868c6cf96c
Every agent now connects to the queue and reads logs with its own secret from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has no reader left. Remove it end to end: - hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the agent module that loaded them (nix/agent-modules/queue.nix) is gone, its options refused with a removal message. - The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent), its store role and policy unit (swarm-bao-queue-agent-policy), its PKI leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options are gone; the options are refused with a removal message. - authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no longer writes swarm/hives/<h>/queue/agent. - swarm-secret-client drops queue::agent_client_path / queue::Credential. - HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone. The log store's authelia check stays for operators. swarm-nats-auth still refuses a `-agent` client id; that refusal and `agentClientSuffix` are left for a follow-up. Refs #4459 Refs #4765
68 lines
2.8 KiB
Nix
68 lines
2.8 KiB
Nix
# This agent's own credential for the swarm queue, read from the store by the
|
|
# harness itself.
|
|
#
|
|
# Keyed per **agent**, so at the queue's auth callout one agent is
|
|
# distinguishable from its co-hived neighbours: `swarm-controller` mints it at
|
|
# agent creation into `swarm/agents/<agent>/queue`
|
|
# (`swarm_secret_client::queue::agent_queue_path`), at swarm level, with no hive
|
|
# anywhere in the chain.
|
|
#
|
|
# The agent authenticates to the store as itself, with the certificate
|
|
# ./bao.nix already proves it can log in with, and reads its own path. A hive
|
|
# courier in the path would be the hive vouching for which agent this is,
|
|
# which is the property the per-agent credential exists to remove.
|
|
#
|
|
# Nothing here writes the secret anywhere. The harness reads it into memory
|
|
# before its first queue connection and again on every reconnect attempt
|
|
# (`hive-agent`'s `swarm_queue`), so a re-minted secret is picked up without a
|
|
# restart. What this module hands the harness is the store's address and the
|
|
# paths of the live certificate pair ./bao.nix keeps.
|
|
#
|
|
# ⛔ The store certificate is for reaching the store and nothing else. It is
|
|
# never presented to the queue: what goes to the queue is the secret read
|
|
# back from this path.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.hyperhive.agent.bao;
|
|
|
|
# This container's agent name — the same string `swarm-controller` minted
|
|
# the credential under, because the agent's unix user is named for the
|
|
# agent (see ./user.nix). The harness builds the path and the cert-auth
|
|
# role from it.
|
|
agentName = config.services.hyperhive.agent.user.name;
|
|
|
|
# The server CA id ./bao.nix loads; the id is
|
|
# `hive_c0re::lifecycle::agent_identity`'s and a rename is a rename there
|
|
# too.
|
|
serverCaCredential = "hive-agent-bao-server-ca";
|
|
|
|
# The store's address is the whole switch, exactly as in ./bao.nix.
|
|
configured = cfg.addr != null;
|
|
in
|
|
{
|
|
config = lib.mkIf configured {
|
|
systemd.services.hive-agent = {
|
|
# A bare id, no path: the terse `LoadCredential=` form that inherits a
|
|
# credential the service *manager* received, which is what the container
|
|
# manager passed in. ./bao.nix states the same shape.
|
|
serviceConfig.LoadCredential = [ serverCaCredential ];
|
|
# The live certificate pair exists once ./bao.nix's unit has run.
|
|
after = [ "hive-agent-bao-identity.service" ];
|
|
# Paths and a name only. `%d` is this unit's own credentials directory.
|
|
environment = {
|
|
HIVE_AGENT_NAME = agentName;
|
|
BAO_ADDR = cfg.addr;
|
|
BAO_CLIENT_CERT = cfg.clientCertFile;
|
|
BAO_CLIENT_KEY = cfg.clientKeyFile;
|
|
# Named even when no CA was delivered: a bare `LoadCredential=` is
|
|
# non-fatal when absent, and the harness treats a missing or empty file
|
|
# as "use the container's own trust store".
|
|
BAO_CACERT = "%d/${serverCaCredential}";
|
|
};
|
|
};
|
|
};
|
|
}
|