mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-archive: grant only once an archive is up; keep logins across a gap in placements

Browse source 
The archive host creates a ready marker in the store and swarm-controller
writes no credentials before it exists, so a swarm without an archive, and a
mixed-version swarm, leave every hive backup a logged no-op. A hive with no
declaration no longer counts as placing nothing: its copies and its agents'
user lines stay. The restic password is pinned by tests across a revoke, a
re-placement and a move.
This commit is contained in:
atlas 2026-11-10 08:18:45 +01:00
commit 91f36f39d2
1 changed files with 241 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/vm-tests/swarm-archive.nix
View file

@ -9,7 +9,7 @@
# applies the retention;
# - the users file follows the store: a user removed from it is refused without
# a restart of the server;
# - a hive that has agents and no grant fails its backup.
# - a hive that has agents and no grant backs up nothing and succeeds.
#
# One node, because the gateway hop is outside what is under test: the
# backup script dials `http://127.0.0.1:<port>` instead of
@ -33,6 +33,11 @@ let
[ -d "$store/$path" ] || { echo "No value found at $path" >&2; exit 2; }
ls "$store/$path" | ${pkgs.jq}/bin/jq -R . | ${pkgs.jq}/bin/jq -s .
exit 0 ;;
"kv put")
[ -e "$store/$4" ] && { echo "check-and-set parameter did not match" >&2; exit 2; }
mkdir -p "$store/$4"
printf %s "''${5#*=}" > "$store/$4/''${5%%=*}"
exit 0 ;;
"kv get")
field="''${3#-field=}"
[ -f "$store/$4/$field" ] || { echo "No value found at $4" >&2; exit 2; }
@ -265,9 +270,14 @@ pkgs.testers.runNixOSTest {
assert status("beta", "beta") == "401", status("beta", "beta")
assert status("alpha", "alpha") == "200", status("alpha", "alpha")
with subtest("a hive with agents and no grant fails its backup"):
with subtest("the archive announces itself once, so swarm-controller starts granting"):
machine.succeed(f"test \"$(cat {store}/secret/swarm/services/archive/ready/ready)\" = 1")
machine.succeed("systemctl start swarm-archive-users")
with subtest("a hive with agents and no grant backs up nothing and does not fail"):
machine.succeed(f"rm -r {store}/secret/swarm/hives/${hive}")
machine.fail("systemctl start test-archive-backup")
machine.succeed("journalctl -u test-archive-backup | grep -q 'archive backup failed: swarm-controller has granted this hive no archive credentials'")
machine.succeed("systemctl start test-archive-backup")
machine.succeed("journalctl -u test-archive-backup | grep -q 'granted this hive no archive credentials'")
machine.fail("journalctl -u test-archive-backup | grep -q 'archive backup failed'")
'';
}