draupnir 0.1.5

//! # Draupnir — the nordisk boot / provisioning library
//!
//! Draupnir is the **low-level engine that fires up a runtime instance** from a
//! single [`BootSpec`], across three backends, and drives its power lifecycle:
//!
//! - [`kvm`] — a **KVM/appliance VM**, booted by driving **tunnr**'s
//!   `tunnr_vm::boot_test(BootSpec) -> BootHandle` primitive (feature
//!   `backend-tunnr`). Draupnir does **not** reimplement VM boot — it wires the
//!   [`Boot`] trait against tunnr.
//! - [`container`] — an **OCI container**, brought up over a container runtime.
//! - [`redfish`] — **bare metal**, provisioned out-of-band through a BMC's
//!   **Redfish** REST API (iLO / iDRAC / OpenBMC): insert a virtual-media ISO,
//!   set the one-time boot override to that media, power the node on. This is
//!   the capability Draupnir uniquely owns.
//!
//! ## Where Draupnir sits
//!
//! Draupnir is the **shared low-level boot lib**. Two high-level consumers depend
//! on it **directly** and neither duplicates its boot code:
//!
//! - **jera** (edda's job handler) → depends on Draupnir for job instances
//!   (`process | VM | container`). jera stays thin: just job policy.
//! - **Skidbladnir** (service/systemd, airgap, orchestration) → depends on
//!   Draupnir for service instances.
//!
//! Draupnir itself knows nothing about jobs or services; it just fires up and
//! controls instances. For its KVM backend it calls **down** into tunnr.
//!
//! ```text
//!   jera ─────────┐
//!                 ├──▶ Draupnir ──▶ { tunnr (KVM) | OCI runtime | Redfish BMC }
//!   Skidbladnir ──┘
//! ```
//!
//! ## The mythological nod
//!
//! Draupnir is Odin's gold ring that drips **eight identical copies** of itself
//! every ninth night. Here that is a *natural extension, not the core*: booting a
//! **fleet of identical machines from one ISO** — [`plan_fleet`] fans one
//! [`BootSpec`] out into N identical specs (bare-metal fleet provisioning via
//! Redfish). The core is one library, three boot backends.

use std::collections::BTreeMap;
use std::fmt;

pub mod container;
pub mod kvm;
pub mod redfish;

/// Draupnir's result alias.
pub type Result<T> = std::result::Result<T, Error>;

/// Everything that can go wrong firing up or controlling an instance.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum Error {
    /// The requested backend is not compiled in (build with its feature) or not
    /// available on this host.
    Unsupported(String),
    /// A live backend (tunnr / OCI runtime / Redfish BMC) reported a failure.
    Backend(String),
    /// The [`BootSpec`] is internally inconsistent (e.g. an ISO image handed to
    /// the KVM backend, or a Redfish spec with no BMC endpoint).
    Spec(String),
}

impl fmt::Display for Error {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Error::Unsupported(m) => write!(f, "draupnir: unsupported: {m}"),
            Error::Backend(m) => write!(f, "draupnir: backend error: {m}"),
            Error::Spec(m) => write!(f, "draupnir: invalid boot spec: {m}"),
        }
    }
}

impl std::error::Error for Error {}

/// Which runtime a [`BootSpec`] targets.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Backend {
    /// A KVM/appliance VM (driven through tunnr).
    Kvm,
    /// An OCI container.
    Container,
    /// A bare-metal node provisioned out-of-band via Redfish.
    Redfish,
}

/// The bootable payload — the *source* an instance is fired up from.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ImageSource {
    /// A kernel + rootfs/initramfs pair (the KVM appliance path → tunnr).
    KernelRootfs {
        /// Kernel image path (`-kernel`).
        kernel: String,
        /// Rootfs/initramfs path (`-initrd`).
        rootfs: String,
    },
    /// A bootable disk image, qcow2 or raw (the KVM disk path → tunnr).
    Disk(String),
    /// An OCI image reference, e.g. `docker.io/library/redis:7` (container path).
    OciImage(String),
    /// A bootable ISO served as Redfish **virtual media** (bare-metal path).
    Iso(String),
}

impl ImageSource {
    /// Whether this payload is a legal source for `backend` — the KVM backend
    /// boots kernel+rootfs or a disk, the container backend an OCI image, and
    /// Redfish an ISO. Used by [`BootSpec::validate`].
    pub fn suits(&self, backend: Backend) -> bool {
        matches!(
            (self, backend),
            (ImageSource::KernelRootfs { .. }, Backend::Kvm)
                | (ImageSource::Disk(_), Backend::Kvm)
                | (ImageSource::OciImage(_), Backend::Container)
                | (ImageSource::Iso(_), Backend::Redfish)
        )
    }
}

