vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

granter role unit: no-op when the granter login works, delete the token after success

Browse source
This commit is contained in:
atlas 2026-10-26 18:41:38 +01:00 • committed by mara
commit 3db835fb57
2 changed files with 42 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/getting-started/setup.md
View file

@ -37,13 +37,13 @@ systemctl restart swarm-bao-granter-role
Check `systemctl status swarm-bao-granter-role` logs
`Uploaded policy: bao-granter`, then restart the granting units that
failed while they waited, and remove the token:
failed while they waited. The granter unit deletes the token itself after a
successful run:
```bash
systemctl reset-failed 'swarm-bao-*-policy.service' swarm-bao-agent-pki.service
systemctl restart 'swarm-bao-*-policy.service' swarm-bao-agent-pki.service
systemctl status swarm-bao-controller-policy # Uploaded policy, Data written to: auth/cert/certs/swarm-controller
rm /var/lib/swarm-bao-bootstrap/grant.token
```
⏱️ A first attempt right after a rebuild may fail with `local node not

5
docs/swarm/bao.md
View file

@ -43,7 +43,10 @@ TTL means a forgotten file expires rather than lingering.
A sealed or unreachable store makes the unit retry every 30 s. A store that
refuses the token (expired, revoked, or missing the `bao-bootstrap` policy)
makes it exit 4 and stay `failed` with the one-time step in its log; mint a
fresh token or remove the file, then restart it.
fresh token or remove the file, then restart it. If the granter's own
certificate login already works, the unit logs that the bootstrap token isn't
needed and exits 0, so a stale file is harmless. A successful run deletes the
token file.
After that, a new or changed `swarm-*` grant needs no operator step: the unit
that writes it changes, and the deploy restarts it. A root step comes back only