vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

granter role no-op deletes the dead bootstrap token

Browse source
This commit is contained in:
atlas 2026-10-26 19:00:02 +01:00 • committed by mara
commit 31670da795
1 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/host-modules/swarm-bao.nix
View file

@ -3186,11 +3186,13 @@ in
# a host that finished bootstrap and kept the file. The
# granter's own login is the proof. A fresh token still takes
# the full path below, since the granter cannot read back its
# own policy to compare it.
# own policy to compare it. The refused token is dead,
# so it is deleted here and the unit does not start again.
if BAO_CLIENT_CERT=${lib.escapeShellArg baoDeploy.granterClientCertFile} \
BAO_CLIENT_KEY=${lib.escapeShellArg baoDeploy.granterClientKeyFile} \
bao login -method=cert -token-only >/dev/null 2>&1; then
echo "granter role already in place; bootstrap token not needed"
rm -f ${lib.escapeShellArg baoDeploy.bootstrapTokenFile}
exit 0
fi
echo ${lib.escapeShellArg "the store is unsealed but refused the bootstrap token in ${baoDeploy.bootstrapTokenFile}: it has expired, been revoked, or does not carry the bao-bootstrap policy."} >&2