/// A BMC (baseboard management controller) endpoint — the out-of-band Redfish
/// service on a bare-metal node (iLO / iDRAC / OpenBMC).
///
/// The secret (password / session token) is supplied out of band at drive time
/// and is deliberately **not** a field here, so a [`BootSpec`] never carries a
/// credential.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BmcEndpoint {
    /// Base URL of the Redfish service, e.g. `https://bmc-42.dc.example`.
    pub host: String,
    /// Redfish account username.
    pub username: String,
    /// The Redfish `ComputerSystem` resource id, e.g. `System.Embedded.1`.
    pub system_id: String,
}

/// The one-time boot device a Redfish node is overridden to.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum BootTarget {
    /// Boot from virtual media / CD (the ISO we inserted).
    Cd,
    /// Network / PXE.
    Pxe,
    /// The local disk.
    Hdd,
    /// Drop into BIOS/UEFI setup.
    BiosSetup,
}

/// The power state of an instance.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum PowerState {
    /// Running.
    On,
    /// Powered off.
    Off,
    /// Not yet observed / indeterminate.
    Unknown,
}

/// **cloud-init NoCloud provisioning** for a KVM appliance boot: the `user-data`
/// (and optional `meta-data`) authored into a small FAT seed image (volume label
/// `cidata`) the guest's cloud-init picks up at first boot.
///
/// Only the [`kvm`] backend consumes it — containers have no init firstboot and
/// the Redfish path provisions the metal itself. It is pure data (zero deps); the
/// seed *image* is authored by the KVM adapter behind `backend-tunnr`.
#[derive(Debug, Clone, PartialEq, Eq, Default)]
pub struct CloudInit {
    /// The cloud-init `user-data` document (typically begins `#cloud-config`).
    pub user_data: String,
    /// The `meta-data` document; when `None` a minimal default carrying an
    /// `instance-id`/`local-hostname` is supplied by the seed builder.
    pub meta_data: Option<String>,
    /// The optional NoCloud `network-config` document (cloud-init network schema).
    /// `None` → no `network-config` file is written to the seed and the guest keeps
    /// its default (usually DHCP). Present → authored as the third seed file.
    pub network_config: Option<String>,
}

impl CloudInit {
    /// A NoCloud provision from a `user-data` document (default `meta-data`, no
    /// `network-config`).
    pub fn user_data(user_data: impl Into<String>) -> Self {
        Self { user_data: user_data.into(), meta_data: None, network_config: None }
    }

    /// Attach a NoCloud `network-config` document (builder style).
    pub fn with_network_config(mut self, network_config: impl Into<String>) -> Self {
        self.network_config = Some(network_config.into());
        self
    }
}

/// A **self-contained boot request**. One shape fires up any backend; the
/// [`backend`](BootSpec::backend) selects the driver and [`validate`] enforces
/// that the [`image`](BootSpec::image) (and, for Redfish, the [`bmc`]) match.
///
/// [`bmc`]: BootSpec::bmc
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BootSpec {
    /// Human/instance name (also the fleet-member prefix).
    pub name: String,
    /// Which backend fires this up.
    pub backend: Backend,
    /// The bootable payload source.
    pub image: ImageSource,
    /// Guest/appliance RAM in MiB (ignored by the bare-metal Redfish path).
    pub mem_mb: u32,
    /// vCPU count (ignored by the bare-metal Redfish path).
    pub cores: u32,
    /// Kernel/boot command line, if the backend takes one.
    pub cmdline: String,
    /// Container command / entrypoint override (empty = the image's own default).
    /// Only the [`container`] backend acts on it; ignored by KVM/Redfish.
    pub cmd: Vec<String>,
    /// Container ports to publish, each bound to the same host port. Only the
    /// [`container`] backend acts on them; ignored by KVM/Redfish.
    pub ports: Vec<u16>,
    /// Environment for the instance (container env; appliance kernel env).
    pub env: BTreeMap<String, String>,
    /// The BMC endpoint — **required** for [`Backend::Redfish`], `None` otherwise.
    pub bmc: Option<BmcEndpoint>,
    /// Optional cloud-init NoCloud provisioning. Consumed by the [`kvm`] backend,
    /// which authors it into a seed image the guest reads at first boot; ignored by
    /// the container/Redfish backends. `None` → no seed is attached.
    pub cloud_init: Option<CloudInit>,
}

