vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents: swap the agent's bao leaf in with one rename

Browse source 
The live pair was replaced with two renames, key then cert. A run
stopped between them (timeout, container stop, power loss) left a new
key beside the old cert, and every later run logged in with that pair,
so the agent could not re-pull until its container restarted.

Each pair now goes into a fresh directory under
/run/hive-agent-bao-identity, and `current`, a symlink to it, is
replaced by one rename. Wherever a run stops, `current` names one whole
pair; the next run removes whatever a stopped run left. Consumers read
`current/cert` and `current/key` through the same read-only options and
still re-read them on every login.

The script test covers a swap stopped at each of its link and rename
steps: the live pair is always one whole pair, and the next run puts
the new one live.

Refs #5017
This commit is contained in:
atlas 2026-10-11 03:24:49 +02:00 • committed by mara
commit 4c4ecb8ed9
7 changed files with 166 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/module-eval/agent-matrix.nix
View file

@ -124,8 +124,8 @@ let
in
u.serviceConfig.LoadCredential == [ "hive-agent-bao-server-ca" ]
&& u.environment.BAO_ADDR == "https://bao.t.local:8200"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/key"
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key"
&& builtins.elem "hive-agent-bao-identity.service" u.after;
}
{