vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add one shared templated agent policy and name each agent's bao entity after it

Browse source
This commit is contained in:
atlas 2026-10-25 20:39:59 +01:00 • committed by mara
commit 4cdf807afc
1 changed files with 777 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

23
swarm-controller/src/read_policy.rs
View file

@ -193,7 +193,7 @@ async fn write_role(store: &SecretStore, hive: &str, ca: &str) -> Result<()> {
store
// The subject is the hive's name: `glue-bao-tls.nix` mints a hive's
// client leaf with its name as the CN, and cert auth matches on that.
.write_cert_role(DEFAULT_CERT_MOUNT, &name, ca, hive, &name)
.write_cert_role(DEFAULT_CERT_MOUNT, &name, ca, hive, &[&name])
.await
.with_context(|| format!("writing the cert-auth role {name}"))?;
tracing::info!(hive, role = %name, "hive store role in place");
@ -234,9 +234,10 @@ pub async fn ensure_agent_policies() {
}
}
/// One pass: log in once, list the agents, write each one's policy.
/// One pass: log in once, list the agents, write the shared agent policy and
/// each one's own, and give each its identity entity.
///
/// The policy only. An agent's cert-auth role and certificate are
/// Policies and entities only. An agent's cert-auth role and certificate are
/// `agent_identity::mint_and_verify`'s, and that reissues the certificate, so
/// it is not what a pass on every start may call.
///
@ -260,6 +261,21 @@ async fn rewrite_agent_policies() -> Result<(), Unreachable> {
.list_cert_roles(DEFAULT_CERT_MOUNT)
.await
.map_err(|e| Unreachable(format!("listing the store's cert-auth roles: {e}")))?;
// First, so the cert-auth role that names it never points at nothing.
match store
.write_policy(policy::SHARED_AGENT_POLICY, &policy::render_shared_agent())
.await
{
Ok(()) => tracing::info!(
policy = policy::SHARED_AGENT_POLICY,
"shared agent policy in place"
),
Err(e) => tracing::warn!(
policy = policy::SHARED_AGENT_POLICY,
error = %e,
"writing the shared agent policy failed"
),
}
let policies = agent_policies(&roles);
let mut written = 0_usize;
for (name, document) in &policies {
@ -271,6 +287,7 @@ async fn rewrite_agent_policies() -> Result<(), Unreachable> {
}
}
tracing::info!(written, agents = policies.len(), "agent policies rewritten");
crate::agent_entity::ensure_agents(&store, &policy::agents_from_role_names(&roles)).await;
Ok(())
}