Watch
0
0
Fork
You've already forked hyperhive
0
hyperhive/hive-c0re/src/swarm_agent_status.rs
atlas c2c61b6146 hive status publishing: read the hive's OIDC secret from the store, retry until it is there
hive-c0re publishes this hive's status to the swarm queue as the OIDC
client `hive-<name>`. Its secret came from
`deploy.hive-controller.statusPublish.clientSecretFile`, which defaulted
to authelia's minted file only on a host running both authelia and the
queue. Every other hive had no secret and never published, so the
controller showed it `never_reported`.

Now `swarm-secret-publish`, beside authelia, also copies each hive's
`hive-<name>` secret to `swarm/hives/<hive>/oidc/client`. Its policy
already allows `swarm/hives/*`. hive-c0re reads that path under the
hive's own store leaf, which the existing `swarm/hives/<hive>/*` grant
covers, and holds the value in memory.

The shared queue client no longer remembers a failed first connect for
the life of the process. A failed attempt is retried with a backoff
from 5s, doubling to a cap of 5 minutes; the dashboard banner stays up
until an attempt succeeds. The two status publishers wait for the
client instead of giving up on the first `None`, so a secret published
after boot is picked up without a restart.

Removed: the `statusPublish.clientSecretFile` option (both spellings,
now removed options with a message), its same-host default, its
LoadCredential, the assertion tying it to the other two coordinates,
and `swarm_queue_client::QueueConfig::from_env`, whose only caller was
this read. Publishing is now on wherever the queue URL and token
endpoint are set and the hive holds a store leaf.

Refs #5015
2026-10-10 01:05:33 +02:00

150 lines
6.7 KiB
Rust

//! Offering each locally-hosted agent's status upward to the swarm.
//!
//! Sibling task to [`crate::swarm_status`], not a field folded into it — see
//! `swarm_queue_client::agent_status`'s module doc for why hive status and
//! agent status live in separate buckets. Same direction, though: a hive
//! **offers** what it already knows about its own agents (via
//! [`crate::container_view::read_agent_status_bounded`], the bounded form of
//! the read `GetAgentMeta` serves to the dashboard), and the swarm
//! controller never reaches down to collect it.
//!
//! **One publish per agent, not one document for the hive.** Each agent
//! gets its own key (`swarm_queue_client::agent_status::key`), so one
//! agent's status changing does not touch any other agent's key, and a
//! consumer watching one agent reads exactly its own revision history.
use std::time::Duration;
use anyhow::{Context, Result};
use crate::stats::sweep_health::{self, SweepHealth};
/// How often this hive offers a snapshot of every agent it hosts.
///
/// Same value as [`crate::swarm_status::PUBLISH_INTERVAL`] on purpose: both
/// feed the same controller-side `staleAfterSeconds` freshness window, and
/// there is no reason for an agent's status to go stale on a different
/// cadence than the hive's own.
pub const PUBLISH_INTERVAL: Duration = crate::swarm_status::PUBLISH_INTERVAL;
/// Consecutive failed sweeps before the dashboard banners. Mirrors
/// [`crate::swarm_status`]'s constant of the same name and purpose.
const FAILURES_BEFORE_BANNER: u32 = 3;
/// Start the publish loop, if this deployment wired up a swarm queue.
///
/// Shares its connect gate with [`crate::swarm_status::spawn`] — both wait on
/// `crate::swarm_queue::wait_for_client()`, one connection per process — so a
/// hive with no queue coordinates pays for this decision once, not twice.
///
/// Takes no `Coordinator` handle, unlike its sibling: this task only reads
/// agent state that already exists on disk / in the container runtime
/// (`lifecycle::agents_for_meta_listing`, `container_view::read_agent_status_bounded`),
/// it never touches the job queue or broker the way `swarm_status::spawn`'s
/// deploy-event listener does.
pub fn spawn(mut shutdown: tokio::sync::watch::Receiver<bool>) {
let Some(hive) = crate::container_view::hive_swarm_names().0 else {
// Already bannered once by `swarm_status::spawn`, which runs the
// identical check — a second banner for the same missing env var
// would just be the same fact told twice.
return;
};
tokio::spawn(async move {
let Some(client) = crate::swarm_queue::wait_for_client().await else {
return;
};
let mut health =
SweepHealth::new("swarm_agent_status_publish", "warn", FAILURES_BEFORE_BANNER);
loop {
match publish_all(&client, &hive).await {
Ok(published) => {
health.record_ok();
tracing::debug!(published, "agent status: sweep complete");
}
Err(e) => {
tracing::warn!(error = ?e, "agent status: sweep failed");
let err = format!("{e:#}");
health.record_err(|ctx| {
let age = ctx.since_last_ok.map_or_else(
|| "no success this session".to_owned(),
|d| format!("last ok {} ago", sweep_health::fmt_age(d)),
);
format!(
"agent status publishing is failing ({} consecutive, {age}) \
— the swarm sees this hive's agents as stale, the agents \
themselves are unaffected: {err}",
ctx.consecutive
)
});
}
}
// Publish first, then wait — same reasoning as
// `swarm_status::spawn`: a hive that just came up is exactly the
// one whose agents someone is looking at.
tokio::select! {
() = tokio::time::sleep(PUBLISH_INTERVAL) => {}
_ = shutdown.changed() => {
tracing::info!("agent status: shutdown signal received");
break;
}
}
}
});
}
/// Offer one snapshot of every agent this hive currently hosts.
///
/// Returns the count published, purely so the caller can log it — nothing
/// downstream reads the number. Enumeration failure (cannot list agents at
/// all) is the one thing that fails the whole sweep; a single agent's
/// status read or publish failing is logged and skipped; skipping one
/// agent should not report every *other* agent on this hive as stale too.
async fn publish_all(client: &async_nats::Client, hive: &str) -> Result<usize> {
// Same hang risk `swarm_status::publish` guards against: an unconnected
// client does not fail a JetStream request, it hangs on it.
swarm_queue_client::ensure_connected(client)?;
let agents = crate::lifecycle::agents_for_meta_listing()
.await
.context("enumerating this hive's agents")?;
let store = swarm_queue_client::agent_status::open_or_create(client).await?;
let mut published = 0usize;
for spec in &agents {
let Ok(ident) = hive_types::Ident::parse(&spec.name) else {
// An agent name that fails `Ident::parse` here would mean
// something already on disk violates the naming charset every
// other path enforces at creation — worth a warning, not a
// reason to abandon everyone else's publish.
tracing::warn!(agent = %spec.name, "agent status: name failed Ident::parse, skipping");
continue;
};
let Some((status_text, status_set_at, running)) =
crate::container_view::read_agent_status_bounded(&ident).await
else {
tracing::warn!(agent = %spec.name, "agent status: unit state unreadable, skipping");
continue;
};
let payload = swarm_queue_client::agent_status::AgentStatus {
status_text,
status_set_at,
running,
};
let bytes = match serde_json::to_vec(&payload) {
Ok(b) => b,
Err(e) => {
tracing::warn!(agent = %spec.name, error = %e, "agent status: serialising failed, skipping");
continue;
}
};
let key = swarm_queue_client::agent_status::key(hive, &spec.name);
if let Err(e) = store.put(key, bytes.into()).await {
tracing::warn!(agent = %spec.name, error = %e, "agent status: publish failed, skipping");
continue;
}
published += 1;
}
Ok(published)
}