mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

the operator's bao works on a store host without a hive

Browse source
This commit is contained in:
atlas 2026-11-11 03:09:07 +01:00 • committed by mara
commit 32155f70aa
1 changed files with 169 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/4-implementation/swarm/bao.md
View file

@ -125,6 +125,14 @@ store's host signs them and the operator copies them to the host that needs
them and names them in config. The service principals' leaves are at the top of
`/var/lib/swarm-bao-pki/`, named after the principal.
The host's `bao` wrapper presents the hive's own `client.pem` where a hive runs
on the host, and otherwise `operator.pem`, which `swarm-bao-pki` mints on every
store host (subject `deploy.bao.operatorCommonName`, `operator` by default; key
`0600` root). No cert-auth role accepts that subject, so it opens the TLS
handshake and logs in to nothing: `bao status`, `operator init` and `operator
unseal` need no token and work on a store host without a hive, and every other
call still needs a token. Don't copy it to another host.
For every hive in `swarm.hives` other than its own, the store's host signs
that hive's two leaves into `/var/lib/swarm-bao-pki/hives/<hive>/`: