mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

forge-token: exit 1 when the store read fails for any reason but "not there"

Browse source 
Only "No value found at" and a 403 mean the token is not minted yet and
exit 0. Any other failure exits 1 so the restart policy and store-retry
apply. The token file stays untouched either way.

Closes #6089
This commit is contained in:
atlas 2026-11-06 02:06:33 +01:00 • committed by mara
commit 39482ea6cd
1 changed files with 46 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/agent-modules/forge-token.nix
View file

@ -164,9 +164,10 @@ in
# 🩸 Degrades where ./bao.nix's check fails, because one policy stanza
# governs both reads: the one that let the login read `bao-mtls` covers
# this path too, so a refusal here is a token not minted yet. The
# file already in place, if any, is kept: a store that is briefly
# unreachable must not take a working token away.
# this path too, so "No value found at <path>" or a 403 here is a token
# not minted yet and exits 0. Any other failure (network, timeout, 5xx)
# exits 1 so the unit's restart policy retries it. The file already in
# place, if any, is kept either way.
#
# ⚠️ Written by redirect, never echoed: the field is the secret. The
# staging file is removed first so the redirect creates it — a file
@ -174,9 +175,15 @@ in
# writing.
rm -f "$err" ${lib.escapeShellArg stagingFile}
if ! bao kv get -field=value ${lib.escapeShellArg tokenPath} > ${lib.escapeShellArg stagingFile} 2>"$err"; then
echo "no forge token at ${tokenPath} yet; consumers keep using the state-dir token if there is one." >&2
# bao prints `Code: <status>` only for an HTTP answer.
if [[ "$(<"$err")" == *"No value found at "* || "$(<"$err")" == *"Code: 403"* ]]; then
echo "no forge token at ${tokenPath} yet; consumers keep using the state-dir token if there is one." >&2
if [ -s "$err" ]; then cat "$err" >&2; fi
exit 0
fi
echo "the swarm secret store failed reading ${tokenPath}; consumers keep using the state-dir token if there is one:" >&2
if [ -s "$err" ]; then cat "$err" >&2; fi
exit 0
exit 1
fi
if cmp -s ${lib.escapeShellArg stagingFile} ${lib.escapeShellArg tokenFile}; then