vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive TLS: reload the trust bundle's unit on a switch, name the missing root when it's empty

Browse source 
A switch that changed `hive-tls-ca` stopped and started it, and the stop
propagated through `Requires=` to the store's container (sealed again under
the shamir seal), every container binding the bundle, and every
`<name>-ca-bundle` unit with its consumers. `reloadIfChanged` with the same
script as `ExecReload` rewrites the bundle in place and restarts none of them.
`Requires=` stays, so a failed assembly still keeps them from starting.

With `swarm-services-root.pem` missing, `hive-tls-ca` writes an empty bundle
and every `<name>-ca-bundle` unit fails. Its log line now names the root's
path. docs/swarm/ca.md describes both.
This commit is contained in:
atlas 2026-10-05 20:47:20 +02:00 • committed by mara
commit 1a4dc16053
3 changed files with 53 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/swarm/ca.md
View file

@ -77,8 +77,21 @@ issues it.
`hive-tls-ca.service` writes `<deploy.hive-controller.tls.stateDir>/trust-bundle.pem`,
the file every consumer anchors on. It holds one certificate, a copy of
`swarm-services-root.pem`: the store's `pki` root, which the gateway leaf and
the swarm-services leaf both chain to. It's the only root the swarm has. Until
the first fetch of that root lands, the bundle is empty.
the swarm-services leaf both chain to. It's the only root the swarm has.
**Without the store's root, the bundle is empty and its readers go red.**
While `<deploy.hive-controller.tls.stateDir>/swarm-services-root.pem` is
missing or empty, as on a first boot before the store answers,
`hive-tls-ca.service` writes an empty bundle and logs that file's path. Every
`<name>-ca-bundle` unit then fails with `<bundle> contributed no certificate
to the bundle`, and the consumers that `Requires=` it don't start.
`swarm-services-cert.service` restarts `hive-tls-ca.service` when it writes a
new root.
A deploy that changes `hive-tls-ca.service` reloads it: the same script
rewrites the bundle in place, and nothing that `Requires=` the unit restarts,
including the store's container. A `<name>-ca-bundle` unit keeps the copy it
made when it started.
⚠️ **A consumer reads its trust when it starts.** An agent or service
container that last started before the store's root reached the bundle