Repository navigation
fix(plugins): nodes add checks for a deploy host before it contacts the host (D-1219) - #401
Merged
Merged
Conversation
acamarata
force-pushed
the
debt-6-d1219
branch
2 times, most recently
from
October 20, 2026 14:07
af9046f to
fda442b
Compare
…he host (D-1219) Add a pre-add hook point that runs on the destination alone, after ParseHostSpec and before the host-key scan. The deploy-host check registers there (identity from ssh -G and DNS only): a match without --allow-deploy-host is refused before any scan, probe or install, and an override is confirmed and audited once, there. Matches that need the host key or machine id are still caught at the add point.
…ource (D-1219) The confirmation taken before contact covers only the match it was given for; a different match found after contact is confirmed again. The installer name is validated before the pre-add hook, so no override is confirmed for an add that cannot proceed.
acamarata
force-pushed
the
debt-6-d1219
branch
from
October 29, 2026 17:37
fda442b to
fd48c8b
Compare
Contributor
Author
|
Rebased onto origin/main and resolved merge conflicts in deployguard override (ConfirmKey semantics), chokepoint/build_v15/node_prepare/single_exec tests, workflow trust YAML, and diagnostic lint refactor. All touched packages pass: protect, provision, deployguard, lifecycle, gates, agent. Pre-existing flaky failures in cmd (TestStreamSurvivesAClosedPipe timeout) and dispatch (TestInvariant_I14 SQLITE_BUSY) are unrelated to this rebase. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
nodes addscanned the host key, ssh-probed and installed the agent before the deploy-host check ran, so a deploy host was still contacted (Epic D9 intends no contact).PointPreAdd, run inDeps.Addafter the destination is parsed and before the scan. Its event carries the destination and node id only.Guard.CheckPreAdd(registered at that point from cmd) matches on the destination (identity from ssh -G and DNS only). A match without--allow-deploy-hostis refused (E663,matched) before any scan, probe, copy or pin. With the flag the override is confirmed and audited once, there; the laterCheckAddtakesConfirmedand neither asks nor audits again.Behaviour change to note: a destination that matches the inventory is now refused outright instead of registered as CI-ineligible; the flag path is unchanged for the operator except that the confirmation comes before contact.
Closes debt row D-1219.