docs: build de 9ab730a738
This commit is contained in:
parent
02f1aaebdf
commit
ff5220f181
382 changed files with 64868 additions and 4 deletions
560
0.2.0rc002/architecture/contraintes.html
Normal file
560
0.2.0rc002/architecture/contraintes.html
Normal file
|
|
@ -0,0 +1,560 @@
|
|||
|
||||
<!DOCTYPE html>
|
||||
|
||||
|
||||
<html lang="fr" data-content_root="../" >
|
||||
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
|
||||
<title>Invariants et pièges — Documentation two 0.1.0</title>
|
||||
|
||||
|
||||
|
||||
<script data-cfasync="false">
|
||||
document.documentElement.dataset.mode = localStorage.getItem("mode") || "";
|
||||
document.documentElement.dataset.theme = localStorage.getItem("theme") || "";
|
||||
</script>
|
||||
<!--
|
||||
this give us a css class that will be invisible only if js is disabled
|
||||
-->
|
||||
<noscript>
|
||||
<style>
|
||||
.pst-js-only { display: none !important; }
|
||||
|
||||
</style>
|
||||
</noscript>
|
||||
|
||||
<!-- Loaded before other Sphinx assets -->
|
||||
<link href="../_static/styles/theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
|
||||
<link href="../_static/styles/pydata-sphinx-theme.css?digest=8878045cc6db502f8baf" rel="stylesheet" />
|
||||
|
||||
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=8f2a1f02" />
|
||||
<link rel="stylesheet" type="text/css" href="../_static/styles/sphinx-book-theme.css?v=3c74b3bc" />
|
||||
|
||||
<!-- So that users can add custom icons -->
|
||||
<script src="../_static/scripts/fontawesome.js?digest=8878045cc6db502f8baf"></script>
|
||||
<!-- Pre-loaded scripts that we'll load fully later -->
|
||||
<link rel="preload" as="script" href="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf" />
|
||||
<link rel="preload" as="script" href="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf" />
|
||||
|
||||
<script src="../_static/documentation_options.js?v=4d0cb239"></script>
|
||||
<script src="../_static/doctools.js?v=fd6eb6e6"></script>
|
||||
<script src="../_static/sphinx_highlight.js?v=6ffebe34"></script>
|
||||
<script src="../_static/scripts/sphinx-book-theme.js?v=fab101a9"></script>
|
||||
<script src="../_static/translations.js?v=e6b791cb"></script>
|
||||
<script>DOCUMENTATION_OPTIONS.pagename = 'architecture/contraintes';</script>
|
||||
<link rel="index" title="Index" href="../genindex.html" />
|
||||
<link rel="search" title="Recherche" href="../search.html" />
|
||||
<link rel="next" title="Versions" href="../versions/index.html" />
|
||||
<link rel="prev" title="Schéma des clés" href="stockage.html" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
||||
<meta name="docsearch:language" content="fr"/>
|
||||
<meta name="docsearch:version" content="0.1" />
|
||||
</head>
|
||||
|
||||
|
||||
<body data-bs-spy="scroll" data-bs-target=".bd-toc-nav" data-offset="180" data-bs-root-margin="0px 0px -60%" data-default-mode="">
|
||||
|
||||
|
||||
|
||||
<div id="pst-skip-link" class="skip-link d-print-none"><a href="#main-content">Passer au contenu principal</a></div>
|
||||
|
||||
<div id="pst-scroll-pixel-helper"></div>
|
||||
|
||||
<button type="button" class="btn rounded-pill" id="pst-back-to-top">
|
||||
<i class="fa-solid fa-arrow-up"></i>Haut de page</button>
|
||||
|
||||
|
||||
<dialog id="pst-search-dialog">
|
||||
|
||||
<form class="bd-search d-flex align-items-center"
|
||||
action="../search.html"
|
||||
method="get">
|
||||
<i class="fa-solid fa-magnifying-glass"></i>
|
||||
<input type="search"
|
||||
class="form-control"
|
||||
name="q"
|
||||
placeholder="Search..."
