Compare commits

..

No commits in common. "main" and "test-scenario-1" have entirely different histories.

8 changed files with 86 additions and 243 deletions

View File

@ -73,67 +73,31 @@ jobs:
print(f"[{env}] Reconciler call failed: {e}")
continue
# Format as markdown table
# Format as markdown grouped by action
ops = data.get("operations", [])
summary = data.get("summary", {})
lines = [f"## Reconciliation Plan: `{env}`\n"]
if not ops:
lines.append("No changes detected.\n")
else:
def fmt_val(v):
if isinstance(v, bool):
return str(v).lower()
if isinstance(v, list):
return ", ".join(str(x) for x in v) if v else "(empty)"
if v is None:
return "(none)"
return str(v)
def get_action(op):
"""Derive a human-readable action from the operation."""
t = op["type"]
changes = op.get("changes", [])
# For updates, check if it's just an enable/disable toggle
if not t.startswith("create") and not t.startswith("delete"):
if len(changes) == 1 and changes[0]["field"] == "enabled":
return "disable" if changes[0]["to"] is False else "enable"
return "update"
return t.split("_", 1)[0]
def fmt_details(op, action):
"""Format details based on action type."""
if action == "delete":
return ""
if action in ("enable", "disable"):
return ""
changes = op.get("changes", [])
if changes:
parts = []
for c in changes:
parts.append(f"`{c['field']}`: {fmt_val(c['from'])} → {fmt_val(c['to'])}")
return "; ".join(parts)
d = op.get("details", {})
if not d:
return ""
parts = []
if "sources" in d and "destinations" in d:
parts.append(f"{fmt_val(d['sources'])} → {fmt_val(d['destinations'])}")
if "auto_groups" in d:
parts.append(f"groups: {fmt_val(d['auto_groups'])}")
if "type" in d and "address" in d:
parts.append(f"{d['type']}:{d['address']}")
if "peers" in d:
parts.append(f"peers: {fmt_val(d['peers'])}")
return "; ".join(parts) if parts else ""
lines.append("| Action | Resource | Name | Details |")
lines.append("|--------|----------|------|---------|")
groups = {"Create": [], "Update": [], "Delete": []}
for op in ops:
resource = op["type"].split("_", 1)[1] if "_" in op["type"] else op["type"]
action = get_action(op)
detail = fmt_details(op, action)
lines.append(f"| {action} | {resource} | {op['name']} | {detail} |")
lines.append("")
t = op["type"]
if t.startswith("create"): groups["Create"].append(op)
elif t.startswith("delete"): groups["Delete"].append(op)
else: groups["Update"].append(op)
for action, items in groups.items():
if not items:
continue
emoji = {"Create": "+", "Update": "~", "Delete": "-"}[action]
lines.append(f"### {action} ({len(items)})\n")
lines.append("| Resource | Name |")
lines.append("|----------|------|")
for op in items:
resource = op["type"].split("_", 1)[1] if "_" in op["type"] else op["type"]
lines.append(f"| {resource} | {op['name']} |")
lines.append("")
c, u, d = summary.get("created", 0), summary.get("updated", 0), summary.get("deleted", 0)
lines.append(f"**Total: {c} create, {u} update, {d} delete**")

View File

@ -95,32 +95,9 @@ jobs:
f"{summary.get('updated',0)} updated, "
f"{summary.get('deleted',0)} deleted")
# Log each operation with details
for op in data.get("operations", []):
t = op["type"]
n = op["name"]
s = op.get("status", "?")
action = "CREATE" if t.startswith("create") else "DELETE" if t.startswith("delete") else "UPDATE"
resource = t.split("_", 1)[1] if "_" in t else t
prefix = f"[{env}] {action} {resource} '{n}' -> {s}"
changes = op.get("changes", [])
if changes:
def fmt(v):
if isinstance(v, bool): return str(v).lower()
if isinstance(v, list): return ", ".join(str(x) for x in v) if v else "(empty)"
if v is None: return "(none)"
return str(v)
parts = [f"{c['field']}: {fmt(c['from'])} -> {fmt(c['to'])}" for c in changes]
print(f" {prefix} [{'; '.join(parts)}]")
else:
print(f" {prefix}")
keys = data.get("created_keys", {})
if keys:
print(f"[{env}] Created setup keys:")
for name, value in keys.items():
print(f" {name}: {value}")
print(f"[{env}] Created setup keys: {list(keys.keys())}")
if failed:
print(f"\nFailed environments: {failed}")

