From 30b9955ad39a12abae3e1ee0fb13f1abad41cf63 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 13 Sep 2026 22:03:08 +0200 Subject: [PATCH] fixture: repair 4 CI failures uncovered on rebase MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Refs #4374 - otelNoIdentity: name journaldUnits so the fixture trips the store- identity path it's testing instead of swarm-otel's unrelated journald-safety assertion (an empty list with log collection on is refused as "collect everything", not "collect nothing"). - otelNoStores: give it a bao client identity. The secret gate moved from deployCfg.authelia.enable to a real client cert/key pair, so a fixture meaning "no telemetry stores" now needs its own secret identity to keep exercising the exporter/authenticator wiring it was written for. - docs/swarm/secrets.md: two vale fixes — a contraction, and drop a condescending "simply". --- docs/swarm/secrets.md | 4 ++-- nix/module-eval.nix | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md index 23893245..24481b57 100644 --- a/docs/swarm/secrets.md +++ b/docs/swarm/secrets.md @@ -82,7 +82,7 @@ The client it reads for is registered unconditionally, the same call bearer-authz client with no audience, and the push audiences supply one even for a collector with nothing published to scrape. -⚠️ **A collector with no store identity is not refused.** Unlike Grafana, +⚠️ **A collector with no store identity isn't refused.** Unlike Grafana, where an absent OIDC block is a container with no way in at all, a collector with nothing to authenticate with still receives every hive's telemetry — only its own pushes to the stores go out unauthenticated and get refused @@ -219,7 +219,7 @@ runs the collector, and registration lives separately in `glue-swarm-otel-oidc-client.nix` for the same reason Grafana's does. Where it differs is what an absent credential means: the collector still receives telemetry with none, so `swarm-otel.nix` doesn't assert -`deploy.bao.clientCertFile` / `clientKeyFile` the way Grafana does — it simply +`deploy.bao.clientCertFile` / `clientKeyFile` the way Grafana does — it doesn't render the reading unit without them, the shape `glue-matrix-bao-token.nix` and `glue-queue-agent-credential.nix` use for their own optional reads. diff --git a/nix/module-eval.nix b/nix/module-eval.nix index 59b5db5a..43a3483f 100644 --- a/nix/module-eval.nix +++ b/nix/module-eval.nix @@ -498,6 +498,8 @@ let otelNoStores = hive { deploy.swarm-otel.enable = true; deploy.authelia.enable = true; + deploy.bao.clientCertFile = "/etc/pki/bao-client.pem"; + deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem"; deploy.victoriametrics.enable = false; deploy.victorialogs.enable = false; }; @@ -531,6 +533,7 @@ let otelNoIdentity = hive { deploy.swarm-otel.enable = true; swarm.authelia.url = "https://auth.example.invalid"; + swarm.otel.journaldUnits = [ "nginx" ]; }; # authelia somewhere else, the credential delivered by hand. Whether this