|
||||
aria-label="Search..."
|
||||
autocomplete="off"
|
||||
autocorrect="off"
|
||||
autocapitalize="off"
|
||||
spellcheck="false"/>
|
||||
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd>K</kbd></span>
|
||||
</form>
|
||||
</dialog>
|
||||
|
||||
<div class="pst-async-banner-revealer d-none">
|
||||
<aside id="bd-header-version-warning" class="d-none d-print-none" aria-label="Alerte de version"></aside>
|
||||
</div>
|
||||
|
||||
|
||||
<header class="bd-header navbar navbar-expand-lg bd-navbar d-print-none">
|
||||
</header>
|
||||
|
||||
|
||||
<div class="bd-container">
|
||||
<div class="bd-container__inner bd-page-width">
|
||||
|
||||
|
||||
|
||||
<dialog id="pst-primary-sidebar-modal"></dialog>
|
||||
<div id="pst-primary-sidebar" class="bd-sidebar-primary bd-sidebar">
|
||||
|
||||
|
||||
|
||||
<div class="sidebar-header-items sidebar-primary__section">
|
||||
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
<div class="sidebar-primary-items__start sidebar-primary__section">
|
||||
<div class="sidebar-primary-item">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<a class="navbar-brand logo" href="../index.html">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<p class="title logo__title">Documentation two 0.1.0</p>
|
||||
|
||||
</a></div>
|
||||
<div class="sidebar-primary-item">
|
||||
|
||||
<button class="btn search-button-field search-button__button pst-js-only" title="Recherche" aria-label="Recherche" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
||||
<i class="fa-solid fa-magnifying-glass"></i>
|
||||
<span class="search-button__default-text">Recherche</span>
|
||||
<span class="search-button__kbd-shortcut"><kbd class="kbd-shortcut__modifier">Ctrl</kbd>+<kbd class="kbd-shortcut__modifier">K</kbd></span>
|
||||
</button></div>
|
||||
<div class="sidebar-primary-item"><nav class="bd-links bd-docs-nav" aria-label="Main">
|
||||
<div class="bd-toc-item navbar-nav active">
|
||||
|
||||
<ul class="nav bd-sidenav bd-sidenav__home-link">
|
||||
<li class="toctree-l1">
|
||||
<a class="reference internal" href="../index.html">
|
||||
two
|
||||
</a>
|
||||
</li>
|
||||
</ul>
|
||||
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Mise en œuvre</span></p>
|
||||
<ul class="nav bd-sidenav">
|
||||
<li class="toctree-l1 has-children"><a class="reference internal" href="../demarrage/index.html">Démarrage</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../demarrage/installation.html">Installation d’un hyperviseur</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../demarrage/premier-vpc.html">Premier VPC, premier subnet, première VM</a></li>
|
||||
</ul>
|
||||
</details></li>
|
||||
<li class="toctree-l1 has-children"><a class="reference internal" href="../deploiement/index.html">Déploiement d’un cluster</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../deploiement/architecture-cluster.html">Architecture du cluster</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../deploiement/image-qcow2.html">Construction de l’image qcow2</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../deploiement/routeurs.html">Routeurs</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../deploiement/premier-hyperviseur.html">Premier hyperviseur</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../deploiement/route-reflector.html">VM route reflector</a></li>
|
||||
</ul>
|
||||
</details></li>
|
||||
</ul>
|
||||
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Exploitation</span></p>
|
||||
<ul class="nav bd-sidenav">
|
||||
<li class="toctree-l1 has-children"><a class="reference internal" href="../exploitation/index.html">Exploitation</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../exploitation/configuration.html">Configuration</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../exploitation/services.html">Services systemd</a></li>
|
||||
