From b5b466f095eea0f217bc6ecf2155ebf208af4256 Mon Sep 17 00:00:00 2001
From: Lex Kheben <i@zbit.name>
Date: Thu, 25 Jun 2026 13:34:16 +0300
Subject: [PATCH 1/5] feat(swarm): add global_id handling in secret
 initialization script

---
 src/swarm-scripts/00-initialize-secrets.sh | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/swarm-scripts/00-initialize-secrets.sh b/src/swarm-scripts/00-initialize-secrets.sh
index bebaf4d1..2ad36b32 100644
--- a/src/swarm-scripts/00-initialize-secrets.sh
+++ b/src/swarm-scripts/00-initialize-secrets.sh
@@ -30,6 +30,7 @@ BASE_DOMAIN=$(cfg "base_domain")
 SWARM_DOMAIN=$(cfg "swarm_domain")
 PKI_DOMAIN=$(cfg "pki_domain")
 GATEWAY_HOSTNAME=$(cfg "gateway_hostname")
+GLOBAL_ID=$(cfg "global_id")
 
 AUTH_SERVICE_YAML=""
 AUTH_SERVICE_YAML_PATH="/sp/swarm/auth-service.yaml"
@@ -68,6 +69,22 @@ ensure_secret() {
     python3 "$(dirname "$0")/swarm-cli.py" create SwarmSecrets "$key" --value "$value" >/dev/null
 }
 
+ensure_global_id_pointer() {
+  local value="$1"
+  [ -n "$value" ] || return 0
+
+  local existing=""
+  existing=$(mysql -h "$DB_HOST" -P "$DB_PORT" -u "$DB_USER" "$DB_NAME" -Nse \
+    "SELECT value FROM SwarmIdPointer WHERE id='global_id' LIMIT 1" 2>/dev/null || true)
+  if [ -n "$existing" ]; then
+    echo "SwarmIdPointer 'global_id' already exists, skipping creation."
+    return 0
+  fi
+
+  mysql -h "$DB_HOST" -P "$DB_PORT" -u "$DB_USER" "$DB_NAME" -e \
+    "INSERT INTO SwarmIdPointer (id, value) VALUES ('global_id', '$(printf '%s' "$value" | sed "s/'/''/g")')"
+}
+
 ensure_swarm_init_cert_secrets() {
   local secret_key
   local prefixed_secret_key
@@ -119,6 +136,8 @@ ensure_secret "base_domain" "$BASE_DOMAIN"
 ensure_secret "swarm_domain" "$SWARM_DOMAIN"
 ensure_secret "pki_domain" "$PKI_DOMAIN"
 ensure_secret "gateway_hostname" "$GATEWAY_HOSTNAME"
+ensure_secret "global_id" "$GLOBAL_ID"
+ensure_global_id_pointer "$GLOBAL_ID"
 ensure_secret "auth_service_yaml" "$AUTH_SERVICE_YAML"
 ensure_swarm_init_cert_secrets
 ensure_secret "evidence_sign_key" "$EVIDENCE_SIGN_KEY"

From 51ee181d30d29981c89f8cf7a10a9d5d1e68df40 Mon Sep 17 00:00:00 2001
From: Lex Kheben <i@zbit.name>
Date: Thu, 25 Jun 2026 13:50:19 +0300
Subject: [PATCH 2/5] refactor(secrets): remove direct global_id secret
 initialization

---
 src/swarm-scripts/00-initialize-secrets.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/swarm-scripts/00-initialize-secrets.sh b/src/swarm-scripts/00-initialize-secrets.sh
index 2ad36b32..bd652031 100644
--- a/src/swarm-scripts/00-initialize-secrets.sh
+++ b/src/swarm-scripts/00-initialize-secrets.sh
@@ -136,7 +136,6 @@ ensure_secret "base_domain" "$BASE_DOMAIN"
 ensure_secret "swarm_domain" "$SWARM_DOMAIN"
 ensure_secret "pki_domain" "$PKI_DOMAIN"
 ensure_secret "gateway_hostname" "$GATEWAY_HOSTNAME"
-ensure_secret "global_id" "$GLOBAL_ID"
 ensure_global_id_pointer "$GLOBAL_ID"
 ensure_secret "auth_service_yaml" "$AUTH_SERVICE_YAML"
 ensure_swarm_init_cert_secrets

From fda3fd02a9edc415811a2a4b4cc6fe99df3450f5 Mon Sep 17 00:00:00 2001
From: Lex Kheben <i@zbit.name>
Date: Fri, 26 Jun 2026 19:20:57 +0300
Subject: [PATCH 3/5] feat(dns-manager): add ClusterPolicyAffinityRule creation
 logic

