diff --git a/docs/swarm/credentials.md b/docs/swarm/credentials.md index 7a7dd9cc..1d4b8c9d 100644 --- a/docs/swarm/credentials.md +++ b/docs/swarm/credentials.md @@ -57,8 +57,8 @@ strategy for every credential, including the mTLS leaf. | `swarm/services//oidc/client` | authelia | the service process that presents the client secret, under the certificate of the host it runs on | must be stated | | _(not in the store)_ a hive's mTLS leaf | the store's own PKI, or an operator placing it by hand | its own client, off disk — the exception above, because it's what makes every other row's pull possible | must be stated | -**An agent's mTLS leaf is in the store; a hive's is not, and the difference -is not an inconsistency.** The rule the exception protects is that nothing +**An agent's mTLS leaf is in the store; a hive's isn't, and the difference +isn't an inconsistency.** The rule the exception protects is that nothing can fetch from the store the credential it would need in order to fetch. A hive's leaf is that credential, so it can only come off disk. An agent's is read by the _hive_, which already holds one — so publishing it costs nothing