vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao: re-run the operator viewer unit when the granter step succeeds

Browse source 
swarm-bao-operator-viewer-policy exits 0 while the granter may not
configure auth/oidc, so it never retries on its own. On 2026-09-29 the
operator fixed the granter (swarm-bao-granter-role succeeded at 15:29Z),
but the viewer unit had last run on 2026-09-28 19:11Z on that exit-0
branch. auth/oidc/config and the viewer role stayed unwritten and OIDC
login failed until a manual restart.

The granter unit now restarts the viewer unit from ExecStartPost, which
runs only after its script exits 0. Restart rather than start, because
the viewer unit is RemainAfterExit and a start would be a no-op.
--no-block, because the viewer unit is ordered after the granter and a
blocking restart would deadlock. The link is one-way, so the viewer's
own Restart=on-failure never re-runs the granter.

OnSuccess= would not fire (the granter stays active under
RemainAfterExit), and Wants=/PartOf= either no-op on an active unit or
also propagate a failed restart and every stop.

The viewer's log message no longer tells the operator to restart it.

Refs #4772
This commit is contained in:
atlas 2026-09-29 17:45:58 +02:00
commit 22c96282b9
3 changed files with 35 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/module-eval/bao-grants.nix
View file

@ -1484,7 +1484,25 @@ let
&& at probe < at "exit 0"
&& at "exit 0" < at "bao kv get"
&& at "bao kv get" < at "bao write auth/oidc/config"
&& lib.hasInfix "systemctl restart swarm-bao-operator-viewer-policy" s;
&& lib.hasInfix "swarm-bao-granter-role re-runs this unit once it succeeds." s
&& !(lib.hasInfix "systemctl restart swarm-bao-operator-viewer-policy" s);
}
{
# The granter step is what lets the viewer unit configure oidc, so its
# success restarts that unit: a restart since the unit is
# `RemainAfterExit`, `--no-block` since it is ordered after the granter.
# The ordering is one-way, so the viewer's retries never reach back.
name = "a successful granter step restarts the viewer unit without blocking";
ok =
let
s = baoGrantHere.systemd.services;
g = s.swarm-bao-granter-role;
v = s.swarm-bao-operator-viewer-policy;
in
lib.hasInfix "systemctl restart --no-block swarm-bao-operator-viewer-policy.service" g.postStart
&& lib.elem "swarm-bao-granter-role.service" v.after
&& !(lib.elem "swarm-bao-operator-viewer-policy.service" g.after)
&& !(v ? postStart && lib.hasInfix "swarm-bao-granter-role" v.postStart);
}
{
# The client secret is on stdin, never an argument in /proc; the rest is