mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

forge-token: exit 1 when the store read fails for any reason but "not there"

Browse source 
Only "No value found at" and a 403 mean the token is not minted yet and
exit 0. Any other failure exits 1 so the restart policy and store-retry
apply. The token file stays untouched either way.

Closes #6089
This commit is contained in:
atlas 2026-11-06 02:06:33 +01:00 • committed by mara
commit 39482ea6cd
1 changed files with 46 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nix/script-tests/agent-bao-fetch.sh
View file

@ -207,6 +207,40 @@ expect_err "No value found"
expect_calls "$login_call" "$kv_call"
expect_file "$rt/$secret_name" old
setup FORGE "a refused read (403) is a token not minted yet"
printf old >"$rt/$secret_name"
chmod 0400 "$rt/$secret_name"
kv_rc=2
kv_err=$'Error reading secret/data/swarm/agents/a1: Error making API request.\n\nURL: GET https://bao.t.local:8200/v1/secret/data/swarm/agents/a1\nCode: 403. Errors:\n\n* 1 error occurred:\n\t* permission denied\n'
go
expect_rc 0
expect_err "$missing_msg"
expect_calls "$login_call" "$kv_call"
expect_file "$rt/$secret_name" old
setup FORGE "a read that fails on the network exits 1 and keeps the old token"
printf old >"$rt/$secret_name"
chmod 0400 "$rt/$secret_name"
kv_rc=2
kv_err="Error reading secret/data/swarm/agents/a1: Get \"$bao_addr/v1/secret/data/swarm/agents/a1\": dial tcp: connect: connection refused"
go
expect_rc 1
expect_err "the swarm secret store failed reading $path"
expect_err "connection refused"
expect_no_err "$missing_msg"
expect_calls "$login_call" "$kv_call"
expect_file "$rt/$secret_name" old
expect_no_file "$rt/token.new"
setup FORGE "a read that the store answers with a 5xx exits 1"
kv_rc=2
kv_err=$'Error reading secret/data/swarm/agents/a1: Error making API request.\n\nCode: 503. Errors:\n\n* Vault is sealed\n'
go
expect_rc 1
expect_err "the swarm secret store failed reading $path"
expect_no_err "$missing_msg"
expect_no_file "$rt/$secret_name"
setup FORGE "a first fetch writes the secret 0400"
go
expect_rc 0