vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: fail swarm-services-cert when the store identity is absent

Browse source 
A hive fronting no swarm name fetches the store's pki root presenting its
reader certificate. When deploy.bao.clientCertFile or clientKeyFile is unset,
or either named file is not readable, the unit now exits 1 with a message
naming both options and their paths, instead of exiting 0 with the root
missing from the trust bundle.

The module-eval cases that asserted the quiet skip assert the failure
instead, and a new case covers the named-but-absent files.
This commit is contained in:
atlas 2026-10-04 08:35:12 +02:00 • committed by mara
commit 849bf46550
4 changed files with 52 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nix/module-eval/hive-tls.nix
View file

@ -50,11 +50,12 @@ let
noIdentity = hive { };
noIdFetch = noIdentity.systemd.services.swarm-services-cert.script;
# The `want_svc=0` branch of a rendered script, up to its closing `fi`.
# The `want_svc=0` branch of a rendered script, up to the `fi` that closes it (the
# only one followed by a blank line).
noSvcBranch =
script:
builtins.head (
lib.splitString "\nfi\n" (lib.last (lib.splitString ''if [ "$want_svc" = 0 ]; then'' script))
lib.splitString "\nfi\n\n" (lib.last (lib.splitString ''if [ "$want_svc" = 0 ]; then'' script))
);
units = allLocal.systemd.services;
@ -159,20 +160,33 @@ let
) noSvcFetch;
}
{
# Nothing to present means no fetch to fail: the unit stays green and
# says why the root is missing. The control is the same hive with an
# identity, whose branch does fetch and can fail.
name = "a hive fronting no swarm name with no store identity skips the fetch and cannot fail on it";
# No identity to present: the unit fails, naming both options, rather
# than leaving the bundle without the root behind a green unit. The
# control is the same hive with an identity, whose branch fetches.
name = "a hive fronting no swarm name with no store identity fails the unit, naming both options";
ok =
noIdentity.services.hyperhive.swarm.localServiceDomains == [ ]
&& noIdentity.services.hyperhive.deploy.bao.clientCertFile == null
&& !(lib.hasInfix "/v1/pki/ca/pem" noIdFetch)
&& lib.hasInfix "store pki root not staged" (noSvcBranch noIdFetch)
&& lib.hasInfix "deploy.bao.clientCertFile" (noSvcBranch noIdFetch)
&& !(lib.hasInfix "exit 1" (noSvcBranch noIdFetch))
&& lib.hasInfix "exit 1" (noSvcBranch noSvcFetch)
&& lib.hasInfix "services.hyperhive.deploy.bao.clientCertFile" (noSvcBranch noIdFetch)
&& lib.hasInfix "services.hyperhive.deploy.bao.clientKeyFile" (noSvcBranch noIdFetch)
&& lib.hasSuffix "exit 1" (noSvcBranch noIdFetch)
&& !(lib.hasInfix "exit 0" (noSvcBranch noIdFetch))
&& !(lib.hasInfix "not staged" noIdFetch)
&& lib.hasInfix "/v1/pki/ca/pem" (noSvcBranch noSvcFetch);
}
{
# An identity named but not on disk fails before curl, naming the paths.
name = "a hive fronting no swarm name whose identity files are absent fails the unit, naming the paths";
ok =
lib.hasInfix "for f in /etc/pki/bao-client.pem /etc/pki/bao-client-key.pem; do" (
noSvcBranch noSvcFetch
)
&& lib.hasInfix ''[ -r "$f" ] || missing="$missing $f"'' (noSvcBranch noSvcFetch)
&& lib.hasInfix "cannot read$missing" (noSvcBranch noSvcFetch)
&& lib.hasInfix "clientCertFile (/etc/pki/bao-client.pem)" (noSvcBranch noSvcFetch)
&& lib.hasInfix "clientKeyFile (/etc/pki/bao-client-key.pem)" (noSvcBranch noSvcFetch);
}
{
# The fetch retries against a sealed store; a gateway `Requires=` on it
# would go down with each attempt. The control is a host fronting