mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread vm test: bao on the store machine uses the operator leaf

Browse source
This commit is contained in:
atlas 2026-11-11 09:27:51 +01:00 • committed by mara
commit 26152161ca
1 changed files with 15 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/vm-tests/semi-spread.nix
View file

@ -313,11 +313,6 @@ pkgs.testers.runNixOSTest (
ARCHETYPE = {"source": "hyperhive", "name": "reviewer"}
POOL = "/var/lib/swarm-pki"
MINTED = "/var/lib/swarm-bao-pki"
# The store's listeners refuse a connection that presents no certificate
# from its CA, and this machine runs no hive, so its `bao` wrapper has
# none. Any leaf does for the CLI; the services-issuer's is in POOL
# before the first call.
BAO = f"env BAO_CLIENT_CERT={POOL}/services-issuer.pem BAO_CLIENT_KEY={POOL}/services-issuer-key.pem bao"
POLICY_UNITS_ACTIVE = (
"for u in $(systemctl list-unit-files 'swarm-bao-*-policy.service' --no-legend | cut -d' ' -f1 | grep -v operator-viewer) "
"swarm-bao-agent-pki.service; do "
@ -360,9 +355,9 @@ pkgs.testers.runNixOSTest (
# `bao status` exits 2 when it reaches a sealed store and 1 for any
# address, CA or client-certificate problem.
try:
swarm.wait_until_succeeds(f"[ \"$({BAO} status >/dev/null 2>&1; echo $?)\" = 2 ]", timeout=timeout)
swarm.wait_until_succeeds("[ \"$(bao status >/dev/null 2>&1; echo $?)\" = 2 ]", timeout=timeout)
except Exception:
out = swarm.execute(f"{BAO} status 2>&1; echo \"exit=$?\"; grep -h '^export BAO_' \"$(command -v bao)\" | tr '\\n' ' '")[1]
out = swarm.execute("bao status 2>&1; echo \"exit=$?\"; grep -h '^export BAO_' \"$(command -v bao)\" | tr '\\n' ' '")[1]
print(f"bao status on swarm: {' '.join(out.split())}")
diagnose(swarm, "openbao", "${swarm.bao.machine}")
raise
@ -496,19 +491,24 @@ pkgs.testers.runNixOSTest (
redeploy(swarm)
with subtest("step 1: bao operator init"):
# The wrapper presents the operator leaf, which swarm-bao-pki mints.
swarm.wait_until_succeeds(
f"[ \"$(systemctl show -p ActiveState --value swarm-bao-pki.service)\" = inactive ] && [ -s {MINTED}/operator.pem ]",
timeout=900,
)
store_sealed(900)
swarm.succeed(f"umask 077 && {BAO} operator init -key-shares=1 -key-threshold=1 -format=json > {INIT}")
swarm.succeed(f"umask 077 && bao operator init -key-shares=1 -key-threshold=1 -format=json > {INIT}")
with subtest("step 4: bao operator unseal, with the shamir seal"):
swarm.succeed(f"{BAO} operator unseal \"$(jq -r '.unseal_keys_b64[0]' {INIT})\"")
swarm.succeed(f"{BAO} status")
swarm.succeed(f"bao operator unseal \"$(jq -r '.unseal_keys_b64[0]' {INIT})\"")
swarm.succeed("bao status")
with subtest("step 1: the granter bootstrap"):
swarm.succeed(
"set -o pipefail; "
f"export BAO_TOKEN=\"$(jq -r .root_token {INIT})\"; "
f"{BAO} policy write bao-bootstrap /etc/hyperhive/bao-bootstrap-policy.hcl; "
f"{BAO} token create -policy=bao-bootstrap -ttl=24h -orphan -display-name=bao-bootstrap -field=token "
"bao policy write bao-bootstrap /etc/hyperhive/bao-bootstrap-policy.hcl; "
"bao token create -policy=bao-bootstrap -ttl=24h -orphan -display-name=bao-bootstrap -field=token "
"| install -D -m 0600 /dev/stdin /var/lib/swarm-bao-bootstrap/grant.token; "
"unset BAO_TOKEN; "
"systemctl restart swarm-bao-granter-role"
@ -526,7 +526,7 @@ pkgs.testers.runNixOSTest (
if swarm.execute("journalctl -u swarm-bao-agent-pki --no-pager | grep -F 'restart openbao.service'")[0] == 0:
swarm.succeed("systemctl --machine=swarm-bao restart openbao.service")
store_sealed(600)
swarm.succeed(f"{BAO} operator unseal \"$(jq -r '.unseal_keys_b64[0]' {INIT})\"")
swarm.succeed(f"bao operator unseal \"$(jq -r '.unseal_keys_b64[0]' {INIT})\"")
settle(swarm, POLICY_UNITS_ACTIVE, 1800, "swarm-bao-*-policy")
swarm.succeed(
"journalctl -u swarm-bao-controller-policy --no-pager "
@ -554,7 +554,7 @@ pkgs.testers.runNixOSTest (
with subtest("authelia's mint has published the clients' secrets"):
settle(
swarm,
f"BAO_TOKEN=\"$(jq -r .root_token {INIT})\" {BAO} kv get -field=value "
f"BAO_TOKEN=\"$(jq -r .root_token {INIT})\" bao kv get -field=value "
"secret/swarm/controller/swarm-controller/oidc/client >/dev/null",
1800,
"authelia-swarm-secrets",
@ -592,7 +592,7 @@ pkgs.testers.runNixOSTest (
with subtest("the forge holds hyperhive/hyperhive at the fixture's commit"):
settle(
swarm,
f"BAO_TOKEN=\"$(jq -r .root_token {INIT})\" {BAO} kv get -field=value "
f"BAO_TOKEN=\"$(jq -r .root_token {INIT})\" bao kv get -field=value "
"secret/swarm/controller/swarm-controller/forge/token > /root/forge-token",
1800,
["forgejo", "forgejo-swarm-controller-account", "forgejo-sso-source"],