vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

granter role no-op deletes the dead bootstrap token

Browse source
This commit is contained in:
atlas 2026-10-26 19:00:02 +01:00 • committed by mara
commit 31670da795
3 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/swarm/bao.md
View file

@ -45,8 +45,8 @@ refuses the token (expired, revoked, or missing the `bao-bootstrap` policy)
makes it exit 4 and stay `failed` with the one-time step in its log; mint a makes it exit 4 and stay `failed` with the one-time step in its log; mint a
fresh token or remove the file, then restart it. If the granter's own fresh token or remove the file, then restart it. If the granter's own
certificate login already works, the unit logs that the bootstrap token isn't certificate login already works, the unit logs that the bootstrap token isn't
needed and exits 0, so a stale file is harmless. A successful run deletes the needed, deletes the dead token file and exits 0, so a stale file is harmless
token file. and the unit runs once. A successful run deletes the token file too.
After that, a new or changed `swarm-*` grant needs no operator step: the unit After that, a new or changed `swarm-*` grant needs no operator step: the unit
that writes it changes, and the deploy restarts it. A root step comes back only that writes it changes, and the deploy restarts it. A root step comes back only

4
nix/host-modules/swarm-bao.nix
View file

@ -3186,11 +3186,13 @@ in
# a host that finished bootstrap and kept the file. The # a host that finished bootstrap and kept the file. The
# granter's own login is the proof. A fresh token still takes # granter's own login is the proof. A fresh token still takes
# the full path below, since the granter cannot read back its # the full path below, since the granter cannot read back its
# own policy to compare it. # own policy to compare it. The refused token is dead,
# so it is deleted here and the unit does not start again.
if BAO_CLIENT_CERT=${lib.escapeShellArg baoDeploy.granterClientCertFile} \ if BAO_CLIENT_CERT=${lib.escapeShellArg baoDeploy.granterClientCertFile} \
BAO_CLIENT_KEY=${lib.escapeShellArg baoDeploy.granterClientKeyFile} \ BAO_CLIENT_KEY=${lib.escapeShellArg baoDeploy.granterClientKeyFile} \
bao login -method=cert -token-only >/dev/null 2>&1; then bao login -method=cert -token-only >/dev/null 2>&1; then
echo "granter role already in place; bootstrap token not needed" echo "granter role already in place; bootstrap token not needed"
rm -f ${lib.escapeShellArg baoDeploy.bootstrapTokenFile}
exit 0 exit 0
fi fi
echo ${lib.escapeShellArg "the store is unsealed but refused the bootstrap token in ${baoDeploy.bootstrapTokenFile}: it has expired, been revoked, or does not carry the bao-bootstrap policy."} >&2 echo ${lib.escapeShellArg "the store is unsealed but refused the bootstrap token in ${baoDeploy.bootstrapTokenFile}: it has expired, been revoked, or does not carry the bao-bootstrap policy."} >&2

2
nix/module-eval/bao-grants.nix
View file

@ -1125,8 +1125,10 @@ let
noop = "granter role already in place; bootstrap token not needed"; noop = "granter role already in place; bootstrap token not needed";
del = "rm -f /run/secrets/bao-bootstrap.token"; del = "rm -f /run/secrets/bao-bootstrap.token";
before = lib.head (lib.splitString "refused the bootstrap token" g); before = lib.head (lib.splitString "refused the bootstrap token" g);
noopBranch = lib.head (lib.splitString "exit 0" (lib.last (lib.splitString noop g)));
in in
lib.hasInfix noop before lib.hasInfix noop before
&& lib.hasInfix del noopBranch
&& lib.hasInfix "bao login -method=cert -token-only" before && lib.hasInfix "bao login -method=cert -token-only" before
&& lib.hasInfix "BAO_CLIENT_CERT=" before && lib.hasInfix "BAO_CLIENT_CERT=" before
&& lib.hasInfix del g && lib.hasInfix del g