vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

bring existing agent cert roles to the 1h token ttl on controller start

Browse source
This commit is contained in:
atlas 2026-10-29 13:47:32 +01:00 • committed by mara
commit 76de27fc97
1 changed files with 513 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

15
swarm-controller/src/read_policy.rs
View file

@ -22,7 +22,8 @@
//! a config change means a redeploy.
//!
//! The shared agent policy is written by the same kind of pass
//! ([`ensure_agent_policies`]), together with each agent's identity entity.
//! ([`ensure_agent_policies`]), together with each agent's identity entity and
//! the token lifetimes of its existing role ([`crate::agent_role_ttl`]).
//! Its roster is the store's `hive-agent-*` cert-auth roles.
use std::{future::Future, time::Duration};
@ -299,12 +300,13 @@ pub async fn ensure_agent_policies() {
}
}
/// One pass: log in once, list the agents, write the shared agent policy and
/// give each agent its identity entity.
/// One pass: log in once, list the agents, write the shared agent policy, give
/// each agent its identity entity and bring each existing role's token
/// lifetimes current.
///
/// The policy and entities only. An agent's cert-auth role and certificate are
/// `agent_identity::mint_and_verify`'s, and that reissues the certificate, so
/// it is not what a pass on every start may call.
/// The roles' certificate, names and policies are not touched. They and the
/// certificate are `agent_identity::mint_and_verify`'s, and that reissues the
/// certificate, so it is not what a pass on every start may call.
///
/// # Errors
/// [`Unreachable`] when the store cannot be reached or will not list its
@ -342,6 +344,7 @@ async fn rewrite_agent_policies() -> Result<(), Unreachable> {
),
}
crate::agent_entity::ensure_agents(&store, &policy::agents_from_role_names(&roles)).await;
crate::agent_role_ttl::bring_current(&store, &roles).await;
Ok(())
}