mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl setup status shows where the setup ceremony stands

Browse source
This commit is contained in:
atlas 2026-11-07 10:02:51 +01:00
commit 61a334c847
1 changed files with 1052 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

33
swarmctl/README.md
View file

@ -190,9 +190,40 @@ schedule does once stored is in
[`docs/2-handbook/swarm/schedules.md`](../docs/2-handbook/swarm/schedules.md). The bodies come
from `swarm-controller-api`, imported in `src/schedule.rs`.
## `setup status`
```console
# swarmctl setup status
1 secret store initialised: done
2 secret store unsealed: not done (the store is sealed)
...
next: step 2, setup.md § 1: `bao operator unseal`
```
One line per step of [`docs/1-getting-started/setup.md`](../docs/1-getting-started/setup.md),
`done`, `not done` or `unknown (<why>)`, and a pointer to the first step left.
Read-only, and it needs no token. Where each step is read from:
| steps | read from |
| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| 1, 2 | `bao status -format=json` through the `bao` on `PATH`, which carries the swarm's address, CA and client certificate; exit 0 is unsealed, 2 is sealed or uninitialised, anything else is an error |
| 3 | the `swarm-bao-granter-role` unit being active or its journal logging `Uploaded policy: bao-granter`; or the granting units of step 4 being active, which log in through the granter |
| 4 | `systemctl is-active` over the `swarm-bao-*-policy` units and `swarm-bao-agent-pki`, as the full-setup VM test polls them, except the operator-viewer one, which waits for authelia |
| 5 | steps 2 and 4 both done |
| 6 | an enabled member of `admins` in authelia's users file |
| 9, 10 | `GET /api/agents/status` and `GET /api/agents/ruth/permissions` on the controller; ruth is done when she is declared `up` and holds `manage_root_agent` |
| 7, 8 | not observable: a browser login leaves nothing to read, and the controller has no read route for a forge admin |
A check that cannot run gives `unknown` with the reason and the rest still
print: `bao` is only on `PATH` on the host running swarm-bao, the users file is
only on the authelia host, and the controller socket only on its host (or
`--swarm`). The exit code is 0 when every step it can see has finished and 1
otherwise, counting an `unknown` from a failed check; step 10, another agent,
is optional and does not count.
## Remote use: `swarmctl login`
The `agent`, `schedule` and `forge` verbs also work from any machine, as
The `agent`, `schedule` and `forge` verbs, and the agent checks of `setup status`, also work from any machine, as
your own SSO account, through the swarm domain's gateway:
```console