f862354e43
An agent's capabilities move from the hive's meta repo
(`meta/capabilities.json`, injected as `HIVE_CAPABILITIES`) into the
`capabilities` field of its key in a new `agent-permissions` KV bucket,
which swarm-controller alone writes.
- swarm-queue-client: `agent_permissions` (bucket, key, `AgentPermissions`,
direct-get read, the import subject and its wire types).
- swarm-controller: creates the bucket at start; `GET|PUT|DELETE
/api/agents/{name}/permissions` (deny_unknown_fields and unknown
capability ⇒ 422, duplicate ⇒ 400, agent must be declared by a hive);
answers each hive's one-shot import, writing a key only where there is
none and only for agents that hive's wanted state declares.
- swarmctl: `agent permissions get|set|clear`.
- swarm-nats-auth: a hive reads every key of the bucket and sends its
import on its own subject; the controller subscribes to the imports and
may answer them (`responses`).
- hive-c0re: reads each of its agents' keys every 30s into
/var/lib/hyperhive/swarm-agent-permissions.json and restarts an agent,
gracefully, when its capabilities change. Unset is the compiled-in
default (ruth: manage_root_agent; everyone else: none). A failed read
keeps the stored value. On first boot it seeds that file from
meta/capabilities.json, sends the grants to the controller, and deletes
the file once the controller answers.
Deleted: the capabilities.json reader/writer, `HIVE_CAPABILITIES` in the
rendered meta flake, ruth's capability seed, the capabilities half of the
permissions rebuild job (`PermPayload::Capabilities`/`Combined`), the
dashboard's capabilities table and `capabilities_changed` event, and the
now-unused `Capability::description`.
Part of #5170.
74 lines
2.4 KiB
TOML
74 lines
2.4 KiB
TOML
[package]
|
|
name = "hive-c0re"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
# For `StreamExt::next` on the swarm-event subscription in `swarm_status`.
|
|
# Workspace-level, same version swarm-controller already uses — not a second copy.
|
|
futures-util.workspace = true
|
|
anyhow.workspace = true
|
|
# Named directly only for the client type the swarm status publisher passes
|
|
# around; the connect itself lives in `swarm-queue-client` below.
|
|
async-nats.workspace = true
|
|
axum.workspace = true
|
|
chrono.workspace = true
|
|
base64.workspace = true
|
|
bcrypt.workspace = true
|
|
reqwest.workspace = true
|
|
forgejo-api.workspace = true
|
|
url.workspace = true
|
|
clap.workspace = true
|
|
clap_complete.workspace = true
|
|
clap-markdown = "0.1"
|
|
# OTEL SDK for the per-agent container-resource metrics exporter
|
|
# (stats/otel_metrics.rs). "internal-logs" on top of the workspace base is
|
|
# this crate's own opt-in: it's not a transport, it's in `default`, and
|
|
# `default-features = false` upstream drops it unless named here.
|
|
opentelemetry.workspace = true
|
|
opentelemetry_sdk.workspace = true
|
|
opentelemetry-otlp = { workspace = true, features = ["internal-logs"] }
|
|
indicatif.workspace = true
|
|
hive-core-agent-sock.workspace = true
|
|
hive-sh4re.workspace = true
|
|
hive-host-sock.workspace = true
|
|
hive-jobq.workspace = true
|
|
hive-jobq-wire.workspace = true
|
|
hive-log.workspace = true
|
|
hive-priv-sock.workspace = true
|
|
hive-types.workspace = true
|
|
libc.workspace = true
|
|
listenfd = "1"
|
|
petgraph.workspace = true
|
|
hmac.workspace = true
|
|
sha2.workspace = true
|
|
rusqlite.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
strum.workspace = true
|
|
# Offering this hive's status to the swarm (`swarm_status`). The same crate
|
|
# the swarm controller reads it with, and `kv` for the same reason: the
|
|
# bucket's name and creation config belong to neither end of it alone.
|
|
swarm-queue-client = { workspace = true, features = [
|
|
"kv",
|
|
"notices",
|
|
"agent-limits",
|
|
"agent-permissions",
|
|
] }
|
|
swarm-secret-client.workspace = true
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
tracing.workspace = true
|
|
problem_details = { version = "0.9.0", features = ["axum"] }
|
|
utoipa.workspace = true
|
|
utoipa-axum.workspace = true
|
|
|
|
# `test-util` for `#[tokio::test(start_paused = true)]`: `forge::bounded`'s
|
|
# test asserts the deadline fires without waiting it out.
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
tokio = { workspace = true, features = ["test-util"] }
|