<li class="toctree-l2 has-children"><a class="reference internal" href="../exploitation/api-agent/index.html">API de l’agent</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
|
||||
<li class="toctree-l3"><a class="reference internal" href="../exploitation/api-agent/asynchronisme.html">Modèle asynchrone et codes de retour</a></li>
|
||||
<li class="toctree-l3"><a class="reference internal" href="../exploitation/api-agent/reference.html">Référence</a></li>
|
||||
</ul>
|
||||
</details></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../exploitation/observabilite.html">Observabilité</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../exploitation/diagnostic.html">Diagnostic</a></li>
|
||||
</ul>
|
||||
</details></li>
|
||||
</ul>
|
||||
<p aria-level="2" class="caption" role="heading"><span class="caption-text">Interne</span></p>
|
||||
<ul class="current nav bd-sidenav">
|
||||
<li class="toctree-l1 has-children"><a class="reference internal" href="../concepts/index.html">Concepts</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../concepts/vpc-subnet-vm.html">VPC, subnet et VM</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../concepts/modes-reseau.html">Modes réseau</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../concepts/cycle-de-vie.html">Cycle de vie des ressources</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../concepts/metadata-cloud-init.html">Metadata et cloud-init</a></li>
|
||||
</ul>
|
||||
</details></li>
|
||||
<li class="toctree-l1 current active has-children"><a class="reference internal" href="index.html">Architecture</a><details open="open"><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul class="current">
|
||||
<li class="toctree-l2"><a class="reference internal" href="vue-densemble.html">Vue d’ensemble</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="stockage.html">Schéma des clés</a></li>
|
||||
<li class="toctree-l2 current active"><a class="current reference internal" href="#">Invariants et pièges</a></li>
|
||||
</ul>
|
||||
</details></li>
|
||||
<li class="toctree-l1 has-children"><a class="reference internal" href="../versions/index.html">Versions</a><details><summary><span class="toctree-toggle" role="presentation"><i class="fa-solid fa-chevron-down"></i></span></summary><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="../versions/0.1.0.html">Michael</a></li>
|
||||
</ul>
|
||||
</details></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</nav></div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="sidebar-primary-items__end sidebar-primary__section">
|
||||
<div class="sidebar-primary-item">
|
||||
<div id="ethical-ad-placement"
|
||||
class="flat"
|
||||
data-ea-publisher="readthedocs"
|
||||
data-ea-type="readthedocs-sidebar"
|
||||
data-ea-manual="true">
|
||||
</div></div>
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
<main id="main-content" class="bd-main" role="main">
|
||||
|
||||
|
||||
|
||||
<div class="sbt-scroll-pixel-helper"></div>
|
||||
|
||||
<div class="bd-content">
|
||||
<div class="bd-article-container">
|
||||
|
||||
<div class="bd-header-article d-print-none">
|
||||
<div class="header-article-items header-article__inner">
|
||||
|
||||
<div class="header-article-items__start">
|
||||
|
||||
<div class="header-article-item"><button class="sidebar-toggle primary-toggle btn btn-sm" title="Toggle primary sidebar" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
||||
<span class="fa-solid fa-bars"></span>
|
||||
</button></div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
<div class="header-article-items__end">
|
||||
|
||||
<div class="header-article-item">
|
||||
|
||||
<div class="article-header-buttons">
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="dropdown dropdown-download-buttons">
|
||||
<button class="btn dropdown-toggle" type="button" data-bs-toggle="dropdown" aria-expanded="false" aria-label="Téléchargez cette page">
|
||||
<i class="fas fa-download"></i>
