vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

make bao readers want swarm-bao-pki and drop its start limit

Browse source 
A pki start refused by its start limit failed every reader that
Requires= it with `dependency`. That leaves a unit inactive, not
failed, so Restart=on-failure never fired and readers without a
refresh timer never ran again (#5381: grafana 502 for ~43 min).

Readers and granting units now Wants= + After= pki; one whose leaf is
still missing fails its login with exit 1 into its existing retry.
pki gets StartLimitIntervalSec=0: it is deliberately not
RemainAfterExit, so each reader's start re-runs it.
This commit is contained in:
atlas 2026-10-16 18:29:35 +02:00
commit 265f8a47cc
12 changed files with 95 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/host-modules/swarm-bao.nix
View file

@ -332,6 +332,10 @@ let
# `swarm-bao-pki` mints the granter's leaf; the granter's role is written by
# `swarm-bao-granter-role`, which normally skips, hence ordering only there.
# Each granting unit `Wants=` pki and never `Requires=` it: a refused or
# failed pki start fails a requirer's job with `dependency`, which no
# `Restart=` retries, while a leaf still missing fails `granterLogin` into
# the unit's own retry.
granterAfter = [
"swarm-bao-pki.service"
"swarm-bao-granter-role.service"
@ -1166,7 +1170,7 @@ let
"swarm-bao-controller-policy.service"
]
++ granterAfter;
requires = [ "swarm-bao-pki.service" ];
wants = [ "swarm-bao-pki.service" ];
wantedBy = [ "multi-user.target" ];
path = [
baoCli
@ -2790,8 +2794,11 @@ in
"swarm-bao-pki.service"
"container@${cfg.machine}.service"
];
wants = [ "container@${cfg.machine}.service" ];
requires = [ "swarm-bao-pki.service" ];
# `Wants=` pki, for ./glue-bao-readers-store-order.nix's reason.
wants = [
"swarm-bao-pki.service"
"container@${cfg.machine}.service"
];
wantedBy = [ "multi-user.target" ];
path = [
baoDeploy.package
@ -3137,7 +3144,7 @@ in
systemd.services.swarm-bao-controller-policy = lib.mkIf haveGranter {
description = "write the swarm controller's bao policy and cert-auth role";
after = [ "container@${cfg.machine}.service" ] ++ granterAfter;
requires = [ "swarm-bao-pki.service" ];
wants = [ "swarm-bao-pki.service" ];
wantedBy = [ "multi-user.target" ];
# The wrapper rather than the package: it carries the address and the
# CA, which is what makes running here cheaper than shipping an
@ -3563,7 +3570,7 @@ in
"swarm-bao-forge-publisher-policy.service"
]
++ granterAfter;
requires = [ "swarm-bao-pki.service" ];
wants = [ "swarm-bao-pki.service" ];
wantedBy = [ "multi-user.target" ];
path = [
baoCli