vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

let the operator's oidc login write the cache's tokens and facts

Browse source
This commit is contained in:
atlas 2026-10-28 23:46:58 +01:00
commit f22f4ee6ac
3 changed files with 87 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/swarm-bao.nix
View file

@ -777,18 +777,28 @@ let
# `read`. The UI needs no `sys/` grant on top:
# `sys/internal/ui/mounts` lists any mount the token holds a capability
# under, and the rest it calls is in the `default` policy.
#
# The cache's five leaves are where an external cache is configured, and
# where the operator replaces the in-swarm cache's tokens; its host units
# create them only while none is stored. `atticJwtLeaf` is left out: a new
# signing key invalidates both tokens.
operatorWritableLeaves = [
classifierApiKeyLeaf
classifierAcpKeyLeaf
atticPushTokenLeaf
]
++ atticFactLeaves;
operatorViewerPolicyName = "swarm-operator-viewer";
operatorViewerPolicyText = ''
path "${credentialMountPath}/metadata/*" {
capabilities = ["list", "read"]
}
path "${credentialMountPath}/data/${classifierApiKeyLeaf}" {
''
+ lib.concatMapStrings (leaf: ''
path "${credentialMountPath}/data/${leaf}" {
capabilities = ["create", "update"]
}
path "${credentialMountPath}/data/${classifierAcpKeyLeaf}" {
capabilities = ["create", "update"]
}
'';
'') operatorWritableLeaves;
# authelia's operator group (`operatorGroup` in ./swarm-authelia.nix, the
# group its rule for the UI's vhost admits) → the viewer policy. authelia

38
nix/module-eval/bao-grants.nix
View file

@ -2634,7 +2634,7 @@ let
# metadata, and a write on the leaves the operator fills by hand.
# A `read` under `data/` would hand a browser session a secret's
# value, and any `sys/` path more than the UI needs.
name = "the operator viewer policy is list and read on KV metadata, a write on the classifier's two keys, and no data/ read or sys/";
name = "the operator viewer policy is list and read on KV metadata, a write on the classifier's two keys and the cache's five, and no data/ read, attic signing key or sys/";
ok =
let
viewer = grantsIn baoGrantHere.systemd.services.swarm-bao-operator-viewer-policy.script;
@ -2661,7 +2661,43 @@ let
"update"
];
}
{
path = "secret/data/swarm/services/attic/push-token";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/pull-token";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/url";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/cache";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/public-key";
caps = [
"create"
"update"
];
}
]
&& grantFor viewer "secret/data/swarm/services/attic/jwt-secret" == null
&& grantFor viewer "secret/data/swarm/agents/x/queue" == null
&& grantFor viewer "secret/metadata/swarm/agents/x/queue" != null
&& !(lib.any (g: lib.hasPrefix "secret/data" g.path && lib.elem "read" g.caps) viewer)

20
nix/script-tests/attic-init.sh
View file

@ -207,6 +207,26 @@ expect "pull token unchanged" "$(stored $PULL)" "$pull"
expect "push token unchanged" "$(stored $PUSH)" "$push"
expect "address, name and key unchanged" "$(stored $URL)$(stored $CACHE)$(stored $KEY)" "http://cache.examplegridgrid:FAKEKEY"
case="values the operator stored over the minted ones are kept"
for leaf in $PULL $PUSH $URL $CACHE $KEY; do
printf '%s' "operator-$leaf" >"$dir/store/$leaf"
done
: >"$calls"
run "$PROVISION"
expect "exit status" $? 0
expect "no token minted" "$(n '^atticadm')" 0
expect "nothing written" "$(n '^bao put')" 0
expect "the operator's push token is still stored" "$(stored $PUSH)" "operator-$PUSH"
expect "the operator's pull token is still stored" "$(stored $PULL)" "operator-$PULL"
expect "the operator's address, name and key are still stored" \
"$(stored $URL)$(stored $CACHE)$(stored $KEY)" "operator-${URL}operator-${CACHE}operator-${KEY}"
expect "the cache lookup used the operator's pull token" "$(n "^attic cache info local:grid | token=operator-$PULL")" 1
printf '%s' "$pull" >"$dir/store/$PULL"
printf '%s' "$push" >"$dir/store/$PUSH"
printf '%s' http://cache.example >"$dir/store/$URL"
printf '%s' grid >"$dir/store/$CACHE"
printf '%s' grid:FAKEKEY >"$dir/store/$KEY"
case="an empty server gets its cache back with the stored tokens"
rm -f "$dir/cache-exists"
: >"$calls"