impl BootSpec {
    /// A KVM appliance boot from a kernel + rootfs (defaults: 512 MiB, 2 cores).
    pub fn kvm_kernel_rootfs(
        name: impl Into<String>,
        kernel: impl Into<String>,
        rootfs: impl Into<String>,
    ) -> Self {
        Self {
            name: name.into(),
            backend: Backend::Kvm,
            image: ImageSource::KernelRootfs { kernel: kernel.into(), rootfs: rootfs.into() },
            mem_mb: 512,
            cores: 2,
            cmdline: String::new(),
            cmd: Vec::new(),
            ports: Vec::new(),
            env: BTreeMap::new(),
            bmc: None,
            cloud_init: None,
        }
    }

    /// A container boot from an OCI image reference (e.g. a redis service).
    pub fn container(name: impl Into<String>, oci_image: impl Into<String>) -> Self {
        Self {
            name: name.into(),
            backend: Backend::Container,
            image: ImageSource::OciImage(oci_image.into()),
            mem_mb: 0,
            cores: 0,
            cmdline: String::new(),
            cmd: Vec::new(),
            ports: Vec::new(),
            env: BTreeMap::new(),
            bmc: None,
            cloud_init: None,
        }
    }

    /// A bare-metal Redfish boot: an ISO served as virtual media to a BMC node.
    pub fn redfish_iso(name: impl Into<String>, iso: impl Into<String>, bmc: BmcEndpoint) -> Self {
        Self {
            name: name.into(),
            backend: Backend::Redfish,
            image: ImageSource::Iso(iso.into()),
            mem_mb: 0,
            cores: 0,
            cmdline: String::new(),
            cmd: Vec::new(),
            ports: Vec::new(),
            env: BTreeMap::new(),
            bmc: Some(bmc),
            cloud_init: None,
        }
    }

    /// Set an environment variable (builder style).
    pub fn with_env(mut self, key: impl Into<String>, val: impl Into<String>) -> Self {
        self.env.insert(key.into(), val.into());
        self
    }

    /// Set the container command / entrypoint override (builder style). Only the
    /// [`container`] backend acts on it.
    pub fn with_cmd<I, S>(mut self, cmd: I) -> Self
    where
        I: IntoIterator<Item = S>,
        S: Into<String>,
    {
        self.cmd = cmd.into_iter().map(Into::into).collect();
        self
    }

    /// Publish a container port (builder style), bound to the same host port. Only
    /// the [`container`] backend acts on it.
    pub fn with_port(mut self, port: u16) -> Self {
        self.ports.push(port);
        self
    }

    /// Attach cloud-init NoCloud provisioning (builder style). Only the KVM backend
    /// acts on it — it authors a seed image the guest reads at first boot.
    pub fn with_cloud_init(mut self, ci: CloudInit) -> Self {
        self.cloud_init = Some(ci);
        self
    }

    /// Reject an internally inconsistent spec **before** touching a backend:
    /// the image must suit the backend, and a Redfish spec must carry a BMC
    /// (and no other backend may). This is pure and unit-tested.
    pub fn validate(&self) -> Result<()> {
        if !self.image.suits(self.backend) {
            return Err(Error::Spec(format!(
                "{:?} image is not bootable by the {:?} backend",
                self.image, self.backend
            )));
        }
        match (self.backend, &self.bmc) {
            (Backend::Redfish, None) => {
                Err(Error::Spec("Redfish boot needs a BMC endpoint".into()))
            }
            (Backend::Redfish, Some(_)) => Ok(()),
            (_, Some(_)) => Err(Error::Spec(
                "only the Redfish backend takes a BMC endpoint".into(),
            )),
            (_, None) => Ok(()),
        }
    }
}

