vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-agent: read the per-agent queue secret from bao in process

Browse source 
The harness now reads swarm/agents/<agent>/queue from the store itself,
under the agent's own store certificate, and holds it in memory only.
It reads once before the first connect and again on every reconnect
attempt (async-nats `ConnectOptions::with_auth_callback`), so an agent
whose secret was re-minted reconnects with the new value instead of
being refused until the container restarts.

hive-agent-queue-credential.service, the /run file it wrote, and
HIVE_AGENT_QUEUE_AGENT_SECRET_FILE are gone; queue-identity.nix now
hands hive-agent.service the store address, its certificate paths and
the agent name.

A failed or empty read before the first connect still falls back to
the hive's shared client. Each read is bounded by a 10s timeout, and
retries wait out the existing reconnect backoff (500ms doubling, capped
at 60s).

Closes #4783
This commit is contained in:
atlas 2026-09-29 09:40:48 +02:00 • committed by mara
commit ccb5bd3b38
10 changed files with 770 additions and 529 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/script-tests/agent-bao-fetch.nix
View file

@ -1,9 +1,8 @@
# `checks.script-test-agent-bao-fetch` — runs the two agent units that log in
# to the swarm secret store and fetch a secret, ../agent-modules/forge-token.nix
# and ../agent-modules/queue-identity.nix, against a stub `bao`. The cases are
# in ./agent-bao-fetch.sh.
# `checks.script-test-agent-bao-fetch` — runs the agent unit that logs in to
# the swarm secret store and fetches a secret, ../agent-modules/forge-token.nix,
# against a stub `bao`. The cases are in ./agent-bao-fetch.sh.
#
# What runs is each unit's rendered `ExecStart`, on the unit's own `PATH` with
# What runs is the unit's rendered `ExecStart`, on the unit's own `PATH` with
# the stub in front. The one edit is the unit's `/run/<unit>/` prefix, moved
# under the build directory because the sandbox has no writable `/run`.
{
@ -71,7 +70,6 @@ in
pkgs.runCommand "hyperhive-script-test-agent-bao-fetch"
(
unitEnv "FORGE" "hive-agent-forge-token"
// unitEnv "QUEUE" "hive-agent-queue-credential"
// {
FAKE_BAO_BIN = "${fakeBao}/bin";
}