vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

stop writing and attaching per-agent and per-hive bao policies

Browse source
This commit is contained in:
atlas 2026-10-26 23:02:08 +01:00
commit 139007e656
1 changed files with 253 additions and 419 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/swarm-bao.nix
View file

@ -872,8 +872,8 @@ let
agentPkiRoleName = baoDeploy.agentPkiRoleName;
# Every common name the agent role issues for: `swarm_secret_client`'s
# `policy::AGENT_PREFIX`, which names each agent's cert-auth role and
# policy too. Outside it the role refuses, so the controller cannot obtain
# `policy::AGENT_PREFIX`, which names each agent's cert-auth role too.
# Outside it the role refuses, so the controller cannot obtain
# a certificate for any other name.
agentCnGlob = "hive-agent-*";
@ -938,7 +938,7 @@ let
#
# 🩸 Each of these reads exactly ONE path in the store, and does it holding
# its own leaf rather than `deploy.bao.clientCertFile` — the hive's own leaf,
# whose policy (`swarm-secret-client`'s `policy::render`) grants read on
# whose policy (`swarm-secret-client`'s `policy::render_shared_hives`) grants read on
# `swarm/agents/*` AND `swarm/hives/<hive>/*`, and nothing under
# `swarm/services/`.
# Principals presenting one certificate are ONE principal to bao, so sharing