mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl: add bao init and bao grant-bootstrap

Browse source 
init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.
This commit is contained in:
atlas 2026-11-08 01:29:09 +01:00 • committed by mara
commit a20596fa59
1 changed files with 909 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

31
docs/1-getting-started/setup.md
View file

@ -23,23 +23,36 @@ _On the host running `swarm-bao`._ Everything else fetches its credentials
from the store, so it comes first.
```bash
sudo bao operator init # keep the keys it prints and the root token OFF this host
swarmctl bao init
```
It prints the unseal (or, under the default `pkcs11` seal, recovery) keys
and the root token **once**, and stores none of them: not in a file, and the root token is
never in a process's argument list (so not in `ps`). Record them off this host before you do
anything else. It refuses an initialised store, and works
from any host that can reach the store and has `bao` on `PATH`; the
wrapper installed on the store host already knows the store's address and CA.
Then bootstrap the **granter**, the one principal that writes every
`swarm-*` policy and role from then on. This is the only step that needs
the root token:
the root token. Run it as root on the host running `swarm-bao`:
```bash
sudo -i
read -rs BAO_TOKEN && export BAO_TOKEN # paste the root token from `bao operator init`
bao policy write bao-bootstrap /etc/hyperhive/bao-bootstrap-policy.hcl
bao token create -policy=bao-bootstrap -ttl=24h -orphan -display-name=bao-bootstrap -field=token \
| install -D -m 0600 /dev/stdin /var/lib/swarm-bao-bootstrap/grant.token
unset BAO_TOKEN
systemctl restart swarm-bao-granter-role
swarmctl bao grant-bootstrap # prompts for the root token, input hidden
```
It writes the `bao-bootstrap` policy, places a 24h grant token for
`swarm-bao-granter-role` and restarts that unit. The token comes from the
hidden prompt, or from stdin when stdin isn't a terminal; never from an
argument or environment variable. If the granter exists already, it
says so and does nothing. To do both steps in one go,
without re-typing the root token, run `swarmctl bao init --and-grant`
instead (it needs the `pkcs11` seal, which unseals itself).
If the host running `swarm-bao` has no `swarmctl` (the controller runs
elsewhere), the granting units print the equivalent `bao` commands when the
store refuses them.
Check `systemctl status swarm-bao-granter-role` logs
`Uploaded policy: bao-granter`, then restart the granting units that
failed while they waited. The granter unit deletes the token itself after a