c6717bccb0
swarm-controller re-issues an agent's store leaf at half its validity, but the running container kept presenting the copy its hive delivered at start, so a re-issued leaf reached the agent only on its next restart. hive-agent-bao-identity now seeds a live copy of the pair in its own runtime directory from the delivered credentials, and re-runs every 10 minutes: it logs in with the live leaf, reads its own swarm/agents/<agent>/bao-mtls (a read render_agent already grants), and when the leaf changed, logs in with the new pair and swaps it in only if the store accepts it. Every unit in the container that logs in to the store presents the live pair: hive-agent (queue-identity.nix), hive-matrix-daemon, hive-subagent-daemon, hive-agent-forge-token, hive-agent-forge-accounts and hive-agent-github-token. They keep loading the server CA as a credential. The long-running daemons are ordered after the refresher so the live pair exists when they start. It renews only while the held leaf is still valid: the login that reads the new leaf is made with the current one. Refs #5017
87 lines
2.6 KiB
Nix
87 lines
2.6 KiB
Nix
# `checks.script-test-agent-bao-fetch` — runs the agent units that log in to
|
|
# the swarm secret store and fetch a secret, ../agent-modules/forge-token.nix
|
|
# and ../agent-modules/bao.nix, against a stub `bao`. The cases are in
|
|
# ./agent-bao-fetch.sh.
|
|
#
|
|
# What runs is the unit's rendered `ExecStart`, on the unit's own `PATH` with
|
|
# the stub in front. The one edit is the unit's `/run/<unit>/` prefix, moved
|
|
# under the build directory because the sandbox has no writable `/run`.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
self,
|
|
nixosSystem,
|
|
}:
|
|
let
|
|
inherit
|
|
(import ../module-eval/lib.nix {
|
|
inherit
|
|
pkgs
|
|
lib
|
|
self
|
|
nixosSystem
|
|
;
|
|
})
|
|
agentWith
|
|
;
|
|
|
|
machine = agentWith { services.hyperhive.agent.bao.addr = "https://bao.t.local:8200"; };
|
|
|
|
unitEnv =
|
|
prefix: name:
|
|
let
|
|
u = machine.systemd.services.${name};
|
|
in
|
|
{
|
|
"${prefix}_UNIT" = name;
|
|
# `removeSuffix`, not `trim`: `trim` drops the string context, and with it
|
|
# the script's store path from this check's inputs.
|
|
"${prefix}_SCRIPT" = lib.removeSuffix " " u.serviceConfig.ExecStart;
|
|
"${prefix}_PATH" = u.environment.PATH;
|
|
"${prefix}_BAO_ADDR" = u.environment.BAO_ADDR;
|
|
};
|
|
|
|
# Answers `login` and `kv get` from `FAKE_BAO_*` variables and logs every
|
|
# call. A `kv` call without the token `login` printed fails, so a script that
|
|
# drops `BAO_TOKEN` between the two cannot pass. A login presenting the
|
|
# certificate `FAKE_BAO_REFUSE_CERT` is refused.
|
|
fakeBao = pkgs.writeShellScriptBin "bao" ''
|
|
echo "$*" >> "$FAKE_BAO_LOG"
|
|
case "$1" in
|
|
login)
|
|
if [ -n "''${FAKE_BAO_REFUSE_CERT-}" ] && [ "$(<"$BAO_CLIENT_CERT")" = "$FAKE_BAO_REFUSE_CERT" ]; then
|
|
echo "fake bao: certificate refused" >&2
|
|
exit 2
|
|
fi
|
|
printf '%s' "$FAKE_BAO_LOGIN_ERR" >&2
|
|
printf '%s' "$FAKE_BAO_LOGIN_OUT"
|
|
exit "$FAKE_BAO_LOGIN_RC"
|
|
;;
|
|
kv)
|
|
if [ "''${BAO_TOKEN-}" != "$FAKE_BAO_LOGIN_OUT" ]; then
|
|
echo "fake bao: kv called without the login's token" >&2
|
|
exit 97
|
|
fi
|
|
printf '%s' "$FAKE_BAO_KV_ERR" >&2
|
|
printf '%s' "$FAKE_BAO_KV_OUT"
|
|
exit "$FAKE_BAO_KV_RC"
|
|
;;
|
|
*)
|
|
echo "fake bao: unexpected call: $*" >&2
|
|
exit 98
|
|
;;
|
|
esac
|
|
'';
|
|
in
|
|
pkgs.runCommand "hyperhive-script-test-agent-bao-fetch"
|
|
(
|
|
unitEnv "FORGE" "hive-agent-forge-token"
|
|
// unitEnv "IDENT" "hive-agent-bao-identity"
|
|
// {
|
|
FAKE_BAO_BIN = "${fakeBao}/bin";
|
|
}
|
|
)
|
|
''
|
|
${pkgs.bash}/bin/bash ${./agent-bao-fetch.sh}
|
|
touch "$out"
|
|
''
|