vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

make bao readers want swarm-bao-pki and drop its start limit

Browse source 
A pki start refused by its start limit failed every reader that
Requires= it with `dependency`. That leaves a unit inactive, not
failed, so Restart=on-failure never fired and readers without a
refresh timer never ran again (#5381: grafana 502 for ~43 min).

Readers and granting units now Wants= + After= pki; one whose leaf is
still missing fails its login with exit 1 into its existing retry.
pki gets StartLimitIntervalSec=0: it is deliberately not
RemainAfterExit, so each reader's start re-runs it.
This commit is contained in:
atlas 2026-10-16 18:29:35 +02:00
commit 265f8a47cc
12 changed files with 95 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/module-eval/swarm-services-switch.nix
View file

@ -804,12 +804,13 @@ let
}
{
# Where the store runs here, each reader waits for its container and
# requires the PKI unit minting the leaf it logs in with. Elsewhere
# neither unit exists, and `Requires=` on an absent unit fails the
# reader's start. On the store's host without the readers, none of them
# is rendered as a stub. Rosters are counted: an empty one holds
# vacuously.
name = "a store reader waits for the store's container and PKI unit only where the store runs here";
# the PKI unit minting the leaf it logs in with, and wants both. It
# never requires the PKI unit: a refused pki start fails a requirer's
# job with `dependency`, which its `Restart=on-failure` never retries.
# Elsewhere neither unit exists. On the store's host without the
# readers, none of them is rendered as a stub. Rosters are counted: an
# empty one holds vacuously.
name = "a store reader waits for and wants the store's container and PKI unit only where the store runs here, and requires neither";
ok =
let
machine = serviceContainersWithCi.services.hyperhive.swarm.bao.machine;
@ -831,12 +832,14 @@ let
];
here = serviceContainersWithCi.systemd.services;
elsewhere = swarmServicesBaoElsewhere.systemd.services;
readersHere = lib.filter (u: here ? ${u}) readers;
readersElsewhere = lib.filter (u: elsewhere ? ${u}) readers;
waits =
u:
here ? ${u}
&& lib.elem "swarm-bao-pki.service" here.${u}.after
&& lib.elem "swarm-bao-pki.service" here.${u}.requires
&& lib.elem "swarm-bao-pki.service" here.${u}.wants
&& !(lib.any (n: lib.elem n here.${u}.requires) storeUnits)
&& lib.elem "container@${machine}.service" here.${u}.after
&& lib.elem "container@${machine}.service" here.${u}.wants;
namesNoStoreUnit =
@ -847,6 +850,8 @@ let
!(lib.any (n: lib.elem n (s.after ++ s.wants ++ s.requires)) storeUnits);
in
lib.all waits readers
&& lib.length readersHere == 10
&& lib.elem "swarm-bao-grafana-admin" readersHere
&& lib.length readersElsewhere == 7
&& lib.all namesNoStoreUnit readersElsewhere
&& !(lib.any (u: storeOnlyNoHive.systemd.services ? ${u}) readers);