Skip to content

MtCollins1Boot does not consume the fleet SSH key: its route is BMC/IPMI, SOL and HTTP, so the arm is derived from the operation #11788

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gunbai-bot merged 4 commits into from
Sep 20, 2026
Merged

MtCollins1Boot does not consume the fleet SSH key: its route is BMC/IPMI, SOL and HTTP, so the arm is derived from the operation #11788

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0de1788
MtCollins1Boot does not consume the fleet SSH key: its route is BMC/I…
Sep 20, 2026
c1995f0
chore: regenerate drifted generated artifacts (ci auto-heal)
gunbai-bot[bot] Sep 20, 2026
b64ef54
Merge remote-tracking branch 'origin/main' into fierce-seal-607/mtcol…
Sep 20, 2026
d95d51b
Regenerate fleet-converge.yml: the fleet-key materialization step no …
Sep 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/fleet-converge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,7 +227,7 @@ jobs:
echo "fleet-key: agent loaded (identity fleet-automation@gunbc; secret versions/1 pinned; fingerprint verified against modeled authority; key file wiped)"
env:
WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'approval_keyring_converge' || github.event.inputs.mode == 'mtcollins1_boot'
if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'approval_keyring_converge'
timeout-minutes: 5
- name: Fleet converge plan (membership_reconcile → artifact)
id: plan
Expand Down
11 changes: 7 additions & 4 deletions dag/gunbc/fleet/fleet_converge_workflow.dag
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -312,9 +312,12 @@ fn fleet_converge_any_mode_step_if(modes: List<FleetConvergeWorkflowMode>) -> St
// inherit the fleet key by omission. The fleet-converge job materializes the fleet key only for a
// dispatch whose mode consumes it: an API-only read (the org credential observe and the org runner
// roster read, both of which reach GitHub over gh and open no host session) must not hold host SSH
// authority it never uses. Only those two modes are established API-only by this declaration;
// every other mode keeps the key it held before, which is the status quo rather than a finding
// that it needs it.
// authority it never uses. Three modes are established as not consuming it: the two API-only reads,
// and the Mt. Collins boot, whose route is BMC/IPMI, SOL and HTTP approval submission with no fleet
// SSH operation. Every mode that predates this declaration keeps the key it held before, which is
// the status quo rather than a finding that it needs it; a mode added AFTER it has no prior standing
// to keep, so its arm is derived from its operation route (the approval keyring converge executes
// over fleet SSH to srv1 and consumes it).
type FleetSshKeyDemand = FleetSshKeyConsumed | FleetSshKeyNotConsumed

fn fleet_converge_mode_fleet_ssh_key_demand(mode: FleetConvergeWorkflowMode) -> FleetSshKeyDemand {
Expand Down Expand Up @@ -343,7 +346,7 @@ fn fleet_converge_mode_fleet_ssh_key_demand(mode: FleetConvergeWorkflowMode) ->
R2MintPreflight => FleetSshKeyConsumed
R2ObjectWriteMint => FleetSshKeyConsumed
ApprovalKeyringConverge => FleetSshKeyConsumed
MtCollins1Boot => FleetSshKeyConsumed
MtCollins1Boot => FleetSshKeyNotConsumed
}
}

Expand Down