mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

forge-token: exit 1 when the store read fails for any reason but "not there"

Browse source 
Only "No value found at" and a 403 mean the token is not minted yet and
exit 0. Any other failure exits 1 so the restart policy and store-retry
apply. The token file stays untouched either way.

Closes #6089
This commit is contained in:
atlas 2026-11-06 02:06:33 +01:00 • committed by mara
commit 39482ea6cd
2 changed files with 46 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/agent-modules/forge-token.nix
View file

@ -164,9 +164,10 @@ in
# 🩸 Degrades where ./bao.nix's check fails, because one policy stanza
# governs both reads: the one that let the login read `bao-mtls` covers
# this path too, so a refusal here is a token not minted yet. The
# file already in place, if any, is kept: a store that is briefly
# unreachable must not take a working token away.
# this path too, so "No value found at <path>" or a 403 here is a token
# not minted yet and exits 0. Any other failure (network, timeout, 5xx)
# exits 1 so the unit's restart policy retries it. The file already in
# place, if any, is kept either way.
#
# ⚠️ Written by redirect, never echoed: the field is the secret. The
# staging file is removed first so the redirect creates it — a file
@ -174,9 +175,15 @@ in
# writing.
rm -f "$err" ${lib.escapeShellArg stagingFile}
if ! bao kv get -field=value ${lib.escapeShellArg tokenPath} > ${lib.escapeShellArg stagingFile} 2>"$err"; then
echo "no forge token at ${tokenPath} yet; consumers keep using the state-dir token if there is one." >&2
# bao prints `Code: <status>` only for an HTTP answer.
if [[ "$(<"$err")" == *"No value found at "* || "$(<"$err")" == *"Code: 403"* ]]; then
echo "no forge token at ${tokenPath} yet; consumers keep using the state-dir token if there is one." >&2
if [ -s "$err" ]; then cat "$err" >&2; fi
exit 0
fi
echo "the swarm secret store failed reading ${tokenPath}; consumers keep using the state-dir token if there is one:" >&2
if [ -s "$err" ]; then cat "$err" >&2; fi
exit 0
exit 1
fi
if cmp -s ${lib.escapeShellArg stagingFile} ${lib.escapeShellArg tokenFile}; then

34
nix/script-tests/agent-bao-fetch.sh
View file

@ -207,6 +207,40 @@ expect_err "No value found"
expect_calls "$login_call" "$kv_call"
expect_file "$rt/$secret_name" old
setup FORGE "a refused read (403) is a token not minted yet"
printf old >"$rt/$secret_name"
chmod 0400 "$rt/$secret_name"
kv_rc=2
kv_err=$'Error reading secret/data/swarm/agents/a1: Error making API request.\n\nURL: GET https://bao.t.local:8200/v1/secret/data/swarm/agents/a1\nCode: 403. Errors:\n\n* 1 error occurred:\n\t* permission denied\n'
go
expect_rc 0
expect_err "$missing_msg"
expect_calls "$login_call" "$kv_call"
expect_file "$rt/$secret_name" old
setup FORGE "a read that fails on the network exits 1 and keeps the old token"
printf old >"$rt/$secret_name"
chmod 0400 "$rt/$secret_name"
kv_rc=2
kv_err="Error reading secret/data/swarm/agents/a1: Get \"$bao_addr/v1/secret/data/swarm/agents/a1\": dial tcp: connect: connection refused"
go
expect_rc 1
expect_err "the swarm secret store failed reading $path"
expect_err "connection refused"
expect_no_err "$missing_msg"
expect_calls "$login_call" "$kv_call"
expect_file "$rt/$secret_name" old
expect_no_file "$rt/token.new"
setup FORGE "a read that the store answers with a 5xx exits 1"
kv_rc=2
kv_err=$'Error reading secret/data/swarm/agents/a1: Error making API request.\n\nCode: 503. Errors:\n\n* Vault is sealed\n'
go
expect_rc 1
expect_err "the swarm secret store failed reading $path"
expect_no_err "$missing_msg"
expect_no_file "$rt/$secret_name"
setup FORGE "a first fetch writes the secret 0400"
go
expect_rc 0