Allow staging fleet host traffic

Allow staging fleet host traffic

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified infra/staging/main.tf
modified infra/staging/templates/fleet-startup.sh.tftpl
modified test/openagents/staging_candidate_contract_test.exs

Diff

3 files changed, +15 -2

    openagents-runtime-secret = google_secret_manager_secret.runtime["openagents-staging-fleet-config"].secret_id
    openagents-builder-secret = google_secret_manager_secret.runtime["openagents-staging-builder-config"].secret_id
    startup-script = templatefile("${path.module}/templates/fleet-startup.sh.tftpl", {
      project_id = var.staging_project_id
      region     = var.region
      network_cidr = var.network_cidr
      project_id   = var.staging_project_id
      region       = var.region
    })
  }


builder_secret=$(metadata_attribute openagents-builder-secret)
instance_ip=$(metadata instance/network-interfaces/0/ip)

# Container-Optimized OS denies unsolicited host traffic by default. Match the
# VPC admission rule locally so only the staging subnet can reach Phoenix,
# EPMD, and the fixed Erlang distribution range.
iptables -C INPUT -s "${network_cidr}" -p tcp -m multiport \
  --dports 4000,4369,9100:9115 -j ACCEPT 2>/dev/null || \
  iptables -I INPUT -s "${network_cidr}" -p tcp -m multiport \
    --dports 4000,4369,9100:9115 -j ACCEPT

if [ -z "$image" ] || [ -z "$image_digest" ] || [ -z "$source_sha" ]; then
  echo "No staging candidate is assigned; leaving the node fenced."
  exit 0

  end

  test "fleet discovery and release identities use the same stable private addresses" do
    terraform = File.read!("infra/staging/main.tf")
    startup = File.read!("infra/staging/templates/fleet-startup.sh.tftpl")
    outputs = File.read!("infra/staging/outputs.tf")

    assert terraform =~ "network_cidr = var.network_cidr"
    assert startup =~ "instance_ip=$(metadata instance/network-interfaces/0/ip)"
    assert startup =~ ~s(iptables -C INPUT -s "${network_cidr}")
    assert startup =~ "--dports 4000,4369,9100:9115 -j ACCEPT"
    assert startup =~ "DNS_CLUSTER_QUERY=openagents-fleet.staging.internal"
    assert startup =~ "OPENAGENTS_NODE_HOST=$instance_ip"
    assert startup =~ "RELEASE_NODE=openagents@$instance_ip"

630	630		`openagents-runtime-secret = google_secret_manager_secret.runtime["openagents-staging-fleet-config"].secret_id`
631	631		`openagents-builder-secret = google_secret_manager_secret.runtime["openagents-staging-builder-config"].secret_id`
632	632		`startup-script = templatefile("${path.module}/templates/fleet-startup.sh.tftpl", {`
633		-	`project_id = var.staging_project_id`
634		-	`region = var.region`
	633	+	`network_cidr = var.network_cidr`
	634	+	`project_id = var.staging_project_id`
	635	+	`region = var.region`
635	636		`})`
636	637		`}`
637	638

41	41		`builder_secret=$(metadata_attribute openagents-builder-secret)`
42	42		`instance_ip=$(metadata instance/network-interfaces/0/ip)`
43	43
	44	+	`# Container-Optimized OS denies unsolicited host traffic by default. Match the`
	45	+	`# VPC admission rule locally so only the staging subnet can reach Phoenix,`
	46	+	`# EPMD, and the fixed Erlang distribution range.`
	47	+	`iptables -C INPUT -s "${network_cidr}" -p tcp -m multiport \`
	48	+	`--dports 4000,4369,9100:9115 -j ACCEPT 2>/dev/null \|\| \`
	49	+	`iptables -I INPUT -s "${network_cidr}" -p tcp -m multiport \`
	50	+	`--dports 4000,4369,9100:9115 -j ACCEPT`
	51	+
44	52		`if [ -z "$image" ] \|\| [ -z "$image_digest" ] \|\| [ -z "$source_sha" ]; then`
45	53		`echo "No staging candidate is assigned; leaving the node fenced."`
46	54		`exit 0`

45	45		`end`
46	46
47	47		`test "fleet discovery and release identities use the same stable private addresses" do`
	48	+	`terraform = File.read!("infra/staging/main.tf")`
48	49		`startup = File.read!("infra/staging/templates/fleet-startup.sh.tftpl")`
49	50		`outputs = File.read!("infra/staging/outputs.tf")`
50	51
	52	+	`assert terraform =~ "network_cidr = var.network_cidr"`
51	53		`assert startup =~ "instance_ip=$(metadata instance/network-interfaces/0/ip)"`
	54	+	`assert startup =~ ~s(iptables -C INPUT -s "${network_cidr}")`
	55	+	`assert startup =~ "--dports 4000,4369,9100:9115 -j ACCEPT"`
52	56		`assert startup =~ "DNS_CLUSTER_QUERY=openagents-fleet.staging.internal"`
53	57		`assert startup =~ "OPENAGENTS_NODE_HOST=$instance_ip"`
54	58		`assert startup =~ "RELEASE_NODE=openagents@$instance_ip"`