Jean-Gabriel Gill-Couture
23e4709f1f
PodmanService gains secret_env (env name + secret name under <kv>/<prefix>/<deployment>/); the agent resolves references at apply time through harmony_secret's OpenbaoSecretStore, reusing the NATS path's ZitadelJwtBearer — one machine identity for both consumers. Resolution failure surfaces as Phase::Failed naming the denied fetch. - OpenbaoSecretStore::with_zitadel_bearer: no token-file cache; login is lazy and get_raw retries once through refresh_auth on permission denied (batch tokens expire without renewal; re-login IS the sync) - agent [openbao] config section (url + secret_prefix; mounts/role default to the staging shape) - FleetDeviceSetupScore renders the [openbao] block when configured - resolution binds at apply, never on the periodic tick, keeping the secret store off the 30s hot path (fleet-scale login load is the ADR-025 constraint)
25 lines
803 B
TOML
25 lines
803 B
TOML
[package]
|
|
name = "harmony-fleet-agent"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
rust-version = "1.85"
|
|
|
|
[dependencies]
|
|
harmony-fleet-auth = { path = "../harmony-fleet-auth" }
|
|
harmony_secret = { path = "../../harmony_secret" }
|
|
harmony-reconciler-contracts = { path = "../../harmony-reconciler-contracts" }
|
|
harmony = { path = "../../harmony", default-features = false, features = ["podman"] }
|
|
async-nats = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
chrono = { workspace = true }
|
|
futures-util = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
tokio = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
clap = { workspace = true }
|
|
toml = { workspace = true }
|
|
thiserror = { workspace = true }
|