swarm: drop the -agent client suffix refusal from authelia and the queue responder
authelia.agentClientSuffix is removed (tombstoned) and the responder takes no --agent-client-suffix: hive-<name>-agent is parsed as hive <name>-agent like any other id. The reserved word agent still keeps a hive from being named *-agent.
This commit is contained in:
atlas
mara
parent
6bcffb0ebb
commit
e01770c056
12 changed files with 33 additions and 233 deletions
|
|
@ -95,6 +95,10 @@ in
|
|||
swarm-authelia-bridge listens on a unix socket the gateway proxies to, so
|
||||
it binds no port. Remove this definition.
|
||||
'')
|
||||
(lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "authelia" "agentClientSuffix" ] ''
|
||||
No client is minted per agent and the queue refuses no client id by
|
||||
suffix, so there is no suffix to name. Remove this definition.
|
||||
'')
|
||||
(lib.mkRemovedOptionModule [
|
||||
"services"
|
||||
"hyperhive"
|
||||
|
|
|
|||
|
|
@ -341,22 +341,6 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
agentClientSuffix = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
readOnly = true;
|
||||
default = "-agent";
|
||||
description = ''
|
||||
Suffix the queue's auth-callout responder refuses on a hive's client
|
||||
id: `${config.services.hyperhive.swarm.authelia.hiveClientPrefix}alpha${config.services.hyperhive.swarm.authelia.agentClientSuffix}`
|
||||
is denied, never read as hive `alpha-agent`. No client is minted with
|
||||
it; an agent authenticates to the queue with its own secret.
|
||||
|
||||
Read-only for the same reason as `hiveClientPrefix`. A hive named with
|
||||
this suffix is refused at evaluation, since the queue would refuse its
|
||||
own client id.
|
||||
'';
|
||||
};
|
||||
|
||||
machine = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
readOnly = true;
|
||||
|
|
|
|||
|
|
@ -682,30 +682,6 @@ in
|
|||
+ "services.hyperhive.swarm.hives; rename the hive or the "
|
||||
+ "colliding client.";
|
||||
}
|
||||
{
|
||||
# A hive whose name ENDS with the agent suffix mints an id the
|
||||
# queue's responder reads as a hive's agent client, which it refuses:
|
||||
# `hive-foo-agent` parses as *the agents of hive foo* before it
|
||||
# parses as *the hive foo-agent*, because the agent rule is the
|
||||
# more specific one and therefore runs first. A NATS denial arrives
|
||||
# as a timeout, so the symptom names nothing.
|
||||
#
|
||||
# Checkable here and nowhere downstream: the responder runs in a
|
||||
# container with no view of the roster (`policy.rs`'s `hive_name`
|
||||
# says why that is deliberate), so this is the last place that knows
|
||||
# both the naming scheme and the set of names.
|
||||
assertion =
|
||||
!cfg.oidc.hiveIdentities
|
||||
|| !lib.any (h: lib.hasSuffix cfg.agentClientSuffix h) (lib.attrNames hyperhiveCfg.swarm.hives);
|
||||
message =
|
||||
"services.hyperhive.swarm.hives contains "
|
||||
+ lib.concatMapStringsSep ", " (h: "'${h}'") (
|
||||
lib.filter (h: lib.hasSuffix cfg.agentClientSuffix h) (lib.attrNames hyperhiveCfg.swarm.hives)
|
||||
)
|
||||
+ " — names ending with '${cfg.agentClientSuffix}', the suffix the "
|
||||
+ "queue refuses as a hive's agent client. Such a hive's own client "
|
||||
+ "id reads as one, and the queue refuses it. Rename the hive.";
