vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

raise the cert role token ttl to 1h

Browse source
This commit is contained in:
atlas 2026-10-28 20:18:18 +01:00 • committed by mara
commit 099af86cd2
1 changed files with 23 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/module-eval/bao-grants.nix
View file

@ -907,8 +907,8 @@ let
&& batch "swarm-bao-metrics-auth-policy" "swarm-metrics-auth"
&& lib.hasInfix "token_policies=swarm-ci-runner" ci
&& !(lib.hasInfix "token_type" ci)
&& lib.hasInfix "token_ttl=15m" ci
&& lib.hasInfix "token_max_ttl=15m" ci;
&& lib.hasInfix "token_ttl=1h" ci
&& lib.hasInfix "token_max_ttl=1h" ci;
}
{
name = "the PKI unit signs the metrics store responder's leaf under its own subject";
@ -1476,8 +1476,9 @@ let
# A cert login leaves a lease until its token expires, and a role without
# `token_ttl` gets the mount's default of 32 days. Every role write in
# every unit is read, so the TTL must be on the command itself, not
# somewhere else in the script. A role is a service token at `15m`, or a
# batch token at `5m`.
# somewhere else in the script. A role is a service token at `1h`, or a
# batch token at `5m`. The granter keeps `15m`: only the bootstrap token
# writes its role, so a deployed store does not rewrite it.
#
# The presence control: the roles found include the controller's, the
# granter's, a batch responder's, the CI runner's and a per-hive leaf
@ -1508,7 +1509,12 @@ let
writes = roleWrites baoGrantHere ++ roleWrites baoGrantTwoHives;
short =
w:
(lib.hasInfix "token_ttl=15m" w.command && lib.hasInfix "token_max_ttl=15m" w.command)
(lib.hasInfix "token_ttl=1h" w.command && lib.hasInfix "token_max_ttl=1h" w.command)
|| (
w.role == "bao-granter"
&& lib.hasInfix "token_ttl=15m" w.command
&& lib.hasInfix "token_max_ttl=15m" w.command
)
|| (
lib.hasInfix "token_type=batch" w.command
&& lib.hasInfix "token_ttl=5m" w.command