/// A booted (or booting) instance handle — what a [`Boot::boot`] returns and
/// what [`Lifecycle`] acts on.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Machine {
    /// Backend-scoped instance id (VM handle / container id / Redfish system id).
    pub id: String,
    /// The [`BootSpec::name`] this was fired up from.
    pub spec_name: String,
    /// Which backend owns it.
    pub backend: Backend,
    /// Last-observed power state.
    pub power: PowerState,
}

impl Machine {
    /// Record a freshly fired-up instance (power state assumed `On`).
    pub fn started(id: impl Into<String>, spec: &BootSpec) -> Self {
        Self {
            id: id.into(),
            spec_name: spec.name.clone(),
            backend: spec.backend,
            power: PowerState::On,
        }
    }
}

/// **Fire up** an instance from a [`BootSpec`]. One trait, three implementations
/// ([`kvm::KvmBoot`], [`container::ContainerBoot`], [`redfish::RedfishBoot`]).
pub trait Boot {
    /// Boot the instance described by `spec`, returning its live [`Machine`].
    fn boot(&self, spec: &BootSpec) -> Result<Machine>;
}

/// Drive an instance's **power lifecycle** after it is fired up.
pub trait Lifecycle {
    /// Power the instance on.
    fn power_on(&self, machine: &Machine) -> Result<()>;
    /// Power the instance off.
    fn power_off(&self, machine: &Machine) -> Result<()>;
    /// Observe the instance's current power state.
    fn status(&self, machine: &Machine) -> Result<PowerState>;
}

/// **Redfish virtual-media + boot-override** control — the out-of-band steps that
/// make a bare-metal node boot our ISO. Only the [`redfish::RedfishBoot`] backend
/// implements it; the KVM/container backends have no BMC.
pub trait VirtualMedia {
    /// Attach `iso` to the node as Redfish virtual media (CD/DVD).
    fn insert_media(&self, node: &BmcEndpoint, iso: &str) -> Result<()>;
    /// Detach any virtual media from the node.
    fn eject_media(&self, node: &BmcEndpoint) -> Result<()>;
    /// Set the node's **one-time** boot override to `target`.
    fn set_boot_override(&self, node: &BmcEndpoint, target: BootTarget) -> Result<()>;
}

/// **The unifying entry point** — fire up one instance from a [`BootSpec`] across
/// *whichever* backend is handed in. It [`validate`](BootSpec::validate)s the spec
/// first (so a mismatched image/BMC is rejected before any backend is touched),
/// then delegates to the backend's [`Boot::boot`]. The same `spec` boots the same
/// image on a [`kvm::KvmBoot`], a [`container::ContainerBoot`], or a
/// [`redfish::RedfishBoot`] — one call, three backends.
pub fn boot(spec: &BootSpec, backend: &dyn Boot) -> Result<Machine> {
    spec.validate()?;
    backend.boot(spec)
}

/// **The ring drips eight copies** — fan one [`BootSpec`] out into `n` identical
/// specs, each with a distinct `"{name}-{i}"` name (1-based), for booting a
/// fleet of identical machines from one image/ISO.
///
/// Pure bookkeeping: it plans the fleet; the caller boots each member through the
/// backend. Unit-tested.
pub fn plan_fleet(spec: &BootSpec, n: usize) -> Vec<BootSpec> {
    (1..=n)
        .map(|i| {
            let mut member = spec.clone();
            member.name = format!("{}-{i}", spec.name);
            member
        })
        .collect()
}

/// **Drip a fleet from one image** — [`plan_fleet`] the spec into `n` members and
/// [`boot`] each through `backend`, returning a per-member result (a partial fleet
/// is observable: some members may boot while a later one errors).
pub fn boot_fleet(spec: &BootSpec, n: usize, backend: &dyn Boot) -> Vec<Result<Machine>> {
    plan_fleet(spec, n)
        .iter()
        .map(|member| boot(member, backend))
        .collect()
}

#[cfg(test)]
mod tests {
    use super::*;

    fn bmc() -> BmcEndpoint {
        BmcEndpoint {
            host: "https://bmc-42.dc.example".into(),
            username: "admin".into(),
            system_id: "System.Embedded.1".into(),
        }
    }

