480 lines
17 KiB
Text
480 lines
17 KiB
Text
|
# Mode Configuration Validator
|
||
|
|
# Validates mode configurations against Nickel schemas and runtime requirements
|
||
|
|
|
||
|
|
# utils/logging star-import was dead — dropped (ADR-025 Phase 3 Layer 2).
|
||
|
|
|
||
|
|
# Validate complete mode configuration
|
||
|
|
export def validate-mode-config [
|
||
|
|
mode_name: string # Mode to validate
|
||
|
|
--strict # Strict validation (fail on warnings)
|
||
|
|
] -> record {
|
||
|
|
log-info $"Validating mode configuration: ($mode_name)"
|
||
|
|
|
||
|
|
let config_file = get-mode-file $mode_name
|
||
|
|
|
||
|
|
if not ($config_file | path exists) {
|
||
|
|
error make {
|
||
|
|
msg: $"Mode configuration file not found: ($config_file)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let config = open $config_file
|
||
|
|
|
||
|
|
mut errors = []
|
||
|
|
mut warnings = []
|
||
|
|
|
||
|
|
# Validate structure
|
||
|
|
let struct_result = validate-structure $config
|
||
|
|
$errors = ($errors | append $struct_result.errors)
|
||
|
|
$warnings = ($warnings | append $struct_result.warnings)
|
||
|
|
|
||
|
|
# Validate authentication
|
||
|
|
let auth_result = validate-authentication-config $config.authentication
|
||
|
|
$errors = ($errors | append $auth_result.errors)
|
||
|
|
$warnings = ($warnings | append $auth_result.warnings)
|
||
|
|
|
||
|
|
# Validate services
|
||
|
|
let service_result = validate-services-config $config.services
|
||
|
|
$errors = ($errors | append $service_result.errors)
|
||
|
|
$warnings = ($warnings | append $service_result.warnings)
|
||
|
|
|
||
|
|
# Validate extensions
|
||
|
|
let ext_result = validate-extensions-config $config.extensions
|
||
|
|
$errors = ($errors | append $ext_result.errors)
|
||
|
|
$warnings = ($warnings | append $ext_result.warnings)
|
||
|
|
|
||
|
|
# Validate workspaces
|
||
|
|
let ws_result = validate-workspace-config $config.workspaces
|
||
|
|
$errors = ($errors | append $ws_result.errors)
|
||
|
|
$warnings = ($warnings | append $ws_result.warnings)
|
||
|
|
|
||
|
|
# Validate security
|
||
|
|
let sec_result = validate-security-config $config.security
|
||
|
|
$errors = ($errors | append $sec_result.errors)
|
||
|
|
$warnings = ($warnings | append $sec_result.warnings)
|
||
|
|
|
||
|
|
# Determine success
|
||
|
|
let has_errors = (($errors | length) > 0)
|
||
|
|
let has_warnings = (($warnings | length) > 0)
|
||
|
|
let success = if $strict {
|
||
|
|
not $has_errors and not $has_warnings
|
||
|
|
} else {
|
||
|
|
not $has_errors
|
||
|
|
}
|
||
|
|
|
||
|
|
{
|
||
|
|
mode: $mode_name
|
||
|
|
success: $success
|
||
|
|
errors: $errors
|
||
|
|
warnings: $warnings
|
||
|
|
error_count: ($errors | length)
|
||
|
|
warning_count: ($warnings | length)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate mode structure
|
||
|
|
def validate-structure [config: record] -> record {
|
||
|
|
mut errors = []
|
||
|
|
mut warnings = []
|
||
|
|
|
||
|
|
# Required top-level fields
|
||
|
|
let required = ["mode", "description", "authentication", "services", "extensions", "workspaces", "security"]
|
||
|
|
|
||
|
|
for field in $required {
|
||
|
|
if not ($field in $config) {
|
||
|
|
$errors = ($errors | append $"Missing required field: ($field)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate mode name
|
||
|
|
if "mode" in $config {
|
||
|
|
let valid_modes = ["solo", "multi-user", "cicd", "enterprise"]
|
||
|
|
if not ($config.mode in $valid_modes) {
|
||
|
|
$errors = ($errors | append $"Invalid mode: ($config.mode). Must be one of: ($valid_modes | str join ', ')")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
{errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate authentication configuration
|
||
|
|
def validate-authentication-config [auth: record] -> record {
|
||
|
|
mut errors = []
|
||
|
|
mut warnings = []
|
||
|
|
|
||
|
|
if not ("type" in $auth) {
|
||
|
|
$errors = ($errors | append "Authentication type not specified")
|
||
|
|
return {errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
let valid_types = ["none", "token", "mtls", "oauth", "kms"]
|
||
|
|
if not ($auth.type in $valid_types) {
|
||
|
|
$errors = ($errors | append $"Invalid authentication type: ($auth.type)")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Type-specific validation
|
||
|
|
match $auth.type {
|
||
|
|
"token" => {
|
||
|
|
if not ("token_path" in $auth) {
|
||
|
|
$errors = ($errors | append "Token path required for token authentication")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"mtls" => {
|
||
|
|
if not ("mtls" in $auth) {
|
||
|
|
$errors = ($errors | append "mTLS configuration required")
|
||
|
|
} else {
|
||
|
|
let mtls = $auth.mtls
|
||
|
|
let required_certs = ["client_cert_path", "client_key_path", "ca_cert_path"]
|
||
|
|
for cert in $required_certs {
|
||
|
|
if not ($cert in $mtls) {
|
||
|
|
$errors = ($errors | append $"Missing mTLS field: ($cert)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"oauth" => {
|
||
|
|
if not ("oauth" in $auth) {
|
||
|
|
$errors = ($errors | append "OAuth configuration required")
|
||
|
|
} else {
|
||
|
|
let oauth = $auth.oauth
|
||
|
|
if not ("provider_url" in $oauth) {
|
||
|
|
$errors = ($errors | append "OAuth provider_url required")
|
||
|
|
}
|
||
|
|
if not ("client_id" in $oauth) {
|
||
|
|
$errors = ($errors | append "OAuth client_id required")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# SSH key storage validation
|
||
|
|
if "ssh_key_storage" in $auth {
|
||
|
|
let valid_storage = ["local", "kms", "vault"]
|
||
|
|
if not ($auth.ssh_key_storage in $valid_storage) {
|
||
|
|
$errors = ($errors | append $"Invalid ssh_key_storage: ($auth.ssh_key_storage)")
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($auth.ssh_key_storage == "kms") and not ("kms" in $auth) {
|
||
|
|
$warnings = ($warnings | append "SSH key storage set to KMS but no KMS configuration provided")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
{errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate services configuration
|
||
|
|
def validate-services-config [services: record] -> record {
|
||
|
|
mut errors = []
|
||
|
|
mut warnings = []
|
||
|
|
|
||
|
|
# Required services
|
||
|
|
let required_services = ["orchestrator", "oci-registry"]
|
||
|
|
|
||
|
|
for service in $required_services {
|
||
|
|
if not ($service in $services) {
|
||
|
|
$errors = ($errors | append $"Missing required service: ($service)")
|
||
|
|
} else {
|
||
|
|
let svc = $services | get $service
|
||
|
|
if not ("deployment" in $svc) {
|
||
|
|
$errors = ($errors | append $"Service ($service) missing 'deployment' field")
|
||
|
|
} else {
|
||
|
|
let valid_deployments = ["local", "remote", "k8s", "disabled"]
|
||
|
|
if not ($svc.deployment in $valid_deployments) {
|
||
|
|
$errors = ($errors | append $"Invalid deployment type for ($service): ($svc.deployment)")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Deployment-specific validation
|
||
|
|
match $svc.deployment {
|
||
|
|
"local" => {
|
||
|
|
if not ("data_dir" in $svc) and not ("local_config" in $svc) {
|
||
|
|
$warnings = ($warnings | append $"Local service ($service) should specify data_dir")
|
||
|
|
}
