bao reader policy, responder units and docs for the per-surface grant

nix/host-modules/swarm-bao.nix

@@ -1219,7 +1219,7 @@ let
 
   # The log store's auth responders: the agent one checks the secret an agent
   # presents against the one stored for it (the same `+` leaf as the queue
-  # responder's), the other checks the bearer Grafana presents against
+  # responder's) and reads the agent's mirrored `logs`/`metrics` grant, the other checks the bearer Grafana presents against
   # Grafana's metrics bearer; and the store container's journal forwarder
   # reads its own client secret under the same leaf. Nothing else.
   logsAuthReaders = [
@@ -1229,6 +1229,7 @@ let
       batchToken = true;
       policyText =
         readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
+        + readStanza "${credentialMountPath}/data/swarm/agents/+/observability"
         + readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
         # The journal forwarder in the store's container, under this same leaf.
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.victorialogs.otel.clientId}/oidc/client";
@@ -1237,7 +1238,7 @@ let
 
   # The metrics store's responders under one leaf: the agent one checks the
   # secret an agent presents against the one stored for it (the same `+` leaf
-  # as the log store's), the other checks the bearer Grafana presents; and the
+  # as the log store's) and reads the agent's mirrored grant, the other checks the bearer Grafana presents; and the
   # host unit that fetches the store container's journal forwarder secret.
   # Nothing else.
   metricsAuthReaders = [
@@ -1247,6 +1248,7 @@ let
       batchToken = true;
       policyText =
         readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
+        + readStanza "${credentialMountPath}/data/swarm/agents/+/observability"
         + readStanza "${credentialMountPath}/data/${grafanaMetricsBearerLeaf}"
         # The metrics store container's journal forwarder, fetched on its host.
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.victoriametrics.otel.clientId}/oidc/client";

nix/host-modules/swarm-victorialogs.nix

@@ -216,8 +216,9 @@ in
       without reading the secret store. A denial is never remembered.
 
       This is also how long a re-minted or deleted queue secret keeps working
-      at the log store's query route after its last successful check. `0`
-      checks the store on every query.
+      at the log store's query route after its last successful check. It is
+      equally how long a revoked `logs` permission keeps working. `0` checks
+      the store on every query.
     '';
   };
 
@@ -514,6 +515,7 @@ in
           "--socket ${logsAuthSocket}"
           # The role ./swarm-bao.nix writes on the store's `cert` mount.
           "--store-cert-role swarm-logs-auth"
+          "--surface logs"
           "--verdict-ttl ${toString deployCfg.victorialogs.authVerdictTtl}"
         ];
         # Paths only: `argv` is world-readable via /proc/<pid>/cmdline.

nix/host-modules/swarm-victoriametrics.nix

@@ -295,8 +295,9 @@ in
       remembered.
 
       This is also how long a re-minted or deleted queue secret keeps working
-      at the metrics store's read API after its last successful check. `0`
-      checks the store on every query.
+      at the metrics store's read API after its last successful check. It is
+      equally how long a revoked `metrics` permission keeps working. `0` checks
+      the store on every query.
     '';
   };
 
@@ -610,6 +611,7 @@ in
           "${deployCfg.victoriametrics.agentAuthPackage}/bin/swarm-logs-auth"
           "--socket ${agentAuthSocket}"
           "--store-cert-role swarm-metrics-auth"
+          "--surface metrics"
           "--verdict-ttl ${toString deployCfg.victoriametrics.agentAuthVerdictTtl}"
         ];
         LoadCredential = lib.mapAttrsToList (id: path: "${id}:${path}") metricsAuthStoreFiles;

nix/module-eval/bao-grants.nix

@@ -835,7 +835,7 @@ let
       # Every agent's queue secret, Grafana's metrics bearer and the store
       # container forwarder's client secret, all read-only, and nothing else:
       # this principal checks a presented secret and does nothing with it.
-      name = "the log store responder's grant is every agent's queue secret, Grafana's bearer and its container forwarder's client secret, read-only, and nothing else";
+      name = "the log store responder's grant is every agent's queue secret and log/metric grant, Grafana's bearer and its container forwarder's client secret, read-only, and nothing else";
       ok =
         let
           s = baoGrantHere.systemd.services.swarm-bao-logs-auth-policy.script;
@@ -845,6 +845,10 @@ let
             path = "secret/data/swarm/agents/+/queue";
             caps = [ "read" ];
           }
+          {
+            path = "secret/data/swarm/agents/+/observability";
+            caps = [ "read" ];
+          }
           {
             path = "secret/data/swarm/services/swarm-grafana/metrics/bearer";
             caps = [ "read" ];
@@ -871,7 +875,7 @@ let
       # creates and the store container forwarder's client secret, and nothing
       # else: this principal checks presented bearers, and its host fetches
       # one secret for the container.
-      name = "the metrics store responder's grant is agents' queue secrets, Grafana's metrics bearer and its container forwarder's client secret, read-only, and nothing else";
+      name = "the metrics store responder's grant is agents' queue secrets and log/metric grants, Grafana's metrics bearer and its container forwarder's client secret, read-only, and nothing else";
       ok =
         let
           s = baoGrantHere.systemd.services.swarm-bao-metrics-auth-policy.script;
@@ -881,6 +885,10 @@ let
             path = "secret/data/swarm/agents/+/queue";
             caps = [ "read" ];
           }
+          {
+            path = "secret/data/swarm/agents/+/observability";
+            caps = [ "read" ];
+          }
           {
             path = "secret/data/swarm/services/swarm-grafana/metrics/bearer";
             caps = [ "read" ];

nix/module-eval/core-toggle.nix

@@ -998,6 +998,7 @@ let
         && !(hasStorePath "${logs.authPackage}" agentUnit.serviceConfig.ExecStart)
         && hasStorePath "${v.authPackage}/bin/swarm-metrics-auth " unit.serviceConfig.ExecStart
         && lib.hasInfix "--store-cert-role swarm-metrics-auth" agentUnit.serviceConfig.ExecStart
+        && lib.hasInfix "--surface metrics" agentUnit.serviceConfig.ExecStart
         && lib.hasInfix "--verdict-ttl ${toString v.agentAuthVerdictTtl}" agentUnit.serviceConfig.ExecStart
         && agentUnit.serviceConfig.LoadCredential == unit.serviceConfig.LoadCredential
         && lib.hasInfix "limit_req_zone $binary_remote_addr zone=swarm_metrics_agent_auth:1m rate=${v.agentAuthRate};" http
@@ -1143,6 +1144,7 @@ let
         && lib.hasInfix "internal;" l."= /__swarm_logs_agent_auth".extraConfig
         && l."= /__swarm_logs_agent_auth".proxyPass == "http://unix:/run/swarm-logs-auth/auth.sock:/"
         && lib.hasInfix "--socket /run/swarm-logs-auth/auth.sock" unit.serviceConfig.ExecStart
+        && lib.hasInfix "--surface logs" unit.serviceConfig.ExecStart
         && lib.hasInfix "internal;" l."= /__swarm_logs_grafana_auth".extraConfig
         &&
           l."= /__swarm_logs_grafana_auth".proxyPass == "http://unix:/run/swarm-logs-grafana-auth/auth.sock:/"