vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add one shared templated hive policy keyed on the cert alias name

Browse source
This commit is contained in:
atlas 2026-10-26 08:57:24 +01:00 • committed by mara
commit 03796f1964
4 changed files with 232 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/swarm/secrets.md
View file

@ -398,6 +398,18 @@ keeps working through its own policy, which stays attached until every agent
has its entity. An agent's role gains `hive-agent` at its next certificate
mint.
A hive's cert-auth role `hive-<hive>` likewise attaches a second policy,
`hive-hives`, shared by all hives. A hive's certificate carries its bare name as
the common name, which is the login's alias name, so hives need no entity:
the policy states the hive's own path as
`swarm/hives/{{identity.entity.aliases.<accessor>.name}}/*`, where `<accessor>`
is the cert mount's accessor. The controller reads the accessor at its own start,
writes the policy, and attaches it when it rewrites the roles. No hive name can
spell `hive-hives`: it would be a hive called `hives`, and
`reserved-hive-fragments.nix` refuses the substring `hive`. When the controller
can't read the accessor or write the policy it logs a warning and the role
attaches the hive's own policy alone, which stays attached.
### Per-principal identities
Bao matches a cert-auth role on the certificate's subject, so a certificate is an