may hold code deployed by other means. codavox owns /opt/puppetlabs/codavox/environments instead and OpenVox Server is pointed at it, which is the same approach PE takes with versioned deploys and /etc/puppetlabs/puppetserver/code. Verified end to end: both compilers converged on the same code_id over mutual TLS using real Puppet certificates; a compiler kept offline across a deploy caught up on one poll with no event replayed; an agent received a static catalog carrying the codavox code_id and inlined sha256 metadata; and changing code produced a new code_id that the agent applied. Also records that the Rocky 9 base image now ships Java 25, which OpenVox refuses, so the topology needs Java 21 installed first. Signed-off-by: Michael Harp <mike@mikeharp.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the integration topology and the fixes that came out of actually running it. Everything before this was tested against synthetic CAs and temp directories.
It works end to end
Against real OpenVox Server processes and real Puppet certificates:
code_idover mutual TLScode_idand inlined sha256 metadatacode_idand the agent applied the new contentThe real compiler certificate carries the
pp_roleextension exactly as assumed —1.3.6.1.4.1.34380.1.1.13: ..openvox_compiler, where..is the ASN.1 UTF8String header, confirming the decoding path.Bug 1: deployed directories were mode 0700
os.MkdirTempcreates 0700, and the agent renames that into place. OpenVox Server runs as thepuppetuser while the agent runs as root, so every catalog compile failed with:No same-user test can observe this — the unit suite was structurally blind to it. Fixed by widening before the rename, with a regression test asserting the deployed tree is traversable by other users.
Bug 2: managing the stock codedir is not viable
A fresh OpenVox Server ships a populated skeleton at
code/environments/production—data,environment.conf,hiera.yaml,manifests,modules— andrename(2)cannot replace a real directory with a symlink:My first instinct was an
--adoptflag to move it aside. That was wrong: it makes every install need an explicit override, and that directory may hold code somebody deployed by other means.codavox now owns
/opt/puppetlabs/codavox/environmentsand OpenVox Server is pointed at it. This is what PE does with versioned deploys and/etc/puppetlabs/puppetserver/code— the stock path is left untouched for anyone still using it.Environment note
The Rocky 9 base image now ships Java 25, which OpenVox refuses (
java 25.0.3 found but OpenVox requires 17 or 21). This affects ovadm's own Docker testing, not just codavox. Documented as a prerequisite step.Topology
compose.codavox.ymllayers a second compiler over ovadm's compose rather than changing that repo. Version directories are on named volumes, not the container overlay filesystem, since atomicrename(2)semantics are a correctness claim and testing them on overlayfs risks false confidence.🤖 Generated with Claude Code