|
||
|
|
if not ("port" in $svc) {
|
||
|
|
$warnings = ($warnings | append $"Local service ($service) should specify port")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"remote" => {
|
||
|
|
if not ("endpoint" in $svc) and not ("remote_config" in $svc) {
|
||
|
|
$errors = ($errors | append $"Remote service ($service) must specify endpoint")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"k8s" => {
|
||
|
|
if not ("namespace" in $svc) and not ("k8s_config" in $svc) {
|
||
|
|
$errors = ($errors | append $"K8s service ($service) must specify namespace")
|
||
|
|
}
|
||
|
|
if not ("deployment_name" in $svc) and not ("k8s_config" in $svc) {
|
||
|
|
$errors = ($errors | append $"K8s service ($service) must specify deployment_name")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate OCI registry specific fields
|
||
|
|
if "oci-registry" in $services {
|
||
|
|
let oci = $services."oci-registry"
|
||
|
|
if $oci.deployment != "disabled" {
|
||
|
|
if not ("type" in $oci) {
|
||
|
|
$errors = ($errors | append "OCI registry type not specified")
|
||
|
|
} else {
|
||
|
|
let valid_types = ["distribution", "zot", "harbor", "artifactory"]
|
||
|
|
if not ($oci.type in $valid_types) {
|
||
|
|
$errors = ($errors | append $"Invalid OCI registry type: ($oci.type)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if not ("endpoint" in $oci) {
|
||
|
|
$errors = ($errors | append "OCI registry endpoint not specified")
|
||
|
|
}
|
||
|
|
|
||
|
|
if "namespaces" in $oci {
|
||
|
|
let ns = $oci.namespaces
|
||
|
|
let required_ns = ["extensions", "nickel_packages", "platform_images", "test_images"]
|
||
|
|
for n in $required_ns {
|
||
|
|
if not ($n in $ns) {
|
||
|
|
$warnings = ($warnings | append $"OCI registry namespace missing: ($n)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
$warnings = ($warnings | append "OCI registry namespaces not configured")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
{errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate extensions configuration
|
||
|
|
def validate-extensions-config [extensions: record] -> record {
|
||
|
|
mut errors = []
|
||
|
|
mut warnings = []
|
||
|
|
|
||
|
|
if not ("source" in $extensions) {
|
||
|
|
$errors = ($errors | append "Extension source not specified")
|
||
|
|
return {errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
let valid_sources = ["local", "gitea", "oci", "mixed"]
|
||
|
|
if not ($extensions.source in $valid_sources) {
|
||
|
|
$errors = ($errors | append $"Invalid extension source: ($extensions.source)")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Source-specific validation
|
||
|
|
match $extensions.source {
|
||
|
|
"local" => {
|
||
|
|
if not ("local_path" in $extensions) {
|
||
|
|
$warnings = ($warnings | append "Local extension source should specify local_path")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"gitea" => {
|
||
|
|
if not ("gitea_config" in $extensions) {
|
||
|
|
$errors = ($errors | append "Gitea configuration required for gitea source")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
"oci" => {
|
||
|
|
if not ("oci_registry" in $extensions) {
|
||
|
|
$errors = ($errors | append "OCI registry configuration required for oci source")
|
||
|
|
} else {
|
||
|
|
if not $extensions.oci_registry.enabled {
|
||
|
|
$warnings = ($warnings | append "OCI source selected but OCI registry not enabled")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
{errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate workspace configuration
|
||
|
|
def validate-workspace-config [workspaces: record] -> record {
|
||
