vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

make bao readers want swarm-bao-pki and drop its start limit

Browse source 
A pki start refused by its start limit failed every reader that
Requires= it with `dependency`. That leaves a unit inactive, not
failed, so Restart=on-failure never fired and readers without a
refresh timer never ran again (#5381: grafana 502 for ~43 min).

Readers and granting units now Wants= + After= pki; one whose leaf is
still missing fails its login with exit 1 into its existing retry.
pki gets StartLimitIntervalSec=0: it is deliberately not
RemainAfterExit, so each reader's start re-runs it.
This commit is contained in:
atlas 2026-10-16 18:29:35 +02:00
commit 265f8a47cc
12 changed files with 95 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nix/module-eval/bao-otel-collector.nix
View file

@ -420,7 +420,8 @@ let
in
lib.elem "container@swarm-bao.service" u.after
&& !(lib.elem "container@swarm-bao.service" (u.before or [ ]))
&& lib.elem "swarm-bao-pki.service" u.requires;
&& lib.elem "swarm-bao-pki.service" u.wants
&& !(lib.elem "swarm-bao-pki.service" u.requires);
}
{
# The far end of the credential. An authenticator checks ONE audience,