Implemented logic to check for and create a ClusterPolicyAffinityRule for 'knot-affinity' in the DNS manager setup script. This ensures the rule is only created if it does not already exist, enhancing the provisioning process.
---
 src/swarm-scripts/74.setup-dns-manager.sh | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/swarm-scripts/74.setup-dns-manager.sh b/src/swarm-scripts/74.setup-dns-manager.sh
index 03ed1f3f..b1400c39 100755
--- a/src/swarm-scripts/74.setup-dns-manager.sh
+++ b/src/swarm-scripts/74.setup-dns-manager.sh
@@ -67,3 +67,21 @@ else
 fi
 
 echo "Done. The provision worker will reconcile '$SERVICE_NAME' shortly."
+
+AFFINITY_RULE_ID="${CLUSTER_POLICY}:knot-affinity"
+if DB_HOST="$DB_HOST" DB_PORT="$DB_PORT" DB_USER="$DB_USER" DB_NAME="$DB_NAME" \
+	python3 "$(dirname "$0")/swarm-cli.py" get ClusterPolicies knot >/dev/null 2>&1; then
+	echo "Ensuring ClusterPolicyAffinityRule '$AFFINITY_RULE_ID'..."
+	if DB_HOST="$DB_HOST" DB_PORT="$DB_PORT" DB_USER="$DB_USER" DB_NAME="$DB_NAME" \
+		python3 "$(dirname "$0")/swarm-cli.py" get ClusterPolicyAffinityRules "$AFFINITY_RULE_ID" >/dev/null 2>&1; then
+		echo "ClusterPolicyAffinityRule '$AFFINITY_RULE_ID' already exists, skipping creation."
+	else
+		echo "Creating ClusterPolicyAffinityRule '$AFFINITY_RULE_ID'..."
+		DB_HOST="$DB_HOST" DB_PORT="$DB_PORT" DB_USER="$DB_USER" DB_NAME="$DB_NAME" \
+			python3 "$(dirname "$0")/swarm-cli.py" create ClusterPolicyAffinityRules "$AFFINITY_RULE_ID" \
+				--name="knot-affinity" \
+				--cluster_policy="$CLUSTER_POLICY" \
+				--target_cluster_policy="knot" \
+				--affinity_type="positive"
+	fi
+fi

From 0bada33000d2da6aada3562b07782183092e2412 Mon Sep 17 00:00:00 2001
From: Lex Kheben <i@zbit.name>
Date: Thu, 2 Jul 2026 13:21:50 +0300
Subject: [PATCH 4/5] refactor(secrets): streamline global_id check and
 creation process

Replaced direct MySQL commands with Python script calls for checking and creating the global_id in the SwarmIdPointer. This enhances the script's maintainability and aligns with the recent refactor of secret initialization.
---
 src/swarm-scripts/00-initialize-secrets.sh | 10 ++--
 src/swarm-scripts/swarm-cli.py             | 57 ++++++++++++++++++++++
 2 files changed, 61 insertions(+), 6 deletions(-)

diff --git a/src/swarm-scripts/00-initialize-secrets.sh b/src/swarm-scripts/00-initialize-secrets.sh
index bd652031..4cdb62c7 100644
--- a/src/swarm-scripts/00-initialize-secrets.sh
+++ b/src/swarm-scripts/00-initialize-secrets.sh
@@ -73,16 +73,14 @@ ensure_global_id_pointer() {
   local value="$1"
   [ -n "$value" ] || return 0
 
-  local existing=""
-  existing=$(mysql -h "$DB_HOST" -P "$DB_PORT" -u "$DB_USER" "$DB_NAME" -Nse \
-    "SELECT value FROM SwarmIdPointer WHERE id='global_id' LIMIT 1" 2>/dev/null || true)
-  if [ -n "$existing" ]; then
+  if DB_HOST="$DB_HOST" DB_PORT="$DB_PORT" DB_USER="$DB_USER" DB_NAME="$DB_NAME" \
+    python3 "$(dirname "$0")/swarm-cli.py" get SwarmIdPointer "global_id" >/dev/null 2>&1; then
     echo "SwarmIdPointer 'global_id' already exists, skipping creation."
     return 0
   fi
 
-  mysql -h "$DB_HOST" -P "$DB_PORT" -u "$DB_USER" "$DB_NAME" -e \
-    "INSERT INTO SwarmIdPointer (id, value) VALUES ('global_id', '$(printf '%s' "$value" | sed "s/'/''/g")')"
+  DB_HOST="$DB_HOST" DB_PORT="$DB_PORT" DB_USER="$DB_USER" DB_NAME="$DB_NAME" \
+    python3 "$(dirname "$0")/swarm-cli.py" create SwarmIdPointer "global_id" --value "$value" >/dev/null
 }
 
 ensure_swarm_init_cert_secrets() {
diff --git a/src/swarm-scripts/swarm-cli.py b/src/swarm-scripts/swarm-cli.py
index 550e31d3..2415e366 100755
--- a/src/swarm-scripts/swarm-cli.py
+++ b/src/swarm-scripts/swarm-cli.py
@@ -402,6 +402,58 @@ def get_cluster_policy_preference_rules(args: argparse.Namespace, db: dict, engi
   print(json.dumps(dict(row)))
 
