vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: set the hive-controller option only in tests that need a hive

Browse source 
The shared `hive` fixture turned `deploy.hive-controller.enable` on for
every eval test. It is now off by default; `hiveWithController` turns it
on, and the fixtures whose claims read the hive tier (hive-c0re, the
queue-agent credential, the hive leaf, `deploy.hive-controller.*`, or an
absence that is only meaningful with a hive present) use it.

glue-nats-auth-bao-identity.nix still read the renamed
`services.hyperhive.enable`, which printed the "Obsolete option" trace
six times per CI run. The term is dropped: the pairing is gated on the
queue and the minted PKI, as its sibling glue-nats-bao-identity.nix is.
This commit is contained in:
atlas 2026-10-05 02:27:33 +02:00 • committed by mara
commit ea63b0d150
10 changed files with 47 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/module-eval/bao-grants.nix
View file

@ -18,12 +18,13 @@ let
;
})
hive
hiveWithController
runGroup
;
# The store, plus a placed bootstrap token: the only shape in which the
# granter's own role can be written at all.
baoGrantHere = hive {
baoGrantHere = hiveWithController {
deploy.bao.enable = true;
deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
};
@ -91,7 +92,7 @@ let
# rather than one per reader: the claim they are *separate* principals is
# only testable where all of them render at once — that is the deployment in
# which two of them sharing a leaf would be invisible.
baoGrantWithConsumers = hive {
baoGrantWithConsumers = hiveWithController {
deploy.bao.enable = true;
deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
deploy.grafana.enable = true;
@ -109,7 +110,7 @@ let
# The store with none of the readers beside it. Grafana and the collector are
# simply off; the queue reader renders on any host holding
# its leaf, which ./glue-bao-tls.nix mints here, so that leaf is taken away.
baoGrantNoReaders = hive {
baoGrantNoReaders = hiveWithController {
deploy.bao.enable = true;
deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
deploy.bao.queueAgentClientCertFile = lib.mkForce null;
@ -126,7 +127,7 @@ let
# Every reader against a store it does not run, each with a leaf placed by
# hand. The deployment in which there is no local policy unit to wait for.
baoRemoteReaders = hive {
baoRemoteReaders = hiveWithController {
deploy.grafana.enable = true;
deploy.swarm-otel.enable = true;
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";