0f53e9be6c
swarm-logs reads `swarm/agents/<agent>/queue` from the swarm secret store with the agent's own store certificate (the read hive-agent makes for its queue connection) and presents it as `Bearer swarm-agent.<agent>.<secret>`, which the gateway's swarm-logs-auth checks. On a 401 it reads the secret again and retries once, so a secret re-minted between the read and the check does not fail the query. The OIDC mint against the hive's shared `hive-<h>-agent` client is gone from swarm-logs, along with the unused `HIVE_AGENT_OIDC_CA_FILE` anchor. logs.nix now gates on the store address instead of the queue's token endpoint and wraps the binary with the paths queue-identity.nix gives the harness; the host forwards the query URL wherever it forwards a store identity. The shared client is still delivered into containers; removing that is Part of #4459.
28 lines
790 B
TOML
28 lines
790 B
TOML
[package]
|
|
name = "swarm-logs"
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
edition.workspace = true
|
|
|
|
[[bin]]
|
|
name = "swarm-logs"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
clap.workspace = true
|
|
clap-markdown = "0.1"
|
|
# The agent-token spelling the gateway's responder parses, and the rustls
|
|
# provider the store client needs.
|
|
swarm-queue-client.workspace = true
|
|
# The read of this agent's own queue secret.
|
|
swarm-secret-client.workspace = true
|
|
# Only to drive that one async read; the query itself is blocking.
|
|
tokio.workspace = true
|
|
# Blocking, not async: this binary makes one request (two on a 401) and
|
|
# exits, so a reactor would exist only to be torn down.
|
|
reqwest = { workspace = true, features = ["blocking"] }
|
|
serde_json.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|