vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

name the agent's entity before narrowing its role, and test hive provisioning against a fake store

Browse source
This commit is contained in:
atlas 2026-10-27 10:11:02 +01:00
commit 09d89507a9
1 changed files with 535 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/swarm/credentials.md
View file

@ -377,12 +377,15 @@ is one write. `swarm-controller` writes it at agent creation and at its own
start.
For that the controller names each agent's identity entity after the agent: at
agent creation, and for every agent at its own start, it reads the cert mount's
accessor and creates the entity `<agent>` with the alias `hive-agent-<agent>`,
or renames the entity a first login created under a generated name. When the alias
sits on any other entity, the controller logs an error and changes nothing, and
that agent reads nothing until an operator resolves it. It needs the `identity/`
and `sys/auth/cert` grants in `swarm-bao.nix`'s `controllerPolicyText` for that.
each certificate mint or renewal, before it writes the agent's cert-auth role,
and for every agent at its own start. It reads the cert mount's accessor and
creates the entity `<agent>` with the alias `hive-agent-<agent>`, or renames the
entity a first login created under a generated name. At a mint or renewal this is
a precondition: when the store refuses a call, or the alias sits on any other
entity, the mint fails and the role stays as it was, so a live agent keeps
working until an operator resolves it. The start pass only logs the same
failures, because it writes no role. The controller needs the `identity/` and
`sys/auth/cert` grants in `swarm-bao.nix`'s `controllerPolicyText` for that.
A cert-auth role that predates the shared policy may still name a policy
`hive-agent-<agent>`. The controller no longer writes or attaches these. The