vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: drop the stale claim that authelia mints hive-<name>-agent

Browse source
This commit is contained in:
atlas 2026-10-13 10:16:30 +02:00 • committed by mara
commit 495c45c2c2
6 changed files with 23 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/swarm-authelia-service.nix
View file

@ -75,21 +75,15 @@ in
type = lib.types.bool;
default = true;
description = ''
Mint machine clients per hive in
Mint one machine client per hive in
{option}`services.hyperhive.swarm.hives`, so each hive can
authenticate to swarm services as itself: `hive-<name>` for the
hive's own daemons, and `hive-<name>-agent` for the agent containers
running on it.
authenticate to swarm services as itself: `hive-<name>`, for the
hive's own daemons.
Two clients rather than one because they are not the same
principal — a hive's daemons run on the host and an agent runs
in a container the host hands a credential to, so a swarm
service has to be able to grant them different things. It is
one client per *hive* on the agent side, not per agent: agents
are created at runtime, and a per-agent client would make
creating one a config change plus an authelia reload. The cost
is that agents on a hive are indistinguishable from each other,
tracked as a follow-up rather than papered over.
Agent containers get no client here: agents are created at runtime,
and a per-agent client would make creating one a config change plus
an authelia reload. An agent authenticates with its own secret from
the swarm store instead.
On by default: a swarm's hives have identities, and that is a
fact about the swarm rather than about any one host. It does not

5
nix/host-modules/swarm.nix
View file

@ -360,8 +360,9 @@ in
fragments = reservedFragments;
why = ''
Hive-scoped identifiers are composed from a hive name —
`hive-<name>`, `hive-<name>-agent` — so a name containing one of
these produces an identifier that is also somebody else's. The
`hive-<name>`, and that id with a suffix the queue's responder
refuses — so a name containing one of these produces an identifier
that is also somebody else's, or one the responder refuses. The
failure is a wrong grant rather than an error: the client
authenticates and receives another principal's permissions, and a
NATS denial arrives as a timeout. Rename the hive.

4
nix/reserved-hive-fragments.nix
View file

@ -9,8 +9,8 @@
# `hive-<name>` — every hive's OIDC client id, and the string the queue's
# auth-callout responder strips to decide which hive a connection is.
"hive"
# `hive-<name>-agent` — the client its agent containers present. A hive named
# `foo-agent` mints exactly the id hive `foo`'s agents do.
# `hive-<name>-agent` — an id the queue's responder refuses. A hive named
# `foo-agent` would mint exactly that id for itself.
"agent"
# Also an exact-match entry next door, for the collector's `<kind>/<owner>`
# components. Here because it is the word this swarm composes identifiers