    #[test]
    fn image_source_suits_the_right_backend() {
        assert!(ImageSource::Disk("/d.qcow2".into()).suits(Backend::Kvm));
        assert!(ImageSource::OciImage("redis:7".into()).suits(Backend::Container));
        assert!(ImageSource::Iso("/boot.iso".into()).suits(Backend::Redfish));
        // Cross pairings are rejected.
        assert!(!ImageSource::Iso("/boot.iso".into()).suits(Backend::Kvm));
        assert!(!ImageSource::OciImage("redis:7".into()).suits(Backend::Redfish));
    }

    #[test]
    fn valid_specs_pass_validation() {
        BootSpec::kvm_kernel_rootfs("appliance", "/bzImage", "/rootfs.cpio.gz")
            .validate()
            .unwrap();
        BootSpec::container("cache", "docker.io/library/redis:7")
            .validate()
            .unwrap();
        BootSpec::redfish_iso("node-42", "/images/installer.iso", bmc())
            .validate()
            .unwrap();
    }

    #[test]
    fn image_backend_mismatch_is_rejected() {
        let mut spec = BootSpec::container("bad", "redis:7");
        spec.image = ImageSource::Iso("/boot.iso".into());
        assert!(matches!(spec.validate(), Err(Error::Spec(_))));
    }

    #[test]
    fn redfish_without_bmc_is_rejected() {
        let mut spec = BootSpec::redfish_iso("node", "/boot.iso", bmc());
        spec.bmc = None;
        assert!(matches!(spec.validate(), Err(Error::Spec(_))));
    }

    #[test]
    fn non_redfish_with_bmc_is_rejected() {
        let mut spec = BootSpec::container("cache", "redis:7");
        spec.bmc = Some(bmc());
        assert!(matches!(spec.validate(), Err(Error::Spec(_))));
    }

    #[test]
    fn started_machine_records_the_spec() {
        let spec = BootSpec::container("cache", "redis:7").with_env("PORT", "6379");
        let m = Machine::started("ctr-abc123", &spec);
        assert_eq!(m.spec_name, "cache");
        assert_eq!(m.backend, Backend::Container);
        assert_eq!(m.power, PowerState::On);
        assert_eq!(spec.env.get("PORT").map(String::as_str), Some("6379"));
    }

    /// A fake [`Boot`] that records the specs it was handed and mints a stable id,
    /// so the unifying [`boot`]/[`boot_fleet`] entry points are testable with no
    /// live backend.
    #[derive(Default)]
    struct RecordingBoot {
        seen: std::cell::RefCell<Vec<String>>,
    }

    impl Boot for RecordingBoot {
        fn boot(&self, spec: &BootSpec) -> Result<Machine> {
            self.seen.borrow_mut().push(spec.name.clone());
            Ok(Machine::started(format!("id-{}", spec.name), spec))
        }
    }

    #[test]
    fn boot_validates_then_delegates_to_the_backend() {
        let backend = RecordingBoot::default();
        let spec = BootSpec::container("cache", "redis:7");
        let m = boot(&spec, &backend).unwrap();
        assert_eq!(m.id, "id-cache");
        assert_eq!(m.backend, Backend::Container);
        assert_eq!(backend.seen.borrow().as_slice(), &["cache".to_string()]);
    }

    #[test]
    fn boot_rejects_an_invalid_spec_before_touching_the_backend() {
        let backend = RecordingBoot::default();
        let mut spec = BootSpec::container("bad", "redis:7");
        spec.image = ImageSource::Iso("/boot.iso".into()); // ISO can't boot on Container
        assert!(matches!(boot(&spec, &backend), Err(Error::Spec(_))));
        assert!(backend.seen.borrow().is_empty(), "backend never touched on an invalid spec");
    }

    #[test]
    fn boot_fleet_drips_and_boots_every_member_through_one_backend() {
        let backend = RecordingBoot::default();
        let one = BootSpec::redfish_iso("node", "/images/installer.iso", bmc());
        let results = boot_fleet(&one, 3, &backend);
        assert_eq!(results.len(), 3);
        let ids: Vec<_> = results.into_iter().map(|r| r.unwrap().id).collect();
        assert_eq!(ids, vec!["id-node-1", "id-node-2", "id-node-3"]);
        assert_eq!(backend.seen.borrow().as_slice(), &["node-1", "node-2", "node-3"]);
    }

