vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

warn when a hive host without a leaf names the otel oidc secret file

Browse source
This commit is contained in:
atlas 2026-10-27 21:32:07 +01:00 • committed by mara
commit c79c41e004
2 changed files with 44 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/otel.nix
View file

@ -51,6 +51,8 @@ let
inherit (config.services.hyperhive.deploy.hive-controller) hiveName;
};
fetchedSecretPath = hiveOtelSecret.path;
pkiDir = import ./lib/bao-pki-dir.nix;
in
{
imports = [
@ -883,13 +885,22 @@ in
# The fetch unit writes `fetchedSecretPath` now, so a file named at the
# old default is delivered by nobody and never refreshed.
warnings = lib.optional (hiveName != null && otel.clientSecretFile == hiveOtelSecret.legacyPath) ''
services.hyperhive.otel.clientSecretFile is ${hiveOtelSecret.legacyPath}, the path
swarm-bao-hive-otel-oidc.service used to write. That unit now writes
${fetchedSecretPath} and, with the option set to anything else, does
not exist, so nothing refreshes the file. Remove the setting to fetch
from the swarm secret store, or deliver the file yourself.
'';
warnings =
lib.optional (hiveName != null && otel.clientSecretFile == hiveOtelSecret.legacyPath) ''
services.hyperhive.otel.clientSecretFile is ${hiveOtelSecret.legacyPath}, the path
swarm-bao-hive-otel-oidc.service used to write. That unit now writes
${fetchedSecretPath} and, with the option set to anything else, does
not exist, so nothing refreshes the file. Remove the setting to fetch
from the swarm secret store, or deliver the file yourself.
''
++ lib.optional (hiveName != null && !hiveLeaf && otel.clientSecretFile != null) ''
services.hyperhive.otel.clientSecretFile is ${otel.clientSecretFile} and this
host holds no store identity (services.hyperhive.deploy.bao.clientCertFile
and clientKeyFile). Place the hive's leaf from ${pkiDir}/hives/${hiveName}/
on the host that runs the store, set those two options, then drop
services.hyperhive.otel.clientSecretFile: the collector then fetches its
secret from the swarm secret store under that leaf.
'';
assertions = [
{

25
nix/module-eval/hive-otel.nix
View file

@ -49,6 +49,10 @@ let
deploy.authelia.enable = true;
};
# Neither a leaf nor a secret file: the one shape the collector has no
# credential for.
hiveOtelBare = hiveWithController { };
hiveOtelFetch = machine: machine.systemd.services.swarm-bao-hive-otel-oidc;
hiveOtelPipelines = hiveOtel.services.opentelemetry-collector.settings.service.pipelines;
@ -262,6 +266,27 @@ let
&& !(builtins.elem "f ${run} 0400 root root -" (rules hiveOtel))
&& warned hiveOtel;
}
{
# Without a store identity, a hand-named secret file is warned to place
# the leaf; with the leaf nothing is warned and the fetch unit exists;
# with neither, the assertion still refuses the build. `hiveOtelBare`
# and `hiveOtelLeaf` are the controls: a lookup that never matches
# would pass the negated arms.
name = "a hive host with no leaf and an operator secret file is warned to place the leaf";
ok =
let
warned = m: lib.any (lib.hasInfix "holds no store identity") m.warnings;
refused = m: lib.any (a: !a.assertion && lib.hasInfix "identity to present" a.message) m.assertions;
in
warned hiveOtel
&& lib.any (lib.hasInfix "/var/lib/swarm-bao-pki/hives/h1/") hiveOtel.warnings
&& !(warned hiveOtelLeaf)
&& hiveOtelLeaf.systemd.services ? swarm-bao-hive-otel-oidc
&& !(warned hiveOtelBare)
&& refused hiveOtelBare
&& !(refused hiveOtel)
&& !(refused hiveOtelLeaf);
}
{
# `LoadCredential` copies the file at the collector's start, so a value
# landed later reaches it only through a restart. Retries every 30s