[hbrelay] Allow relay startup even if the password is not yet resolved

During cluster join, the hb relay can start before its secret configuration
objects are available. As a result, the heartbeat previously failed to start,
leaving no opportunity for proper configuration afterward.

This change allows the hb relay to start and wait for password resolution
by subscribing to the passwordFrom configuration object.

Additional updates:
- Added a nil check for the client in the ticker loop to avoid unnecessary executions.
- Improved logging in refreshClient to enhance debugging and traceability.

Author: cgalibern

daemon/hb/hbrelay/hbrx.go

@@ -108,6 +108,9 @@ func (t *rx) Start(cmdC chan<- any, msgC chan<- *hbtype.Msg) error {
 				t.cancel()
 				return
 			case <-ticker.C:
+				if t.cli == nil {
+					continue
+				}
 				t.crypto = crypto.Load()
 				t.onTick()
 			case ev := <-sub.C:

daemon/hb/hbrelay/main.go

@@ -132,7 +132,7 @@ func (t *cfg) onEvent(ev any) {
 		t.log.HandleAuditStop(c.Q, c.Subsystems, "hb", strings.Replace(t.id, "hb#", "hb:", 1))
 	case *msgbus.InstanceConfigUpdated:
 		if err := t.refreshClient(); err != nil {
-			t.log.Errorf("refresh client on changed %s: %s", t.passwordFrom.Path, err)
+			t.log.Warnf("refresh client on changed %s: %s", t.passwordFrom.Path, err)
 			return
 		}
 	}
@@ -152,10 +152,16 @@ func (t *cfg) attachActiveAuditIfAny(ctx context.Context) {
 
 func (t *cfg) refreshClient() error {
 	if b, err := t.passwordFrom.Decode(); err != nil {
-		return fmt.Errorf("decode password: %w", err)
+		t.log.Warnf("decode password key %s from %s: %s", t.passwordFrom.Key, t.passwordFrom.Path, err)
+		t.cli = nil
+		return nil
 	} else if string(b) != t.password {
 		if t.password != "" {
-			t.log.Debugf("password changed for %s", t.passwordFrom.Path)
+			t.log.Debugf("password changed for %s key %s", t.passwordFrom.Path, t.passwordFrom.Key)
+		} else if t.password == "" {
+			t.log.Debugf("password is empty for %s key %s", t.passwordFrom.Path, t.passwordFrom.Key)
+			t.cli = nil
+			return nil
 		}
 		t.password = string(b)
 		cli, err := client.New(
@@ -172,7 +178,7 @@ func (t *cfg) refreshClient() error {
 		t.cli = cli
 		return nil
 	}
-	t.log.Debugf("password unhanged for %s", t.passwordFrom.Path)
+	t.log.Infof("password unhanged for %s", t.passwordFrom.Path)
 	return nil
 }