vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

swarm-bao: give the store's collector an explicit self-telemetry port

Browse source 
8890, so it stops claiming the hive collector's 8888 in the shared netns.
Extends the module-eval port case to all three tiers.
This commit is contained in:
atlas 2026-09-23 18:04:33 +02:00
commit e2ff4f5281
2 changed files with 78 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

44
nix/module-eval/hive-otel.nix
View file

@ -54,6 +54,23 @@ let
# one carries none.
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
};
# Also duplicated from bao-otel-collector.nix, where it is the fixture for
# the store standing beside a HIVE collector. That co-location is exactly
# the topology the port case below needs: two collectors, one netns, and
# nothing but their self-telemetry ports keeping them apart.
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
# demands of any hive with the tier on.
baoWithHiveOtel = hive {
deploy.bao.enable = true;
otel.enable = true;
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
};
# The collector INSIDE the store's container — neither the host's nor the
# swarm tier's.
baoForwarderSettings =
machine: machine.containers.swarm-bao.config.services.opentelemetry-collector.settings;
cases = [
{
# The tier in the middle. Its OTLP receiver takes both signals on one
@ -133,17 +150,28 @@ let
&& u.startLimitIntervalSec or 0 > u.serviceConfig.RestartSec * u.startLimitBurst;
}
{
# Both collectors share a network namespace whenever they are
# co-located, and this port appears in no config the port-collision
# assertion can read — so equal defaults mean the second to start dies
# at `bind()`. Pinned as a case rather than an assertion: enforcing it
# belongs with the other port checks, not here.
name = "the two collector tiers do not claim the same self-telemetry port";
# Collectors share a network namespace whenever they are co-located,
# and this port appears in no config the port-collision assertion can
# read — so equal defaults mean the second to start dies at `bind()`.
# Pinned as a case rather than an assertion: enforcing it belongs with
# the other port checks, not here.
#
# THREE tiers, because the store's container grew a collector of its
# own and this case could not see it: an UNDECLARED port is not an
# absent one, it is the binary's 8888, which is the hive tier's. That
# is why `portOf` falls back to 8888 rather than throwing — a tier that
# declares nothing has to fail this case loudly, not evaluate away.
name = "no two collector tiers claim the same self-telemetry port";
ok =
let
portOf = s: (lib.head s.service.telemetry.metrics.readers).pull.exporter.prometheus.port;
portOf =
s:
(lib.head (s.service.telemetry.metrics.readers or [ { } ])).pull.exporter.prometheus.port or 8888;
hivePort = portOf hiveOtelSettings;
swarmPort = portOf (otelSettings baoWithCollector);
baoPort = portOf (baoForwarderSettings baoWithHiveOtel);
in
portOf hiveOtelSettings != portOf (otelSettings baoWithCollector);
hivePort != swarmPort && hivePort != baoPort && swarmPort != baoPort;
}
];
in