vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive TLS: reload the trust bundle's unit on a switch, name the missing root when it's empty

Browse source 
A switch that changed `hive-tls-ca` stopped and started it, and the stop
propagated through `Requires=` to the store's container (sealed again under
the shamir seal), every container binding the bundle, and every
`<name>-ca-bundle` unit with its consumers. `reloadIfChanged` with the same
script as `ExecReload` rewrites the bundle in place and restarts none of them.
`Requires=` stays, so a failed assembly still keeps them from starting.

With `swarm-services-root.pem` missing, `hive-tls-ca` writes an empty bundle
and every `<name>-ca-bundle` unit fails. Its log line now names the root's
path. docs/swarm/ca.md describes both.
This commit is contained in:
atlas 2026-10-05 20:47:20 +02:00 • committed by mara
commit 1a4dc16053
3 changed files with 53 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nix/module-eval/hive-tls.nix
View file

@ -281,6 +281,32 @@ let
&& !(lib.hasInfix "anchors+=(" caUnit.script)
&& !(lib.hasInfix "ca.pem" caUnit.script);
}
{
# A reload does not propagate through `Requires=`; a stop and start
# restarts the store's container, which comes back sealed. The control
# is that container still requiring the unit, so a failed assembly
# still keeps it from starting.
name = "a switch that changes the trust bundle's unit reloads it with the same script, so the store's container is not restarted";
ok =
let
text = allLocal.systemd.units."hive-tls-ca.service".text;
store = units."container@swarm-bao";
in
caUnit.reloadIfChanged
&& caUnit.reload == caUnit.script
&& lib.hasInfix "X-ReloadIfChanged=true" text
&& lib.hasInfix "ExecReload=" text
&& lib.elem "hive-tls-ca.service" store.requires
&& lib.elem "hive-tls-ca.service" store.after;
}
{
# A missing root is the one case where the bundle is empty, and every
# `<name>-ca-bundle` unit fails on it; the log names the file.
name = "an empty trust bundle is logged naming the store's root it is copied from";
ok = lib.hasInfix ''echo "the store's root $svcroot is missing or empty'' (
lib.last (lib.splitString ''if [ -s "$svcroot" ]; then'' caUnit.script)
);
}
{
# The control is the all-local host, which defines none of them.
name = "a definition of a removed swarm.ca option fails evaluation, naming the option and the store's root";