vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

warn when a hive host without a leaf names the otel oidc secret file

Browse source
This commit is contained in:
atlas 2026-10-27 21:32:07 +01:00 • committed by mara
commit c79c41e004
1 changed files with 44 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/otel.nix
View file

@ -51,6 +51,8 @@ let
inherit (config.services.hyperhive.deploy.hive-controller) hiveName;
};
fetchedSecretPath = hiveOtelSecret.path;
pkiDir = import ./lib/bao-pki-dir.nix;
in
{
imports = [
@ -883,13 +885,22 @@ in
# The fetch unit writes `fetchedSecretPath` now, so a file named at the
# old default is delivered by nobody and never refreshed.
warnings = lib.optional (hiveName != null && otel.clientSecretFile == hiveOtelSecret.legacyPath) ''
services.hyperhive.otel.clientSecretFile is ${hiveOtelSecret.legacyPath}, the path
swarm-bao-hive-otel-oidc.service used to write. That unit now writes
${fetchedSecretPath} and, with the option set to anything else, does
not exist, so nothing refreshes the file. Remove the setting to fetch
from the swarm secret store, or deliver the file yourself.
'';
warnings =
lib.optional (hiveName != null && otel.clientSecretFile == hiveOtelSecret.legacyPath) ''
services.hyperhive.otel.clientSecretFile is ${hiveOtelSecret.legacyPath}, the path
swarm-bao-hive-otel-oidc.service used to write. That unit now writes
${fetchedSecretPath} and, with the option set to anything else, does
not exist, so nothing refreshes the file. Remove the setting to fetch
from the swarm secret store, or deliver the file yourself.
''
++ lib.optional (hiveName != null && !hiveLeaf && otel.clientSecretFile != null) ''
services.hyperhive.otel.clientSecretFile is ${otel.clientSecretFile} and this
host holds no store identity (services.hyperhive.deploy.bao.clientCertFile
and clientKeyFile). Place the hive's leaf from ${pkiDir}/hives/${hiveName}/
on the host that runs the store, set those two options, then drop
services.hyperhive.otel.clientSecretFile: the collector then fetches its
secret from the swarm secret store under that leaf.
'';
assertions = [
{