 
+def create_swarm_id_pointer(args: argparse.Namespace, db: dict, engine: Engine) -> None:
+  """
+  Insert or keep a SwarmIdPointer.
+  Semantics are like INSERT IGNORE: we do not overwrite existing pointers.
+  """
+  id_value = args.id or args.positional_id
+  value = args.value
+
+  if not id_value or value is None:
+    print("SwarmIdPointer requires id (positional or --id) and --value.", file=sys.stderr)
+    sys.exit(1)
+
+  insert_sql = (
+    "INSERT INTO SwarmIdPointer (id, value)\n"
+    "VALUES (:id, :value)\n"
+    "ON DUPLICATE KEY UPDATE\n"
+    "  value = value;\n"
+  )
+  params = {
+    "id": id_value,
+    "value": value,
+  }
+  run_sql(engine, insert_sql, params)
+  print(f"SwarmIdPointer '{id_value}' upserted (existing values preserved).")
+
+
+def get_swarm_id_pointer(args: argparse.Namespace, db: dict, engine: Engine) -> None:
+  """
+  Fetch a SwarmIdPointer by id.
+  - Exit code 0: pointer exists, JSON is printed to stdout.
+  - Exit code 1: pointer not found.
+  - Exit code 2: query failed.
+  """
+  pointer_id = args.id or args.positional_id
+  if not pointer_id:
+    print("SwarmIdPointer get requires id (positional or --id).", file=sys.stderr)
+    sys.exit(2)
+
+  sql = "SELECT id, value FROM SwarmIdPointer WHERE id = :id LIMIT 1"
+  try:
+    with engine.connect() as conn:
+      row = conn.execute(text(sql), {"id": pointer_id}).mappings().first()
+  except Exception as exc:
+    print(f"MySQL query failed: {exc}", file=sys.stderr)
+    sys.exit(2)
+
+  if row is None:
+    sys.exit(1)
+
+  print(json.dumps(dict(row)))
+
+
 def create_swarm_secrets(args: argparse.Namespace, db: dict, engine: Engine) -> None:
   """
   Insert or keep a SwarmSecret.
@@ -520,6 +572,7 @@ def parse_args(argv: List[str]) -> argparse.Namespace:
       "ClusterPolicyMeasurementRules",
       "ClusterPolicyPreferenceRules",
       "SwarmSecrets",
+      "SwarmIdPointer",
     ],
   )
   # Positional optional id (first non-key=value), like the original script
@@ -593,6 +646,10 @@ def main(argv: List[str]) -> None:
     create_cluster_services(args, db, engine)
   elif key == "create:SwarmSecrets":
     create_swarm_secrets(args, db, engine)
+  elif key == "create:SwarmIdPointer":
+    create_swarm_id_pointer(args, db, engine)
+  elif key == "get:SwarmIdPointer":
+    get_swarm_id_pointer(args, db, engine)
   elif key == "get:ClusterPolicies":
     get_cluster_policies(args, db, engine)
   elif key == "get:ClusterServices":

From 7df46d589eaf644404882c1226301489808d053c Mon Sep 17 00:00:00 2001
From: Lex Kheben <i@zbit.name>
Date: Thu, 2 Jul 2026 13:23:18 +0300
Subject: [PATCH 5/5] fix(dns-manager): restore completion message in setup
 script

Reintroduced the completion message indicating that the provision worker will reconcile the service shortly, enhancing user feedback during the DNS manager setup process.
---
 src/swarm-scripts/74.setup-dns-manager.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/swarm-scripts/74.setup-dns-manager.sh b/src/swarm-scripts/74.setup-dns-manager.sh
index b1400c39..a7540971 100755
--- a/src/swarm-scripts/74.setup-dns-manager.sh
+++ b/src/swarm-scripts/74.setup-dns-manager.sh
@@ -66,8 +66,6 @@ else
 			--location="$LOCATION_PATH"
 fi
 
-echo "Done. The provision worker will reconcile '$SERVICE_NAME' shortly."
-
 AFFINITY_RULE_ID="${CLUSTER_POLICY}:knot-affinity"
 if DB_HOST="$DB_HOST" DB_PORT="$DB_PORT" DB_USER="$DB_USER" DB_NAME="$DB_NAME" \
 	python3 "$(dirname "$0")/swarm-cli.py" get ClusterPolicies knot >/dev/null 2>&1; then
@@ -85,3 +83,5 @@ if DB_HOST="$DB_HOST" DB_PORT="$DB_PORT" DB_USER="$DB_USER" DB_NAME="$DB_NAME" \
 				--affinity_type="positive"
 	fi
 fi
+
+echo "Done. The provision worker will reconcile '$SERVICE_NAME' shortly."