feat: wait for the daemon to be ready before the step finishes - #9
Merged
Conversation
The install step returned as soon as riptides.service was active, but the daemon is not intercepting yet at that point - it still has to connect to the driver and get a workload identity issued. Connections opened by the next workflow step could land in that window and go unrecorded. Pass --wait-ready to install.sh (new wait-for-ready / ready-timeout inputs, on by default) and assert the driver reports OK in the test workflow.
baluchicken
approved these changes
Aug 3, 2026
stoader
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The install step returned as soon as
riptides.servicewas active, but the daemon isn't intercepting yet at that point — it still has to connect to the control plane, push trust anchors into the driver, and get a workload identity issued. Connections opened by the next workflow step can land in that window and go unrecorded.wait-for-ready(defaulttrue) andready-timeout(default120), passed through as--wait-ready --wait-timeout N./sys/module/riptides/healthreadsOKafter the action.Readiness comes from the daemon's
/readyz(riptideslabs/daemon#425), which reports the control plane connection and whether every trust anchor it holds was verified present in the driver.Two notes:
install.shlive fromdocs.riptides.io, so that has to ship first or the runner getsUnknown option: --wait-ready. daemon#425 is not a hard dependency:install.shfalls back to the driver's sysfs status files when the endpoint isn't there.