    /// A [`Boot`] that mints ids until it has booted `ok_before` members, then
    /// errors — so the documented "a partial fleet is observable" contract of
    /// [`boot_fleet`] can be exercised.
    struct FlakyBoot {
        ok_before: usize,
        booted: std::cell::RefCell<usize>,
    }

    impl Boot for FlakyBoot {
        fn boot(&self, spec: &BootSpec) -> Result<Machine> {
            let mut n = self.booted.borrow_mut();
            if *n >= self.ok_before {
                return Err(Error::Backend(format!("backend went away booting {}", spec.name)));
            }
            *n += 1;
            Ok(Machine::started(format!("id-{}", spec.name), spec))
        }
    }

    #[test]
    fn boot_fleet_reports_a_partial_fleet_when_a_later_member_fails() {
        // The doc promises a partial fleet is observable: the first members boot,
        // a later one errors, and every per-member result is returned in order.
        let backend = FlakyBoot { ok_before: 2, booted: std::cell::RefCell::new(0) };
        let one = BootSpec::redfish_iso("node", "/images/installer.iso", bmc());
        let results = boot_fleet(&one, 4, &backend);
        assert_eq!(results.len(), 4);
        assert_eq!(results[0].as_ref().unwrap().id, "id-node-1");
        assert_eq!(results[1].as_ref().unwrap().id, "id-node-2");
        assert!(matches!(results[2], Err(Error::Backend(_))), "3rd member fails");
        assert!(matches!(results[3], Err(Error::Backend(_))), "4th member fails too");
        let ok = results.iter().filter(|r| r.is_ok()).count();
        assert_eq!(ok, 2, "exactly the first two members booted");
    }

    #[test]
    fn plan_fleet_of_zero_is_empty_and_of_one_keeps_a_suffix() {
        assert!(plan_fleet(&BootSpec::container("c", "redis:7"), 0).is_empty());
        // Even n=1 gets the 1-based suffix (a fleet member is always "{name}-{i}").
        let one = plan_fleet(&BootSpec::container("c", "redis:7"), 1);
        assert_eq!(one.len(), 1);
        assert_eq!(one[0].name, "c-1");
    }

    #[test]
    fn cloud_init_user_data_constructor_defaults_meta_data_to_none() {
        let ci = CloudInit::user_data("#cloud-config\n");
        assert_eq!(ci.user_data, "#cloud-config\n");
        assert_eq!(ci.meta_data, None);
        assert_eq!(ci.network_config, None);
    }

    #[test]
    fn container_spec_defaults_are_lean() {
        // A container boot carries no VM sizing and no overrides until asked — the
        // "lean by design" contract the KVM path does not share.
        let spec = BootSpec::container("cache", "docker.io/library/redis:7");
        assert_eq!(spec.mem_mb, 0);
        assert_eq!(spec.cores, 0);
        assert!(spec.cmd.is_empty());
        assert!(spec.ports.is_empty());
        assert!(spec.env.is_empty());
        assert!(spec.bmc.is_none());
        assert!(spec.cloud_init.is_none());
    }

    #[test]
    fn cloud_init_on_a_container_spec_still_validates_and_is_backend_ignored() {
        // cloud_init is a KVM-only provisioning payload; attaching it to a container
        // spec is not an error (the container backend simply ignores it).
        let spec = BootSpec::container("cache", "redis:7")
            .with_cloud_init(CloudInit::user_data("#cloud-config\n"));
        spec.validate().unwrap();
        assert!(spec.cloud_init.is_some());
    }

    #[test]
    fn plan_fleet_drips_n_identical_but_distinctly_named_members() {
        let one = BootSpec::redfish_iso("node", "/images/installer.iso", bmc());
        let fleet = plan_fleet(&one, 8);
        assert_eq!(fleet.len(), 8);
        assert_eq!(fleet[0].name, "node-1");
        assert_eq!(fleet[7].name, "node-8");
        // Identical payload + backend across the whole ring.
        assert!(fleet.iter().all(|m| m.image == one.image && m.backend == one.backend));
        // Names are unique.
        let mut names: Vec<_> = fleet.iter().map(|m| m.name.clone()).collect();
        names.sort();
        names.dedup();
        assert_eq!(names.len(), 8);
    }
}