|
|
mut errors = []
|
||
|
|
mut warnings = []
|
||
|
|
|
||
|
|
if not ("locking" in $workspaces) {
|
||
|
|
$errors = ($errors | append "Workspace locking policy not specified")
|
||
|
|
return {errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
let valid_locking = ["disabled", "enabled", "required"]
|
||
|
|
if not ($workspaces.locking in $valid_locking) {
|
||
|
|
$errors = ($errors | append $"Invalid locking policy: ($workspaces.locking)")
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($workspaces.locking in ["enabled", "required"]) {
|
||
|
|
if not ("lock_provider" in $workspaces) {
|
||
|
|
$errors = ($errors | append "Lock provider required when locking is enabled")
|
||
|
|
} else {
|
||
|
|
let valid_providers = ["gitea", "etcd", "redis", "filesystem"]
|
||
|
|
if not ($workspaces.lock_provider in $valid_providers) {
|
||
|
|
$errors = ($errors | append $"Invalid lock provider: ($workspaces.lock_provider)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if not ("git_integration" in $workspaces) {
|
||
|
|
$warnings = ($warnings | append "Git integration policy not specified")
|
||
|
|
} else {
|
||
|
|
let valid_git = ["disabled", "optional", "required"]
|
||
|
|
if not ($workspaces.git_integration in $valid_git) {
|
||
|
|
$errors = ($errors | append $"Invalid git integration: ($workspaces.git_integration)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if not ("isolation" in $workspaces) {
|
||
|
|
$warnings = ($warnings | append "Workspace isolation not specified, using default")
|
||
|
|
}
|
||
|
|
|
||
|
|
{errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate security configuration
|
||
|
|
def validate-security-config [security: record] -> record {
|
||
|
|
mut errors = []
|
||
|
|
mut warnings = []
|
||
|
|
|
||
|
|
# Check encryption settings
|
||
|
|
if not ("encryption_at_rest" in $security) {
|
||
|
|
$warnings = ($warnings | append "Encryption at rest not specified")
|
||
|
|
}
|
||
|
|
|
||
|
|
if not ("encryption_in_transit" in $security) {
|
||
|
|
$warnings = ($warnings | append "Encryption in transit not specified")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate DNS modification
|
||
|
|
if "dns_modification" in $security {
|
||
|
|
let valid_dns = ["none", "coredns", "system"]
|
||
|
|
if not ($security.dns_modification in $valid_dns) {
|
||
|
|
$errors = ($errors | append $"Invalid dns_modification: ($security.dns_modification)")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate audit logging
|
||
|
|
if "audit_logging" in $security and $security.audit_logging {
|
||
|
|
if not ("audit_log_path" in $security) {
|
||
|
|
$errors = ($errors | append "Audit log path required when audit logging enabled")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Validate secret provider
|
||
|
|
if "secret_provider" in $security {
|
||
|
|
let sp = $security.secret_provider
|
||
|
|
if not ("type" in $sp) {
|
||
|
|
$errors = ($errors | append "Secret provider type not specified")
|
||
|
|
} else {
|
||
|
|
let valid_types = ["sops", "kms"]
|
||
|
|
if not ($sp.type in $valid_types) {
|
||
|
|
$errors = ($errors | append $"Invalid secret provider type: ($sp.type)")
|
||
|
|
}
|
||
|
|
|
||
|
|
# Type-specific validation
|
||
|
|
if ($sp.type == "sops") and not ("age_key_file" in $sp) {
|
||
|
|
$warnings = ($warnings | append "SOPS configured but age_key_file not specified")
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($sp.type == "kms") and not ("server_url" in $sp) {
|
||
|
|
$errors = ($errors | append "KMS server_url required for KMS secret provider")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