|
||||
</button>
|
||||
<ul class="dropdown-menu">
|
||||
|
||||
|
||||
|
||||
<li><a href="../_sources/architecture/contraintes.rst" target="_blank"
|
||||
class="btn btn-sm btn-download-source-button dropdown-item"
|
||||
title="Télécharger le fichier source"
|
||||
data-bs-placement="left" data-bs-toggle="tooltip"
|
||||
>
|
||||
|
||||
|
||||
<span class="btn__icon-container">
|
||||
<i class="fas fa-file"></i>
|
||||
</span>
|
||||
<span class="btn__text-container">.rst</span>
|
||||
</a>
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
<li>
|
||||
<button onclick="window.print()"
|
||||
class="btn btn-sm btn-download-pdf-button dropdown-item"
|
||||
title="Imprimer au format PDF"
|
||||
data-bs-placement="left" data-bs-toggle="tooltip"
|
||||
>
|
||||
|
||||
|
||||
<span class="btn__icon-container">
|
||||
<i class="fas fa-file-pdf"></i>
|
||||
</span>
|
||||
<span class="btn__text-container">.pdf</span>
|
||||
</button>
|
||||
</li>
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
<button onclick="toggleFullScreen()"
|
||||
class="btn btn-sm btn-fullscreen-button pst-navbar-icon"
|
||||
title="Mode plein écran"
|
||||
data-bs-placement="bottom" data-bs-toggle="tooltip"
|
||||
>
|
||||
|
||||
|
||||
<span class="btn__icon-container">
|
||||
<i class="fas fa-expand"></i>
|
||||
</span>
|
||||
|
||||
</button>
|
||||
|
||||
|
||||
|
||||
<button class="btn btn-sm nav-link pst-navbar-icon theme-switch-button pst-js-only" aria-label="Thème" data-bs-title="Thème" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
||||
<i class="theme-switch fa-solid fa-sun fa-lg" data-mode="light" title="Clair"></i>
|
||||
<i class="theme-switch fa-solid fa-moon fa-lg" data-mode="dark" title="Sombre"></i>
|
||||
<i class="theme-switch fa-solid fa-circle-half-stroke fa-lg" data-mode="auto" title="Paramètres système"></i>
|
||||
</button>
|
||||
|
||||
|
||||
<button class="btn btn-sm pst-navbar-icon search-button search-button__button pst-js-only" title="Recherche" aria-label="Recherche" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
||||
<i class="fa-solid fa-magnifying-glass fa-lg"></i>
|
||||
</button>
|
||||
<button class="sidebar-toggle secondary-toggle btn btn-sm pst-navbar-icon" title="Toggle secondary sidebar" data-bs-placement="bottom" data-bs-toggle="tooltip">
|
||||
<span class="fa-solid fa-list"></span>
|
||||
</button>
|
||||
</div></div>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<div id="jb-print-docs-body" class="onlyprint">
|
||||
<h1>Invariants et pièges</h1>
|
||||
<!-- Table of contents -->
|
||||
<div id="print-main-content">
|
||||
<div id="jb-print-toc">
|
||||
|
||||
<div>
|
||||
<h2> Contenu </h2>
|
||||
</div>
|
||||
<nav aria-label="Page">
|
||||
<ul class="visible nav section-nav flex-column">
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#reseau">Réseau</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#qemu-et-vm">QEMU et VM</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#arret-de-l-agent">Arrêt de l’agent</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#cloud-init">cloud-init</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#configuration">Configuration</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#securite-connue-et-acceptee">Sécurité connue et acceptée</a></li>
|
||||
</ul>
|
||||
</nav>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<div id="searchbox"></div>
|
||||
<article class="bd-article">
|
||||
|
||||
<section id="invariants-et-pieges">
|
||||
<h1>Invariants et pièges<a class="headerlink" href="#invariants-et-pieges" title="Lien vers cette rubrique">#</a></h1>
|
||||
<p>Contraintes découvertes en production ou en corrigeant des bugs. Les enfreindre casse quelque
|
||||
chose qui fonctionne, souvent en silence.</p>
|
||||
<div class="admonition note">
|
||||
<p class="admonition-title">Note</p>
|
||||
