Skip to content

Commit b7100a4

Browse files
fix(compute): reuse an existing node encryption key instead of conflicting
A machine can be both a registered compute Node and a local hypervisor pool - both provision a NodeEncryptionKey keyed by the same node uuid. MachinePool.insert() always tried to create a fresh one unconditionally, so registering a hypervisor on an already-provisioned node hit a duplicate-key conflict. The key is an identity for the node, not a specific agent process, so reuse whatever already exists instead.
1 parent ba04844 commit b7100a4

1 file changed

Lines changed: 16 additions & 6 deletions

File tree

exordos_core/compute/dm/models.py

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -118,14 +118,24 @@ def insert(self, session=None, agent_private_key: str | None = None):
118118
# `agent_private_key` lets a caller that already generated and
119119
# deployed a key to the agent (e.g. the bootstrap flow) keep both
120120
# sides in sync instead of getting a fresh, mismatched one here.
121+
# A key may already exist for this node uuid (e.g. it's also
122+
# registered as a plain compute Node, which provisions its own
123+
# key the same way) - node uuid is the key's identity regardless
124+
# of which agent process uses it, so reuse it instead of
125+
# conflicting on insert.
121126
if isinstance(self.driver_spec, ExordosLocalHyperDriverSpec):
122-
if agent_private_key is None:
123-
_, agent_private_key = ua_crypto.generate_key_base64()
124-
private_key = ua_models.NodeEncryptionKey(
125-
uuid=self.driver_spec.node,
126-
private_key=agent_private_key,
127+
existing_keys = ua_models.NodeEncryptionKey.objects.get_all(
128+
filters={"uuid": dm_filters.EQ(self.driver_spec.node)},
129+
session=session,
127130
)
128-
private_key.insert(session=session)
131+
if not existing_keys:
132+
if agent_private_key is None:
133+
_, agent_private_key = ua_crypto.generate_key_base64()
134+
private_key = ua_models.NodeEncryptionKey(
135+
uuid=self.driver_spec.node,
136+
private_key=agent_private_key,
137+
)
138+
private_key.insert(session=session)
129139

130140
def get_agent_private_key(self):
131141
enc_key = ua_models.NodeEncryptionKey.objects.get_one(

0 commit comments

Comments
 (0)