|
||||
}
|
||||
# The two obligations `authelia.bearer.authz` carries. Authelia
|
||||
# enforces both itself — but in its `preStart` validator, so a
|
||||
# violation produces a green `nixos-rebuild switch` and an authelia
|
||||
|
|
|
|||
|
|
@ -858,7 +858,6 @@ in
|
|||
# so a drift here is silent at the point of change and
|
||||
# misattributed at the point of failure.
|
||||
"--hive-client-prefix ${lib.escapeShellArg autheliaCfg.hiveClientPrefix}"
|
||||
"--agent-client-suffix ${lib.escapeShellArg autheliaCfg.agentClientSuffix}"
|
||||
"--reader-client ${lib.escapeShellArg controllerCfg.queueClientId}"
|
||||
# Hears try-outs and answers each by reply, and nothing else.
|
||||
"--review-classifier-client ${lib.escapeShellArg config.services.hyperhive.swarm.review-classifier.clientId}"
|
||||
|
|
|
|||
|
|
@ -360,12 +360,11 @@ in
|
|||
fragments = reservedFragments;
|
||||
why = ''
|
||||
Hive-scoped identifiers are composed from a hive name —
|
||||
`hive-<name>`, and that id with a suffix the queue's responder
|
||||
refuses — so a name containing one of these produces an identifier
|
||||
that is also somebody else's, or one the responder refuses. The
|
||||
failure is a wrong grant rather than an error: the client
|
||||
authenticates and receives another principal's permissions, and a
|
||||
NATS denial arrives as a timeout. Rename the hive.
|
||||
`hive-<name>` — so a name containing one of these produces an
|
||||
identifier that is also somebody else's. The failure is a wrong
|
||||
grant rather than an error: the client authenticates and receives
|
||||
another principal's permissions, and a NATS denial arrives as a
|
||||
timeout. Rename the hive.
|
||||
'';
|
||||
})
|
||||
];
|
||||
|
|
|
|||
|
|
@ -226,7 +226,7 @@ let
|
|||
}
|
||||
{
|
||||
# The substring guard has to work with the collector off too.
|
||||
# `h1-agent` would give the hive a client id the responder refuses.
|
||||
# `h1-agent` contains the reserved word `agent`.
|
||||
name = "a hive name containing a composed-identifier word is refused, with the collector off";
|
||||
ok = fragmentGuardFired hiveNameWithComposedWord;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -459,16 +459,16 @@ let
|
|||
!(lib.any (lib.hasSuffix "-policy.service") (u.after ++ u.wants));
|
||||
}
|
||||
{
|
||||
# The responder refuses the hive's shared agent client and takes no flag
|
||||
# granting it subjects: an `--agent-publish-subject` fails the unit at
|
||||
# start.
|
||||
name = "the responder grants the hive's shared agent client nothing";
|
||||
# The responder takes no agent-client suffix: no such client is minted.
|
||||
# `--hive-client-prefix` is the control that the lookup finds a flag the
|
||||
# unit does pass.
|
||||
name = "the responder is passed no agent-client suffix";
|
||||
ok =
|
||||
let
|
||||
exec =
|
||||
natsQueueOnly.containers.swarm-nats.config.systemd.services.swarm-nats-auth.serviceConfig.ExecStart;
|
||||
in
|
||||
!(lib.hasInfix "--agent-publish-subject " exec);
|
||||
lib.hasInfix "--hive-client-prefix " exec && !(lib.hasInfix "--agent-client-suffix" exec);
|
||||
}
|
||||
{
|
||||
# The per-agent grant: the terminal and agent-state streams keyed on the
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@
|
|||
# `hive-<name>` — every hive's OIDC client id, and the string the queue's
|
||||
# auth-callout responder strips to decide which hive a connection is.
|
||||
"hive"
|
||||
# `hive-<name>-agent` — an id the queue's responder refuses. A hive named
|
||||
# `foo-agent` would get a client id the responder refuses.
|
||||
# Keeps a hive's identifiers clear of the agent-scoped families, e.g. a hive
|
||||
# named `agent-<agent>` colliding with `hive-<hive>` object names.
|
||||
"agent"
|
||||
# Also an exact-match entry next door, for the collector's `<kind>/<owner>`
|
||||
# components. Here because it is the word this swarm composes identifiers
|
||||
|
|
|
|||
Loading…
Reference in a new issue