<p>Cette page reprend la section « Invariants et pièges » de <code class="docutils literal notranslate"><span class="pre">CLAUDE.md</span></code>, qui reste la
|
||||
référence de développement et fait foi en cas d’écart.</p>
|
||||
</div>
|
||||
<section id="reseau">
|
||||
<h2>Réseau<a class="headerlink" href="#reseau" title="Lien vers cette rubrique">#</a></h2>
|
||||
<ul class="simple">
|
||||
<li><p><strong>Ne pas retirer la route ``/32`` vers ``169.254.169.254``</strong> de l’option 121, même quand elle
|
||||
paraît redondante avec la route par défaut. La DNAT vers le serveur de metadata est posée dans
|
||||
le netns du VPC en <code class="docutils literal notranslate"><span class="pre">PREROUTING</span></code> : le paquet n’y est traité en L3 que si son next-hop est
|
||||
<code class="docutils literal notranslate"><span class="pre">interface_ip</span></code>. Avec un autre next-hop, la trame est commutée en L2 sans traverser
|
||||
<code class="docutils literal notranslate"><span class="pre">PREROUTING</span></code>, et le provisionnement cloud-init échoue.</p></li>
|
||||
<li><p><strong>RFC 3442</strong> : un client qui lit l’option 121 <strong>ignore l’option 3</strong>. Toute route par défaut
|
||||
doit donc figurer dans la 121 ; l’option 3 ne sert que les clients qui n’implémentent pas la
|
||||
121.</p></li>
|
||||
<li><p><strong>La route vers le CIDR du VPC garde ``interface_ip`` comme next-hop</strong> dans tous les modes sauf
|
||||
<code class="docutils literal notranslate"><span class="pre">bridge</span></code> : sur un subnet à IP publique, le trafic interne ne doit pas sortir par la gateway
|
||||
publique.</p></li>
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">169.254.169.254</span></code> est centralisé dans <code class="docutils literal notranslate"><span class="pre">metadata.ServiceIP</span></code> — ne pas le réécrire en dur.</p></li>
|
||||
</ul>
|
||||
</section>
|
||||
<section id="qemu-et-vm">
|
||||
<h2>QEMU et VM<a class="headerlink" href="#qemu-et-vm" title="Lien vers cette rubrique">#</a></h2>
|
||||
<ul class="simple">
|
||||
<li><p><strong>Un seul disque ``vdX`` par VM</strong> ; les disques additionnels passent par le SCSI (<code class="docutils literal notranslate"><span class="pre">sdX</span></code>). La
|
||||
carte PCI en dépend : NIC en <code class="docutils literal notranslate"><span class="pre">0x03</span></code>, contrôleur SCSI en <code class="docutils literal notranslate"><span class="pre">0x1e</span></code>, virtio-blk en <code class="docutils literal notranslate"><span class="pre">0x1f</span></code>.</p></li>
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">bus=pci.0</span></code> est explicite sur les trois <code class="docutils literal notranslate"><span class="pre">-device</span></code> : un passage de la machine en <strong>q35</strong>
|
||||
casserait le démarrage (<code class="docutils literal notranslate"><span class="pre">Bus</span> <span class="pre">'pci.0'</span> <span class="pre">not</span> <span class="pre">found</span></code>).</p></li>
|
||||
<li><p>QEMU est lancé par <code class="docutils literal notranslate"><span class="pre">systemd-run</span> <span class="pre">--scope</span></code>, <strong>jamais</strong> en unit transitoire : le scope est
|
||||
exécuté par le processus appelant et hérite du netns posé par <code class="docutils literal notranslate"><span class="pre">netns.Call</span></code>. Une unit
|
||||
transitoire, forkée par PID 1, démarrerait dans le netns racine et ne verrait pas le tap.</p></li>
|
||||
<li><p>L’arrêt d’une VM ne touche <strong>jamais</strong> aux fichiers disque. En revanche, un <code class="docutils literal notranslate"><span class="pre">quit</span></code> brutal est
|
||||
envoyé à l’expiration de <code class="docutils literal notranslate"><span class="pre">dispatcher.timeout_seconds</span></code>.</p></li>
|
||||
</ul>
|
||||
</section>
|
||||
<section id="arret-de-l-agent">
|
||||
