541a32a9cb
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Successful in 2m38s
CD Pipeline / build-and-deploy (push) Failing after 24m19s
CD Pipeline / post-deploy-checks (push) Has been skipped
108 lines
3.9 KiB
Python
108 lines
3.9 KiB
Python
from __future__ import annotations
|
||
|
||
from pathlib import Path
|
||
|
||
import yaml
|
||
|
||
|
||
ROOT = Path(__file__).resolve().parents[3]
|
||
ALERTMANAGER_CONFIG = ROOT / "ops" / "alertmanager" / "alertmanager.yml"
|
||
DEPLOY_SCRIPT = ROOT / "scripts" / "ops" / "deploy-alertmanager-config.sh"
|
||
|
||
|
||
def _config() -> dict:
|
||
return yaml.safe_load(ALERTMANAGER_CONFIG.read_text(encoding="utf-8"))
|
||
|
||
|
||
def _receiver(name: str) -> dict:
|
||
return next(item for item in _config()["receivers"] if item["name"] == name)
|
||
|
||
|
||
def test_awoooi_webhook_uses_public_api_route_not_dead_vip() -> None:
|
||
receiver = _receiver("awoooi-webhook")
|
||
urls = [
|
||
item["url"]
|
||
for item in receiver.get("webhook_configs", [])
|
||
if item.get("url")
|
||
]
|
||
|
||
assert urls == ["https://awoooi.wooo.work/api/v1/webhooks/alertmanager"]
|
||
assert all("192.168.0.125:32334" not in url for url in urls)
|
||
assert all("/api/v1/webhooks/alertmanager" in url for url in urls)
|
||
|
||
|
||
def test_emergency_direct_telegram_stays_limited_to_alert_chain() -> None:
|
||
receiver = _receiver("telegram-direct")
|
||
assert receiver.get("telegram_configs")
|
||
|
||
route_text = str(_config()["route"])
|
||
assert "AWOOOIApiDown" in route_text
|
||
assert 'severity="critical"' in route_text
|
||
|
||
|
||
def test_emergency_card_is_bounded_and_has_honest_automation_attribution() -> None:
|
||
receiver = _receiver("telegram-direct")
|
||
telegram = receiver["telegram_configs"][0]
|
||
message = telegram["message"]
|
||
|
||
assert "SRE BYPASS｜告警主鏈異常" in message
|
||
assert "Prometheus deterministic rule（未呼叫 LLM）" in message
|
||
assert "Executor：none" in message
|
||
assert "未宣稱已修復" in message
|
||
assert "Verifier：source-specific delivery metric" in message
|
||
assert "故障主機" not in message
|
||
telegram_route = next(
|
||
route
|
||
for route in _config()["route"]["routes"]
|
||
if route["receiver"] == "telegram-direct"
|
||
)
|
||
assert telegram_route["repeat_interval"] == "2h"
|
||
|
||
|
||
def test_alertmanager_has_no_agent99_inbound_receiver_or_secret_first_hop() -> None:
|
||
config = _config()
|
||
assert all(
|
||
item.get("receiver") != "agent99-alert-chain-relay"
|
||
for item in config["route"]["routes"]
|
||
)
|
||
assert all(
|
||
receiver.get("name") != "agent99-alert-chain-relay"
|
||
for receiver in config["receivers"]
|
||
)
|
||
source = ALERTMANAGER_CONFIG.read_text(encoding="utf-8")
|
||
assert "192.168.0.99:8787" not in source
|
||
assert "AGENT99_SRE_RELAY_TOKEN_PLACEHOLDER" not in source
|
||
assert "authorization:" not in source
|
||
|
||
|
||
def test_alertmanager_deploy_does_not_inject_agent99_relay_secret() -> None:
|
||
source = DEPLOY_SCRIPT.read_text(encoding="utf-8")
|
||
assert "AGENT99_SRE_ALERT_RELAY_TOKEN" not in source
|
||
assert 'os.environ["AGENT99_SRE_RELAY_TOKEN"]' not in source
|
||
assert "AGENT99_SRE_RELAY_TOKEN_PLACEHOLDER" not in source
|
||
assert "unreplaced secret placeholder remains" in source
|
||
assert "set -x" not in source
|
||
|
||
|
||
def test_secret_bearing_alertmanager_config_and_backups_are_not_world_readable() -> None:
|
||
source = DEPLOY_SCRIPT.read_text(encoding="utf-8")
|
||
|
||
assert "install -m 0600" in source
|
||
assert 'chmod 0600 "\\$legacy_backup"' in source
|
||
assert 'chmod 0400 "\\$target"' in source
|
||
assert 'chmod 0000 "\\$target"' in source
|
||
assert "chmod 0644" not in source
|
||
assert "/proc/\\${container_pid}/status" in source
|
||
assert "runtime_uid" in source
|
||
assert "runtime_gid" in source
|
||
assert "test -r /etc/alertmanager/alertmanager.yml" in source
|
||
assert "rollback_secure" in source
|
||
assert "secure rollback attempted" in source
|
||
assert "amtool check-config /etc/alertmanager/alertmanager.yml" in source
|
||
assert "amtool check-config /dev/stdin" in source
|
||
assert "/tmp/alertmanager-rendered.yml" not in source
|
||
assert "trap 'rm -f \"\\$staged\"' EXIT" in source
|
||
assert source.index('chmod 0000 "\\$target"') < source.index(
|
||
"sudo -n sh -c 'cat \"\\$1\" > \"\\$2\"'"
|
||
)
|