vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fixture: repair 4 CI failures uncovered on rebase

Browse source 
Refs #4374

- otelNoIdentity: name journaldUnits so the fixture trips the store-
  identity path it's testing instead of swarm-otel's unrelated
  journald-safety assertion (an empty list with log collection on is
  refused as "collect everything", not "collect nothing").
- otelNoStores: give it a bao client identity. The secret gate moved
  from deployCfg.authelia.enable to a real client cert/key pair, so a
  fixture meaning "no telemetry stores" now needs its own secret
  identity to keep exercising the exporter/authenticator wiring it
  was written for.
- docs/swarm/secrets.md: two vale fixes — a contraction, and drop a
  condescending "simply".
This commit is contained in:
atlas 2026-09-13 22:03:08 +02:00 • committed by mara
commit 30b9955ad3
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/swarm/secrets.md
View file

@ -82,7 +82,7 @@ The client it reads for is registered unconditionally, the same call
bearer-authz client with no audience, and the push audiences supply one even bearer-authz client with no audience, and the push audiences supply one even
for a collector with nothing published to scrape. for a collector with nothing published to scrape.
⚠️ **A collector with no store identity is not refused.** Unlike Grafana, ⚠️ **A collector with no store identity isn't refused.** Unlike Grafana,
where an absent OIDC block is a container with no way in at all, a collector where an absent OIDC block is a container with no way in at all, a collector
with nothing to authenticate with still receives every hive's telemetry — with nothing to authenticate with still receives every hive's telemetry —
only its own pushes to the stores go out unauthenticated and get refused only its own pushes to the stores go out unauthenticated and get refused
@ -219,7 +219,7 @@ runs the collector, and registration lives separately in
`glue-swarm-otel-oidc-client.nix` for the same reason Grafana's does. Where it `glue-swarm-otel-oidc-client.nix` for the same reason Grafana's does. Where it
differs is what an absent credential means: the collector still receives differs is what an absent credential means: the collector still receives
telemetry with none, so `swarm-otel.nix` doesn't assert telemetry with none, so `swarm-otel.nix` doesn't assert
`deploy.bao.clientCertFile` / `clientKeyFile` the way Grafana does — it simply `deploy.bao.clientCertFile` / `clientKeyFile` the way Grafana does — it
doesn't render the reading unit without them, the shape doesn't render the reading unit without them, the shape
`glue-matrix-bao-token.nix` and `glue-queue-agent-credential.nix` use for `glue-matrix-bao-token.nix` and `glue-queue-agent-credential.nix` use for
their own optional reads. their own optional reads.

3
nix/module-eval.nix
View file

@ -498,6 +498,8 @@ let
otelNoStores = hive { otelNoStores = hive {
deploy.swarm-otel.enable = true; deploy.swarm-otel.enable = true;
deploy.authelia.enable = true; deploy.authelia.enable = true;
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
deploy.victoriametrics.enable = false; deploy.victoriametrics.enable = false;
deploy.victorialogs.enable = false; deploy.victorialogs.enable = false;
}; };
@ -531,6 +533,7 @@ let
otelNoIdentity = hive { otelNoIdentity = hive {
deploy.swarm-otel.enable = true; deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid"; swarm.authelia.url = "https://auth.example.invalid";
swarm.otel.journaldUnits = [ "nginx" ];
}; };
# authelia somewhere else, the credential delivered by hand. Whether this # authelia somewhere else, the credential delivered by hand. Whether this