vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

let the operator's oidc login write the cache's tokens and facts

Browse source
This commit is contained in:
atlas 2026-10-28 23:46:58 +01:00
commit f22f4ee6ac
1 changed files with 87 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

38
nix/module-eval/bao-grants.nix
View file

@ -2634,7 +2634,7 @@ let
# metadata, and a write on the leaves the operator fills by hand.
# A `read` under `data/` would hand a browser session a secret's
# value, and any `sys/` path more than the UI needs.
name = "the operator viewer policy is list and read on KV metadata, a write on the classifier's two keys, and no data/ read or sys/";
name = "the operator viewer policy is list and read on KV metadata, a write on the classifier's two keys and the cache's five, and no data/ read, attic signing key or sys/";
ok =
let
viewer = grantsIn baoGrantHere.systemd.services.swarm-bao-operator-viewer-policy.script;
@ -2661,7 +2661,43 @@ let
"update"
];
}
{
path = "secret/data/swarm/services/attic/push-token";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/pull-token";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/url";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/cache";
caps = [
"create"
"update"
];
}
{
path = "secret/data/swarm/services/attic/public-key";
caps = [
"create"
"update"
];
}
]
&& grantFor viewer "secret/data/swarm/services/attic/jwt-secret" == null
&& grantFor viewer "secret/data/swarm/agents/x/queue" == null
&& grantFor viewer "secret/metadata/swarm/agents/x/queue" != null
&& !(lib.any (g: lib.hasPrefix "secret/data" g.path && lib.elem "read" g.caps) viewer)