vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

give cert-auth role tokens a 15m ttl so logins stop leaving 32-day leases

Browse source
This commit is contained in:
atlas 2026-10-28 18:32:44 +01:00 • committed by mara
commit 00df3ccffb
1 changed files with 160 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

62
nix/module-eval/bao-grants.nix
View file

@ -885,9 +885,9 @@ let
{
# The three agent-token checkers log in once per check; a batch token
# leaves nothing stored per request. The CI runner's role, written by the
# same helper, keeps service tokens, and still carries its policy, so a
# misspelled script name cannot make the absence pass.
name = "the agent-token checkers' roles issue batch tokens and a holder's role does not";
# same helper, keeps service tokens with the short TTL, and still carries
# its policy, so a misspelled script name cannot make the absence pass.
name = "the agent-token checkers' roles issue batch tokens and the CI runner's issues short service tokens";
ok =
let
script = unit: baoGrantHere.systemd.services.${unit}.script;
@ -907,7 +907,8 @@ let
&& batch "swarm-bao-metrics-auth-policy" "swarm-metrics-auth"
&& lib.hasInfix "token_policies=swarm-ci-runner" ci
&& !(lib.hasInfix "token_type" ci)
&& !(lib.hasInfix "token_ttl" ci);
&& lib.hasInfix "token_ttl=15m" ci
&& lib.hasInfix "token_max_ttl=15m" ci;
}
{
name = "the PKI unit signs the metrics store responder's leaf under its own subject";
@ -1471,6 +1472,59 @@ let
&& !(lib.hasPrefix "swarm-" cn)
&& !(lib.hasPrefix "hive-" cn);
}
{
# A cert login leaves a lease until its token expires, and a role without
# `token_ttl` gets the mount's default of 32 days. Every role write in
# every unit is read, so the TTL must be on the command itself, not
# somewhere else in the script. A role is a service token at `15m`, or a
# batch token at `5m`.
#
# The presence control: the roles found include the controller's, the
# granter's, a batch responder's, the CI runner's and a per-hive leaf
# role, so a changed spelling of the write cannot leave the loop with
# nothing to check.
name = "every cert-auth role the units write issues short-lived tokens";
ok =
let
roleWrites =
cfg:
lib.concatMap (
u:
let
chunks = lib.tail (lib.splitString "bao write auth/cert/certs/" u.script);
commandOf =
chunk:
let
ls = lib.splitString "\n" chunk;
last = lib.lists.findFirstIndex (l: !(lib.hasSuffix "\\" l)) 0 ls;
in
lib.concatStringsSep "\n" (lib.take (last + 1) ls);
in
map (c: {
role = lib.head (lib.splitString " " c);
command = commandOf c;
}) chunks
) (lib.attrValues cfg.systemd.services);
writes = roleWrites baoGrantHere ++ roleWrites baoGrantTwoHives;
short =
w:
(lib.hasInfix "token_ttl=15m" w.command && lib.hasInfix "token_max_ttl=15m" w.command)
|| (
lib.hasInfix "token_type=batch" w.command
&& lib.hasInfix "token_ttl=5m" w.command
&& !(lib.hasInfix "token_max_ttl" w.command)
);
roles = map (w: w.role) writes;
in
lib.all short writes
&& lib.all (r: lib.elem r roles) [
"swarm-controller"
"bao-granter"
"swarm-nats-auth"
"swarm-ci-runner"
"swarm-hive-leaf-h2"
];
}
{
# The other principals are what they were: no unit but the granter's own
# hands its policy to a role, and none of them logs in as it.