vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval/hive-otel: pin the fetch reviving a start-limited collector

Browse source 
On a first boot the secret file does not exist until the first fetch
succeeds, so the collector fails `LoadCredential` into its start limit,
which leaves it `failed`. `refresh_unit` already handles that: it sees
`is-failed`, runs `reset-failed` (which clears the start-limit counter)
and starts it. This case pins that arm, the empty-ActiveEnterTimestamp
fallback that makes the file count as newer, and that the collector only
wants the fetch rather than requiring it.

Refs #5015
This commit is contained in:
atlas 2026-10-10 01:22:32 +02:00
commit e4e62be506
1 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/module-eval/hive-otel.nix
View file

@ -232,6 +232,29 @@ let
&& lib.hasInfix "ActiveEnterTimestamp" s
&& lib.hasInfix ''if [ "$written_us" -le "$started_us" ]; then'' s;
}
{
# On a first boot the file does not exist until the fetch succeeds, so
# the collector fails `LoadCredential` into its start limit, i.e. the
# `failed` state. Only `reset-failed` clears that limit, so the fetch
# has to reset before it starts; `try-restart` acts on no failed unit.
# A never-active collector has an empty `ActiveEnterTimestamp`, read as
# 0, so the file always counts as newer. The collector only `wants` the
# fetch, so an unreachable store does not hold it back.
name = "the hive collector's fetch revives a collector that hit its start limit without the file";
ok =
let
s = builtins.unsafeDiscardStringContext (hiveOtelFetch hiveOtelLeaf).script;
c = hiveOtelLeaf.systemd.services.opentelemetry-collector;
failedArm = lib.last (lib.splitString ''is-failed --quiet "$unit"; then'' s);
in
lib.hasInfix ''is-failed --quiet "$unit"; then'' s
&& lib.hasInfix ''reset-failed "$unit"'' failedArm
&& lib.hasInfix ''start --no-block "$unit"'' (
lib.last (lib.splitString ''reset-failed "$unit"'' failedArm)
)
&& lib.hasInfix "started_us=0" s
&& !(builtins.elem "swarm-bao-hive-otel-oidc.service" (c.requires or [ ]));
}
{
# The store is the one route, on the IdP's own host too: no default into
# authelia's tree and no unit waiting for a file to appear there.