View File

@ -12,7 +12,7 @@ function makeEvent(overrides: Partial<NbEvent> = {}): NbEvent {
initiator_id: "init-1",
initiator_name: "admin",
target_id: "peer-1",
meta: { setup_key_name: "drone-key", name: "drone-01" },
meta: { setup_key: "drone-key", name: "drone-01" },
...overrides,
};
}
@ -66,7 +66,7 @@ Deno.test("processEnrollmentEvents filters by lastTimestamp", () => {
Deno.test("processEnrollmentEvents ignores unknown keys", () => {
const events: NbEvent[] = [
makeEvent({
meta: { setup_key_name: "rogue-key", name: "rogue-host" },
meta: { setup_key: "rogue-key", name: "rogue-host" },
target_id: "peer-x",
}),
];

View File

@ -21,10 +21,10 @@ export function processEnrollmentEvents(
.filter((e) => {
if (e.activity_code !== "peer.setupkey.add") return false;
if (lastTimestamp && e.timestamp <= lastTimestamp) return false;
if (!knownKeyNames.has(e.meta.setup_key_name)) {
if (!knownKeyNames.has(e.meta.setup_key)) {
console.log(JSON.stringify({
msg: "unknown_enrollment",
setup_key_name: e.meta.setup_key_name,
setup_key: e.meta.setup_key,
peer_id: e.target_id,
}));
return false;
@ -32,7 +32,7 @@ export function processEnrollmentEvents(
return true;
})
.map((e) => ({
setupKeyName: e.meta.setup_key_name,
setupKeyName: e.meta.setup_key,
peerId: e.target_id,
peerHostname: e.meta.name,
timestamp: e.timestamp,

