wooo/ewoooc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ops): verify EwoooC metrics payload
Some checks failed
CD Pipeline / deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
ogt
2026-07-11 20:23:38 +08:00
parent 66b6ca04a4
commit 89b149ee79
6 changed files with 45 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
tests/test_metrics_edge_controlled_apply_service.py
View File

@@ -40,11 +40,11 @@ PROMETHEUS_SNIPPET = """ - job_name: 'ewoooc-app'
scheme: http
metrics_path: /metrics
static_configs:
- targets: ['172.20.0.1:9191']
- targets: ['172.20.0.1:19191']
"""
NGINX_BRIDGE = """server {
listen 172.20.0.1:9191;
listen 172.20.0.1:19191;
server_name ewooooc-metrics.internal;
location = /metrics {
allow 172.16.0.0/12;
@@ -84,7 +84,7 @@ def test_render_standalone_nginx_bridge_is_idempotent():
second = render_nginx_config(rendered, NGINX_BRIDGE)
assert rendered == second
assert rendered.count("listen 172.20.0.1:9191") == 1
assert rendered.count("listen 172.20.0.1:19191") == 1
def test_build_plan_is_no_write_and_commit_safe(tmp_path: Path):
@@ -144,6 +144,19 @@ def test_prometheus_config_sha_detects_stale_container_mount(tmp_path: Path, mon
assert container_sha == stale_sha
def test_metrics_canary_requires_ewoooc_product_markers():
from services.metrics_edge_controlled_apply_service import _parse_metrics_canary
valid = (
"momo_app_info 1\nmomo_app_health 1\nmomo_database_up 1"
"\n__EWOOOC_HTTP_STATUS__:200"
)
wrong_exporter = "fail2ban_total_failed 0\n__EWOOOC_HTTP_STATUS__:200"
assert _parse_metrics_canary(valid) == ("200", True)
assert _parse_metrics_canary(wrong_exporter) == ("200", False)
def test_prometheus_identity_verifier_requires_same_image_and_data_volume():
from services.metrics_edge_controlled_apply_service import (
_prometheus_identity_preserved,

4
tests/test_metrics_edge_security.py
View File

@@ -75,7 +75,7 @@ def test_source_owned_edge_and_prometheus_templates_are_closed_by_default():
encoding="utf-8"
)
assert "listen 172.20.0.1:9191;" in nginx
assert "listen 172.20.0.1:19191;" in nginx
assert "location = /metrics" in nginx
assert "allow 172.16.0.0/12;" in nginx
assert "deny all;" in nginx
@@ -83,7 +83,7 @@ def test_source_owned_edge_and_prometheus_templates_are_closed_by_default():
assert "proxy_ssl_verify on;" in nginx
assert "job_name: 'ewoooc-app'" in prometheus
assert "metrics_path: /metrics" in prometheus
assert "targets: ['172.20.0.1:9191']" in prometheus
assert "targets: ['172.20.0.1:19191']" in prometheus
def test_monitoring_compose_has_no_plaintext_admin_password_or_public_prometheus_port():