mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

the operator's bao works on a store host without a hive

Browse source
This commit is contained in:
atlas 2026-11-11 03:09:07 +01:00 • committed by mara
commit 32155f70aa
2 changed files with 169 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

67
nix/module-eval/bao-controller.nix
View file

@ -98,6 +98,16 @@ let
baoWrapperCmd = if baoWrapper == null then "" else (baoWrapper.buildCommand or "");
# The wrapper's rendered command on any store host.
wrapperCmdOf =
m:
let
w = lib.findFirst (p: (p.name or "") == "bao-hive") null m.environment.systemPackages;
in
if w == null then "" else (w.buildCommand or "");
pkiDir = import ../host-modules/lib/bao-pki-dir.nix;
swarmctlWrapper = lib.findFirst (
p: (p.name or "") == "swarmctl-configured"
) null controllerNoStore.environment.systemPackages;
@ -285,6 +295,63 @@ let
&& !builtins.elem "hive-client-ca.pem:/etc/pki/store-server-ca.pem" s.swarm-controller.serviceConfig.LoadCredential
&& m.deploy.swarm-controller.hiveClientCaFile == m.deploy.bao.clientCaFile;
}
{
# A store host without a hive has no reader leaf, so the wrapper presents
# the operator leaf that the PKI unit mints. `BAO_ADDR` in the same
# command is the control that the wrapper was found at all.
name = "the wrapped bao CLI on a store host without a hive presents the operator leaf";
ok =
let
cmd = wrapperCmdOf baoControllerHere;
in
!baoControllerHere.services.hyperhive.deploy.hive-controller.enable
&& lib.hasInfix "--set-default BAO_ADDR" cmd
&& lib.hasInfix "--set-default BAO_CLIENT_CERT ${lib.escapeShellArg "${pkiDir}/operator.pem"}" cmd
&& lib.hasInfix "--set-default BAO_CLIENT_KEY ${lib.escapeShellArg "${pkiDir}/operator-key.pem"}" cmd
&& lib.hasInfix "${pkiDir}/operator.pem ] || " baoControllerHere.systemd.services.swarm-bao-pki.script;
}
{
# A host with a hive keeps its reader leaf in the wrapper and does not
# name the operator's. The reader leaf in the same command is the
# presence control.
name = "the wrapped bao CLI on a store host with a hive keeps the hive's leaf";
ok =
let
cmd = wrapperCmdOf shared.allLocal;
in
shared.allLocal.services.hyperhive.deploy.hive-controller.enable
&& lib.hasInfix "--set-default BAO_CLIENT_CERT ${lib.escapeShellArg "${pkiDir}/client.pem"}" cmd
&& !lib.hasInfix "operator" cmd;
}
{
# The operator leaf exists only where the store runs. The store host's
# PKI unit above is the presence control.
name = "a host that does not run the store has no operator leaf";
ok =
!(controllerNoStore.systemd.services ? swarm-bao-pki)
&& controllerNoStore.services.hyperhive.deploy.bao.operatorClientCertFile == null
&& controllerNoStore.services.hyperhive.deploy.bao.operatorClientKeyFile == null;
}
{
# No cert-auth role accepts the operator leaf's subject, so the leaf
# opens the TLS handshake and logs in to nothing. Every role a unit
# writes names its subject in `allowed_common_names`; the control is that
# the roles are found and include the controller's.
name = "no cert-auth role the store host writes accepts the operator leaf's subject";
ok =
let
scripts = lib.concatMapStringsSep "\n" (u: u.script or "") (
lib.attrValues baoControllerHere.systemd.services
);
subjects = map lib.head (
builtins.filter lib.isList (builtins.split "allowed_common_names=([^ \\\n]+)" scripts)
);
operatorCn = baoControllerHere.services.hyperhive.deploy.bao.operatorCommonName;
in
lib.elem baoControllerHere.services.hyperhive.deploy.bao.controllerCommonName subjects
&& lib.length subjects > 5
&& !lib.elem operatorCn subjects;
}
{
name = "the wrapped bao CLI carries this store's address";
ok = lib.hasInfix "--set-default BAO_ADDR" baoWrapperCmd;

8
nix/module-eval/name-guards.nix
View file

@ -60,6 +60,7 @@ let
forwarderOidcCommonName = "fwctl";
forgePublisherCommonName = "fpctl";
granterCommonName = "grctl";
operatorCommonName = "opctl";
hiveLeafCommonNamePrefix = "hl";
};
swarm.hives = {
@ -71,6 +72,7 @@ let
fwctl.domain = "f.t.local";
fpctl.domain = "fp.t.local";
grctl.domain = "gr.t.local";
opctl.domain = "op.t.local";
other.domain = "other.t.local";
hl-other.domain = "hl.t.local";
};
@ -209,6 +211,12 @@ let
name = "a hive named after the bao granter's subject is refused too";
ok = equalityGuardRefuses hiveNamedAfterEverySubject "grctl";
}
{
# And the operator's leaf: no role accepts it, but a hive of that name
# has a reader role that does.
name = "a hive named after the operator leaf's subject is refused too";
ok = equalityGuardRefuses hiveNamedAfterEverySubject "opctl";
}
{
# 🩸 The per-hive half, and the one a prefix-only reservation would miss:
# the role is `<prefix>-<hive>`, so the reserved string has to be composed