amadan

carlos / platform Public

Sidecar isolation Task 9 (4/5): host.env's allowlist takes the isolation switches (R4-2)

CARLOS_NESTED_WORKERS, CARLOS_FLAT_EXEC and CARLOS_FLAT_EXEC_ALLOW join
hostenv's Optional names, region scoped, so a deployment that assembles
host.env from the parameters can set them; Assemble and Seed take them by
name.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
claude 81421c285c47a7a3f4abd4010eea9be71cba050b parent e0ff141
2 files changed, +48 −0
  • internal/hostenv/hostenv.go +9 −0
  • internal/hostenv/hostenv_test.go +39 −0
diff --git a/internal/hostenv/hostenv.go b/internal/hostenv/hostenv.go
index e89154183..d95b62b14 100644
--- a/internal/hostenv/hostenv.go
+++ b/internal/hostenv/hostenv.go
@@ -77,6 +77,14 @@ var Optional = []string{
"CARLOS_BACKHAUL_MAX_INFLIGHT",
"CARLOS_DNS_PROVIDER",
"CARLOS_EDGE_GZIP",
+ // The isolation switches (sidecar isolation spec D11, D12; R4-2) an
+ // operator sets per box in root-owned host.env. Here they are region
+ // scoped, for the deployments that assemble host.env from the
+ // parameters; a per-box choice there is out of scope, and the flagship
+ // and dev deployments set them one box at a time over their own line
+ // script. CARLOS_NESTED_WORKERS is further down the list.
+ "CARLOS_FLAT_EXEC",
+ "CARLOS_FLAT_EXEC_ALLOW",
"CARLOS_HIBERNATE_IDLE",
"CARLOS_HIBERNATE_PREFIX",
"CARLOS_HOST_CLAIM_RETIRED_LOCATIONS",
@@ -84,6 +92,7 @@ var Optional = []string{
"CARLOS_LAYOUT_DEFAULT",
"CARLOS_MOVES_PHASE1",
"CARLOS_MOVE_READY_DELTA_BYTES",
+ "CARLOS_NESTED_WORKERS",
"CARLOS_PLAN_LIMITS",
"CARLOS_REQUIRE_POINTER_DIGEST",
"CARLOS_S3_ENDPOINT",
diff --git a/internal/hostenv/hostenv_test.go b/internal/hostenv/hostenv_test.go
index 7b61ece70..6aa5bee23 100644
--- a/internal/hostenv/hostenv_test.go
+++ b/internal/hostenv/hostenv_test.go
@@ -426,3 +426,42 @@ func TestStatusOverridesAndTheAlertWebhookAreRefusedByNameNotValue(t *testing.T)
})
}
}
+
+// R4-2: the isolation switches of the sidecar isolation spec (D11, D12)
+// are on the allowlist, so a deployment that assembles host.env from the
+// parameters can set them at region scope: Assemble and Seed take them by
+// name, with the values an operator would write.
+func TestHostEnvAllowsWorkerAndFlatExecNames(t *testing.T) {
+ env := today()
+ env["CARLOS_NESTED_WORKERS"] = "on"
+ env["CARLOS_FLAT_EXEC"] = "refuse"
+ env["CARLOS_FLAT_EXEC_ALLOW"] = "tools.example.com,shop.example.com"
+ for _, name := range []string{"CARLOS_NESTED_WORKERS", "CARLOS_FLAT_EXEC", "CARLOS_FLAT_EXEC_ALLOW"} {
+ if !Allowed(name) {
+ t.Fatalf("%s is not on the allowlist", name)
+ }
+ }
+ shared, regional := Split(env)
+ assembled, err := Assemble(shared, regional)
+ if err != nil {
+ t.Fatalf("Assemble: %v", err)
+ }
+ out, err := Render(assembled)
+ if err != nil {
+ t.Fatalf("Render: %v", err)
+ }
+ for _, line := range []string{"CARLOS_NESTED_WORKERS=on", "CARLOS_FLAT_EXEC=refuse", "CARLOS_FLAT_EXEC_ALLOW=tools.example.com,shop.example.com"} {
+ if !strings.Contains(string(out), line+"\n") {
+ t.Fatalf("rendered file lacks %q:\n%s", line, out)
+ }
+ }
+ p := &fakeParams{vals: map[string]string{}}
+ if _, err := Seed(context.Background(), p, "flagship", "ie", env); err != nil {
+ t.Fatalf("Seed: %v", err)
+ }
+ for _, name := range []string{"CARLOS_NESTED_WORKERS", "CARLOS_FLAT_EXEC", "CARLOS_FLAT_EXEC_ALLOW"} {
+ if _, ok := p.vals["/carlos/flagship/ie/"+name]; !ok {
+ t.Fatalf("Seed did not write the regional %s: %v", name, p.vals)
+ }
+ }
+}