vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive telemetry collector: keep the secret wait for an operator-named file

Browse source 
The previous commit dropped `hive-otel-client-secret` and the collector's
`requires`/`after` on it for every hive. Only the store fetch restarts the
collector when its file lands; an operator-named `otel.clientSecretFile`
has nothing doing that, so a late file failed `LoadCredential` straight into
the collector's start limit with no way back.

The wait unit and the ordering are back for `senderAuth && !fetches`, and
absent only where `swarm-bao-hive-otel-oidc` delivers the file. The
module-eval case for a hand-named secret now also pins the wait unit and
the collector's `requires`/`after` on it, on both of its fixtures.

Refs #5015
This commit is contained in:
atlas 2026-10-10 01:16:04 +02:00
commit 9ef4f55113
3 changed files with 92 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix/module-eval/hive-otel.nix
View file

@ -261,12 +261,27 @@ let
}
{
# A secret delivered some other way is the operator's: no unit fetches
# into a file the collector does not load, or restarts it on one.
name = "a hand-named collector secret renders no store fetch";
# into a file the collector does not load, or restarts it on one. Nothing
# restarts the collector when that file lands, so it waits for the file
# instead of failing `LoadCredential` into its start limit.
name = "a hand-named collector secret renders no store fetch, and the collector waits for the file";
ok =
let
waitsFor =
machine:
let
c = machine.systemd.services.opentelemetry-collector;
w = machine.systemd.services.hive-otel-client-secret;
in
builtins.elem "hive-otel-client-secret.service" c.requires
&& builtins.elem "hive-otel-client-secret.service" c.after
&& lib.hasInfix "/var/lib/hive-otel-oidc/client.secret" w.script;
in
!(hiveOtel.systemd.services ? swarm-bao-hive-otel-oidc)
&& !(baoWithHiveOtel.systemd.services ? swarm-bao-hive-otel-oidc)
&& builtins.elem "swarm-client.secret:/var/lib/hive-otel-oidc/client.secret" baoWithHiveOtel.systemd.services.opentelemetry-collector.serviceConfig.LoadCredential;
&& builtins.elem "swarm-client.secret:/var/lib/hive-otel-oidc/client.secret" baoWithHiveOtel.systemd.services.opentelemetry-collector.serviceConfig.LoadCredential
&& waitsFor hiveOtel
&& waitsFor baoWithHiveOtel;
}
];
in