{errors: $errors, warnings: $warnings}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Check runtime requirements for mode
|
||
|
|
export def check-runtime-requirements [
|
||
|
|
mode_name: string
|
||
|
|
] -> record {
|
||
|
|
let config_file = get-mode-file $mode_name
|
||
|
|
let config = open $config_file
|
||
|
|
|
||
|
|
mut checks = []
|
||
|
|
|
||
|
|
# Check for required binaries
|
||
|
|
match $config.services.orchestrator.deployment {
|
||
|
|
"local" => {
|
||
|
|
let orch_check = (which orchestrator | length) > 0
|
||
|
|
$checks = ($checks | append {
|
||
|
|
check: "Orchestrator binary"
|
||
|
|
required: true
|
||
|
|
available: $orch_check
|
||
|
|
message: if $orch_check { "Found" } else { "Not found in PATH" }
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Check for OCI registry tools
|
||
|
|
if $config.services.oci-registry.deployment == "local" {
|
||
|
|
let registry_type = $config.services.oci-registry.type
|
||
|
|
let bin_check = (which $registry_type | length) > 0
|
||
|
|
$checks = ($checks | append {
|
||
|
|
check: $"OCI registry binary \(($registry_type))"
|
||
|
|
required: false
|
||
|
|
available: $bin_check
|
||
|
|
message: if $bin_check { "Found" } else { $"($registry_type) not found in PATH" }
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
# Check for authentication requirements
|
||
|
|
match $config.authentication.type {
|
||
|
|
"token" => {
|
||
|
|
let token_path = $config.authentication.token_path | str replace "~" $env.HOME
|
||
|
|
let token_exists = ($token_path | path exists)
|
||
|
|
$checks = ($checks | append {
|
||
|
|
check: "Authentication token"
|
||
|
|
required: true
|
||
|
|
available: $token_exists
|
||
|
|
message: if $token_exists { $"Found at ($token_path)" } else { $"Not found at ($token_path)" }
|
||
|
|
})
|
||
|
|
}
|
||
|
|
"mtls" => {
|
||
|
|
if "mtls" in $config.authentication {
|
||
|
|
let cert_path = $config.authentication.mtls.client_cert_path
|
||
|
|
let cert_exists = ($cert_path | path exists)
|
||
|
|
$checks = ($checks | append {
|
||
|
|
check: "mTLS client certificate"
|
||
|
|
required: true
|
||
|
|
available: $cert_exists
|
||
|
|
message: if $cert_exists { $"Found at ($cert_path)" } else { $"Not found at ($cert_path)" }
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Check for Kubernetes (if using k8s deployment)
|
||
|
|
if ($config.services.orchestrator.deployment == "k8s") {
|
||
|
|
let kubectl_check = (which kubectl | length) > 0
|
||
|
|
$checks = ($checks | append {
|
||
|
|
check: "kubectl"
|
||
|
|
required: true
|
||
|
|
available: $kubectl_check
|
||
|
|
message: if $kubectl_check { "Found" } else { "Not found in PATH" }
|
||
|
|
})
|
||
|
|
|
||
|
|
if $kubectl_check {
|
||
|
|
let cluster_check = (do { kubectl cluster-info } | complete).exit_code == 0
|
||
|
|
$checks = ($checks | append {
|
||
|
|
check: "Kubernetes cluster access"
|
||
|
|
required: true
|
||
|
|
available: $cluster_check
|
||
|
|
message: if $cluster_check { "Connected" } else { "Cannot connect to cluster" }
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let all_required_met = ($checks | where required | all {|c| $c.available })
|
||
|
|
|
||
|
|
{
|
||
|
|
mode: $mode_name
|
||
|
|
all_requirements_met: $all_required_met
|
||
|
|
checks: $checks
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Helper: Get mode file path
|
||
|
|
def get-mode-file [mode: string] -> string {
|
||
|
|
let modes_dir = $env.PROVISIONING_PROJECT_ROOT? | default (pwd) | path join "workspace" "config" "modes"
|
||
|
|
$modes_dir | path join $"($mode).yaml"
|
||
|
|
}
|