View File

@ -1,11 +1,7 @@
import type { DesiredState } from "../state/schema.ts";
import type { ActualState } from "../state/actual.ts";
import type { NbPolicyRule } from "../netbird/types.ts";
import {
EXECUTION_ORDER,
type FieldChange,
type Operation,
} from "./operations.ts";
import { EXECUTION_ORDER, type Operation } from "./operations.ts";
/**
* Compares desired state against actual state and returns an ordered list of
@ -57,14 +53,10 @@ function diffPostureChecks(
continue;
}
const pcChanges: FieldChange[] = [];
if (existing.description !== config.description) {
pcChanges.push({ field: "description", from: existing.description, to: config.description });
}
if (JSON.stringify(existing.checks) !== JSON.stringify(config.checks)) {
pcChanges.push({ field: "checks", from: existing.checks, to: config.checks });
}
if (pcChanges.length > 0) {
if (
existing.description !== config.description ||
JSON.stringify(existing.checks) !== JSON.stringify(config.checks)
) {
ops.push({
type: "update_posture_check",
name,
@ -72,7 +64,6 @@ function diffPostureChecks(
description: config.description,
checks: config.checks,
},
changes: pcChanges,
});
}
}
@ -117,9 +108,6 @@ function diffGroups(
desired_peers: desiredPeerNames,
actual_peers: actualPeerNames,
},
changes: [
{ field: "peers", from: actualPeerNames, to: desiredPeerNames },
],
});
}
}
@ -231,9 +219,6 @@ function diffNetworks(
type: "update_network",
name,
details: { description: config.description },
changes: [
{ field: "description", from: existing.description, to: config.description },
],
});
}
@ -308,23 +293,13 @@ function diffNetworkResources(
const actualGroupNames = existing.groups.map((g) => g.name).sort();
const desiredGroupNames = [...res.groups].sort();
const resChanges: FieldChange[] = [];
if (existing.description !== res.description) {
resChanges.push({ field: "description", from: existing.description, to: res.description });
}
if (existing.type !== res.type) {
resChanges.push({ field: "type", from: existing.type, to: res.type });
}
if (existing.address !== res.address) {
resChanges.push({ field: "address", from: existing.address, to: res.address });
}
if (existing.enabled !== res.enabled) {
resChanges.push({ field: "enabled", from: existing.enabled, to: res.enabled });
}
if (!arraysEqual(actualGroupNames, desiredGroupNames)) {
resChanges.push({ field: "groups", from: actualGroupNames, to: desiredGroupNames });
}
if (resChanges.length > 0) {
if (
existing.description !== res.description ||
existing.type !== res.type ||
existing.address !== res.address ||
existing.enabled !== res.enabled ||
!arraysEqual(actualGroupNames, desiredGroupNames)
) {
ops.push({
type: "update_network_resource",
name: res.name,
@ -337,7 +312,6 @@ function diffNetworkResources(
enabled: res.enabled,
groups: res.groups,
},
changes: resChanges,
});
}
}
@ -388,17 +362,11 @@ function diffNetworkRouters(
}
// Compare mutable fields
const routerChanges: FieldChange[] = [];
if (existing.metric !== router.metric) {
routerChanges.push({ field: "metric", from: existing.metric, to: router.metric });
}
if (existing.masquerade !== router.masquerade) {
routerChanges.push({ field: "masquerade", from: existing.masquerade, to: router.masquerade });
}
if (existing.enabled !== router.enabled) {
routerChanges.push({ field: "enabled", from: existing.enabled, to: router.enabled });
}
if (routerChanges.length > 0) {
if (
existing.metric !== router.metric ||
existing.masquerade !== router.masquerade ||
existing.enabled !== router.enabled
) {
ops.push({
type: "update_network_router",
name: key,
@ -411,7 +379,6 @@ function diffNetworkRouters(
masquerade: router.masquerade,
enabled: router.enabled,
},
changes: routerChanges,
});
}
}
@ -474,7 +441,7 @@ function diffPeers(
const existing = actual.peersByName.get(name);
if (!existing) continue; // Never create or delete peers
const peerChanges: FieldChange[] = [];
let changed = false;
// Compare groups (excluding "All"), resolve actual peer group names
const actualGroupNames = existing.groups
@ -483,20 +450,19 @@ function diffPeers(
.sort();
const desiredGroupNames = [...config.groups].sort();
if (!arraysEqual(actualGroupNames, desiredGroupNames)) {
peerChanges.push({ field: "groups", from: actualGroupNames, to: desiredGroupNames });
changed = true;
}
if (existing.login_expiration_enabled !== config.login_expiration_enabled) {
peerChanges.push({ field: "login_expiration_enabled", from: existing.login_expiration_enabled, to: config.login_expiration_enabled });
}
if (existing.inactivity_expiration_enabled !== config.inactivity_expiration_enabled) {
peerChanges.push({ field: "inactivity_expiration_enabled", from: existing.inactivity_expiration_enabled, to: config.inactivity_expiration_enabled });
}
if (existing.ssh_enabled !== config.ssh_enabled) {
peerChanges.push({ field: "ssh_enabled", from: existing.ssh_enabled, to: config.ssh_enabled });
if (
existing.login_expiration_enabled !== config.login_expiration_enabled ||
existing.inactivity_expiration_enabled !==
config.inactivity_expiration_enabled ||
existing.ssh_enabled !== config.ssh_enabled
) {
changed = true;
}
if (peerChanges.length > 0) {
if (changed) {
ops.push({
type: "update_peer",
name,
@ -506,7 +472,6 @@ function diffPeers(
inactivity_expiration_enabled: config.inactivity_expiration_enabled,
ssh_enabled: config.ssh_enabled,
},
changes: peerChanges,
});
}
}
@ -546,14 +511,10 @@ function diffUsers(
).sort();
const desiredAutoGroupNames = [...config.auto_groups].sort();
const userChanges: FieldChange[] = [];
if (existing.role !== config.role) {
userChanges.push({ field: "role", from: existing.role, to: config.role });
}
if (!arraysEqual(actualAutoGroupNames, desiredAutoGroupNames)) {
userChanges.push({ field: "auto_groups", from: actualAutoGroupNames, to: desiredAutoGroupNames });
}
if (userChanges.length > 0) {
if (
existing.role !== config.role ||
!arraysEqual(actualAutoGroupNames, desiredAutoGroupNames)
) {
ops.push({
type: "update_user",
name: email,
@ -562,7 +523,6 @@ function diffUsers(
role: config.role,
auto_groups: config.auto_groups,
},
changes: userChanges,
});
}
}
@ -649,30 +609,12 @@ function diffPolicies(
desiredPostureChecks,
);
const changes: FieldChange[] = [];
if (existing.enabled !== config.enabled) {
changes.push({ field: "enabled", from: existing.enabled, to: config.enabled });
}
if (!arraysEqual(actualSources, desiredSources)) {
changes.push({ field: "sources", from: actualSources, to: desiredSources });
}
if (destsChanged) {
if (config.destination_resource) {
const actualDestRes = existing.rules[0]?.destinationResource;
changes.push({ field: "destination_resource", from: actualDestRes ?? null, to: config.destination_resource });
} else {
const actualDests = extractGroupNames(
existing.rules.flatMap((r) => r.destinations ?? []),
actual,
).sort();
changes.push({ field: "destinations", from: actualDests, to: [...config.destinations].sort() });
}
}
if (postureChecksChanged) {
changes.push({ field: "source_posture_checks", from: actualPostureChecks, to: desiredPostureChecks });
}
if (changes.length > 0) {
if (
existing.enabled !== config.enabled ||
!arraysEqual(actualSources, desiredSources) ||
destsChanged ||
postureChecksChanged
) {
ops.push({
type: "update_policy",
name,
@ -683,7 +625,6 @@ function diffPolicies(
destination_resource: config.destination_resource,
source_posture_checks: config.source_posture_checks,
},
changes,
});
}
}
@ -741,17 +682,11 @@ function diffRoutes(
continue;
}
const routeChanges: FieldChange[] = [];
if (existing.enabled !== config.enabled) {
routeChanges.push({ field: "enabled", from: existing.enabled, to: config.enabled });
}
if (existing.description !== config.description) {
routeChanges.push({ field: "description", from: existing.description, to: config.description });
}
if (existing.network !== config.network) {
routeChanges.push({ field: "network", from: existing.network, to: config.network });
}
if (routeChanges.length > 0) {
if (
existing.enabled !== config.enabled ||
existing.description !== config.description ||
existing.network !== config.network
) {
ops.push({
type: "update_route",
name: networkId,
@ -760,7 +695,6 @@ function diffRoutes(
description: config.description,
network: config.network,
},
changes: routeChanges,
});
}
}
@ -807,17 +741,11 @@ function diffDns(
config.nameservers,
);
const dnsChanges: FieldChange[] = [];
if (existing.enabled !== config.enabled) {
dnsChanges.push({ field: "enabled", from: existing.enabled, to: config.enabled });
}
if (existing.primary !== config.primary) {
dnsChanges.push({ field: "primary", from: existing.primary, to: config.primary });
}
if (nsChanged) {
dnsChanges.push({ field: "nameservers", from: existing.nameservers, to: config.nameservers });
}
if (dnsChanges.length > 0) {
if (
existing.enabled !== config.enabled ||
existing.primary !== config.primary ||
nsChanged
) {
ops.push({
type: "update_dns",
name,
@ -826,7 +754,6 @@ function diffDns(
primary: config.primary,
nameservers: config.nameservers,
},
changes: dnsChanges,
});
}
}

