vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

ship container unit journals through the hive collector

Browse source
This commit is contained in:
atlas 2026-10-29 12:49:03 +01:00
commit e316e683c3
3 changed files with 27 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/scheduler/observability.md
View file

@ -375,7 +375,8 @@ no broker event, no per-hive dashboard banner. Both of those used to exist;
this change removed them in favour of the log line.
The hive tier's own collector runs a `journald` receiver scoped to the units
in `services.hyperhive.otel.journalUnits`: `hive-c0re.service`, plus
in `services.hyperhive.otel.journalUnits`: `hive-c0re.service`, the `container@*.service`
units (the start-time rootfs check lines; a host with the swarm collector reads them already), plus
`squid.service` and `squid-selfcheck.service` (see [Egress proxy](../networking/network.md#egress-proxy-squid)).
A host that runs the cache without the swarm collector adds `swarm-bao-attic-secret.service`
and `swarm-bao-attic-tokens.service`.

10
nix/host-modules/otel.nix
View file

@ -346,6 +346,16 @@ in
# The unit whose crash-watch warning a swarm-level alert reads.
services.hyperhive.otel.journalUnits = [ "hive-c0re.service" ];
# A container's start-time output: the rootfs check's warn-only lines
# and strict refusals (`hive-priv check-rootfs`, an `ExecStartPre=` of
# the unit) and nspawn's own start failures. `journalctl -u` takes the
# glob. A host that also runs the swarm collector ships its whole
# journal already (./swarm-otel.nix), so naming it there would send
# each line twice.
services.hyperhive.otel.journalUnits = lib.optionals (
!config.services.hyperhive.deploy.swarm-otel.enable
) [ "container@*.service" ];
services.opentelemetry-collector = {
enable = true;
# Contrib, matching the swarm tier (./swarm-otel.nix). The upstream

15
nix/module-eval/builder.nix
View file

@ -432,6 +432,21 @@ let
atticExternal
];
}
{
# The hive collector ships the container units' start output (the rootfs
# check's lines) unless the swarm collector already reads the whole
# journal. `hive-c0re.service` is the control that the lookup finds the
# list.
name = "the hive collector ships the container units' journal only where nothing else reads the host journal";
ok =
let
units = m: m.services.opentelemetry-collector.settings.receivers.journald.units;
glob = "container@*.service";
in
lib.elem glob (units atticByHand)
&& !(lib.elem glob (units atticHere))
&& lib.elem "hive-c0re.service" (units atticHere);
}
{
# Both host units log in as the cache's principal, not the hive's, and
# the container reaches the key through a read-only directory. The