<h2>Arrêt de l’agent<a class="headerlink" href="#arret-de-l-agent" title="Lien vers cette rubrique">#</a></h2>
|
||||
<ul class="simple">
|
||||
<li><p>Ordre imposé : serveurs HTTP → drainage des workers → fermeture de la base. L’inverser crée une
|
||||
course.</p></li>
|
||||
<li><p>Budget d’arrêt dépassé ⇒ <strong>la base n’est pas fermée</strong> : fermer Badger sous un écrivain
|
||||
concurrent est pire qu’un rejeu du journal au démarrage suivant.</p></li>
|
||||
<li><p>Jamais de <code class="docutils literal notranslate"><span class="pre">log.Fatal</span></code> dans une goroutine : <code class="docutils literal notranslate"><span class="pre">os.Exit</span></code> n’exécute aucun <code class="docutils literal notranslate"><span class="pre">defer</span></code>.</p></li>
|
||||
</ul>
|
||||
</section>
|
||||
<section id="cloud-init">
|
||||
<h2>cloud-init<a class="headerlink" href="#cloud-init" title="Lien vers cette rubrique">#</a></h2>
|
||||
<ul class="simple">
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">network-config.tmpl</span></code> cible <code class="docutils literal notranslate"><span class="pre">eth0</span></code> alors que les guests sont en <code class="docutils literal notranslate"><span class="pre">ens3</span></code> : il ne s’applique
|
||||
donc à rien, et le réseau vient du DHCP. <strong>Ne pas le « corriger » ni le supprimer</strong> — le rendre
|
||||
opérant ferait remplacer par cloud-init la configuration réseau de l’image sur toutes les VM.</p></li>
|
||||
<li><p>Un document fourni par l’appelant est servi <strong>verbatim</strong> ; un document absent retombe sur le
|
||||
template ; un document explicitement vide est servi vide. Les trois cas sont distincts.</p></li>
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">metadata.password</span></code> est un <strong>hash</strong>, pas un mot de passe en clair.</p></li>
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">instance-id</span></code> vaut le nom de la VM : recréer une VM du même nom sur le même disque fait que
|
||||
cloud-init la reconnaît et <strong>n’applique pas</strong> le user-data.</p></li>
|
||||
</ul>
|
||||
</section>
|
||||
<section id="configuration">
|
||||
<h2>Configuration<a class="headerlink" href="#configuration" title="Lien vers cette rubrique">#</a></h2>
|
||||
<ul class="simple">
|
||||
<li><p>Le chargement se fait par <strong>viper</strong> : tags <code class="docutils literal notranslate"><span class="pre">mapstructure</span></code>, jamais <code class="docutils literal notranslate"><span class="pre">yaml</span></code>.</p></li>
|
||||
<li><p>Un chemin configurable se propage par les signatures de fonction, jamais par une variable ou un
|
||||
setter de paquet.</p></li>
|
||||
</ul>
|
||||
</section>
|
||||
<section id="securite-connue-et-acceptee">
|
||||
<h2>Sécurité connue et acceptée<a class="headerlink" href="#securite-connue-et-acceptee" title="Lien vers cette rubrique">#</a></h2>
|
||||
<p>Ces points sont documentés parce qu’ils sont <strong>assumés en l’état</strong>, pas parce qu’ils sont sans
|
||||
conséquence. Ils doivent être réévalués avant toute exposition élargie de l’API.</p>
|
||||
<ul class="simple">
|
||||
<li><p><strong>L’API n’a aucune authentification</strong> et l’exemple de configuration l’expose sur
|
||||
<code class="docutils literal notranslate"><span class="pre">0.0.0.0:8080</span></code>. Quiconque atteint ce port pilote le host KVM.</p></li>
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">vm/<name>/password</span></code> est stocké tel quel (c’est un hash) et restitué par <code class="docutils literal notranslate"><span class="pre">/db?prefix=vm/</span></code>
|
||||
du serveur d’administration — contenu par <code class="docutils literal notranslate"><span class="pre">admin.enabled:</span> <span class="pre">false</span></code> et l’écoute en boucle
|
||||
locale.</p></li>