View File

@ -33,17 +33,10 @@ export type OperationType =
| "update_user"
| "delete_user";
export interface FieldChange {
field: string;
from: unknown;
to: unknown;
}
export interface Operation {
type: OperationType;
name: string;
details?: Record<string, unknown>;
changes?: FieldChange[];
}
export interface OperationResult extends Operation {

View File

@ -109,8 +109,6 @@ async function handleReconcile(
operations: ops.map((op) => ({
type: op.type,
name: op.name,
...(op.details && { details: op.details }),
...(op.changes && { changes: op.changes }),
})),
summary: summarize(ops),
});
@ -143,8 +141,6 @@ async function handleReconcile(
type: r.type,
name: r.name,
status: r.status,
...(r.details && { details: r.details }),
...(r.changes && { changes: r.changes }),
})),
created_keys: createdKeysObj,
summary: summarize(results),

View File

@ -15,40 +15,30 @@
"type": "one-off",
"expires_in": 604800,
"usage_limit": 1,
"auto_groups": [
"ground-stations"
],
"auto_groups": ["ground-stations"],
"enrolled": false
},
"Pilot-TestHawk-1": {
"type": "one-off",
"expires_in": 604800,
"usage_limit": 1,
"auto_groups": [
"pilots"
],
"auto_groups": ["pilots"],
"enrolled": false
},
"GS-Enroll-Test": {
"Pilot-Vlad-2": {
"type": "one-off",
"expires_in": 604800,
"usage_limit": 1,
"auto_groups": [
"ground-stations"
],
"enrolled": true
"auto_groups": ["pilots"],
"enrolled": false
}
},
"policies": {
"pilots-to-gs": {
"description": "",
"enabled": false,
"sources": [
"pilots"
],
"destinations": [
"ground-stations"
],
"enabled": true,
"sources": ["pilots"],
"destinations": ["ground-stations"],
"bidirectional": true,
"protocol": "all",
"action": "accept",
@ -57,22 +47,14 @@
"observers-to-gs": {
"description": "",
"enabled": true,
"sources": [
"observers"
],
"destinations": [
"ground-stations"
],
"sources": ["observers"],
"destinations": ["ground-stations"],
"bidirectional": false,
"protocol": "all",
"action": "accept",
"source_posture_checks": []
}
},
"routes": {},
"dns": {
"nameserver_groups": {}
},
"posture_checks": {},
"networks": {},
"peers": {},
@ -82,5 +64,9 @@
"role": "owner",
"auto_groups": []
}
},
"routes": {},
"dns": {
"nameserver_groups": {}
}
}
}