vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: a gateway host without the services-issuer pair evaluates and goes red at runtime

Browse source 
Drop the eval assertion b78190e1 added. It refused every self-signed
gateway host that does not run the store, which is the default hive
shape, and contradicts docs/swarm/secrets.md's supported no-store
deployment. The approved #4921 plan has such a host evaluate and fail
at runtime; `requireServicesIssuer` already exits 1 naming both
options, on the root-fetch branch and before issuing.

The module-eval case that pinned `hiveWithController { }` as refused
now pins it, and a hive-less gateway with no pair, as evaluating with
the unit's refusal in the script. The fixture pairs the assertion
forced into forge-placement, nats-tls and swarm-otel-identity are
reverted.

Refs #4921
This commit is contained in:
atlas 2026-10-06 11:53:17 +02:00 • committed by mara
commit 6a9c819136
7 changed files with 37 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/module-eval/hive-tls.nix
View file

@ -288,9 +288,11 @@ let
&& refsHive [ noService.systemd.services.hive-tls-resign ];
}
{
# The control is the same host with the pair placed, and the store's
# host, where the glue supplies it.
name = "a self-signed gateway with no services-issuer pair fails evaluation, naming both options";
# A host with no store and no pair placed is a supported shape: it
# evaluates, and its unit goes red. The control is the same host with
# the pair placed, whose branch fetches, and the store's host, where
# the glue supplies the pair.
name = "a self-signed gateway with no services-issuer pair evaluates, and its unit fails naming both options";
ok =
let
refused =
@ -298,15 +300,29 @@ let
lib.any (
a:
!a.assertion
&& lib.hasInfix "services.hyperhive.deploy.bao.servicesIssuerClientCertFile" a.message
&& lib.hasInfix "services.hyperhive.deploy.bao.servicesIssuerClientKeyFile" a.message
&& (
lib.hasInfix "servicesIssuerClientCertFile" a.message
|| lib.hasInfix "servicesIssuerClientKeyFile" a.message
)
) m.assertions;
redUnit =
m:
let
branch = noSvcBranch m.systemd.services.swarm-services-cert.script;
in
lib.hasInfix "services.hyperhive.deploy.bao.servicesIssuerClientCertFile (unset)" branch
&& lib.hasInfix "services.hyperhive.deploy.bao.servicesIssuerClientKeyFile (unset)" branch
&& lib.hasSuffix "exit 1" (lib.removeSuffix "\n" branch)
&& !(lib.hasInfix "/v1/pki/ca/pem" branch);
in
refused gatewayNoHiveNoPair
&& refused noIdentity
&& !(refused gatewayNoHive)
&& !(refused noService)
&& !(refused allLocal)
!(refused gatewayNoHiveNoPair)
&& !(refused noIdentity)
&& redUnit gatewayNoHiveNoPair
&& redUnit noIdentity
&& !(redUnit gatewayNoHive)
&& lib.hasInfix "/v1/pki/ca/pem" (
noSvcBranch gatewayNoHive.systemd.services.swarm-services-cert.script
)
&&
allLocal.services.hyperhive.deploy.bao.servicesIssuerClientCertFile
== "/var/lib/swarm-bao-pki/services-issuer.pem";