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">/run/two/metadata/<vm>/vendor-data</span></code> est en <code class="docutils literal notranslate"><span class="pre">0644</span></code> et contient ce hash : tout compte local
|
||||
du host peut le lire.</p></li>
|
||||
<li><p><code class="docutils literal notranslate"><span class="pre">pkg/systemd.New()</span></code> n’a <strong>pas de timeout</strong> : si le socket D-Bus accepte sans répondre,
|
||||
l’appelant se fige. Concerne le watchdog, la création et la suppression de subnets, et le
|
||||
serveur de metadata.</p></li>
|
||||
<li><p>Il n’y a <strong>pas de rollback</strong> : un échec partiel de création laisse des objets réseau orphelins
|
||||
jusqu’à un <code class="docutils literal notranslate"><span class="pre">DELETE</span></code> explicite.</p></li>
|
||||
</ul>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
|
||||
</article>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<footer class="prev-next-footer d-print-none">
|
||||
|
||||
<div class="prev-next-area">
|
||||
<a class="left-prev"
|
||||
href="stockage.html"
|
||||
title="page précédente">
|
||||
<i class="fa-solid fa-angle-left"></i>
|
||||
<div class="prev-next-info">
|
||||
<p class="prev-next-subtitle">précédent</p>
|
||||
<p class="prev-next-title">Schéma des clés</p>
|
||||
</div>
|
||||
</a>
|
||||
<a class="right-next"
|
||||
href="../versions/index.html"
|
||||
title="page suivante">
|
||||
<div class="prev-next-info">
|
||||
<p class="prev-next-subtitle">suivant</p>
|
||||
<p class="prev-next-title">Versions</p>
|
||||
</div>
|
||||
<i class="fa-solid fa-angle-right"></i>
|
||||
</a>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<dialog id="pst-secondary-sidebar-modal"></dialog>
|
||||
<div id="pst-secondary-sidebar" class="bd-sidebar-secondary bd-toc"><div class="sidebar-secondary-items sidebar-secondary__inner">
|
||||
|
||||
|
||||
<div class="sidebar-secondary-item"><div
|
||||
id="pst-page-navigation-heading-2"
|
||||
class="page-toc tocsection onthispage">
|
||||
<i class="fa-solid fa-list"></i> Contenu
|
||||
</div>
|
||||
<nav id="pst-page-toc-nav" class="page-toc" aria-labelledby="pst-page-navigation-heading-2">
|
||||
<ul class="visible nav section-nav flex-column">
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#reseau">Réseau</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#qemu-et-vm">QEMU et VM</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#arret-de-l-agent">Arrêt de l’agent</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#cloud-init">cloud-init</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#configuration">Configuration</a></li>
|
||||
<li class="toc-h2 nav-item toc-entry"><a class="reference internal nav-link" href="#securite-connue-et-acceptee">Sécurité connue et acceptée</a></li>
|
||||
</ul>
|
||||
</nav></div>
|
||||
|
||||
</div></div>
|
||||
|
||||
|
||||
</div>
|
||||
<footer class="bd-footer-content">
|
||||
|
||||
<div class="bd-footer-content__inner container">
|
||||
|
||||
<div class="footer-item">
|
||||
|
||||
<p class="component-author">
|
||||
Par Nicolas Boufidjeline
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="footer-item">
|
||||
|
||||
|
||||
<p class="copyright">
|
||||
|
||||
© Copyright 2026, Nicolas Boufidjeline.
|
||||
<br/>
|
||||
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="footer-item">
|
||||
|
||||
</div>
|
||||
|
||||
<div class="footer-item">
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
</main>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Scripts loaded after <body> so the DOM is not blocked -->
|
||||
<script defer src="../_static/scripts/bootstrap.js?digest=8878045cc6db502f8baf"></script>
|
||||
<script defer src="../_static/scripts/pydata-sphinx-theme.js?digest=8878045cc6db502f8baf"></script>
|
||||
|
||||
<footer class="bd-footer">
|
||||
</footer>
|
||||
</body>
|
||||
</html>
|
||||
Loading…
Add table
Add a link
Reference in a new issue