vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive CA: delete ca.pem, ca-previous.pem and ca-key.pem, the bundle is the store's root

Browse source 
The gateway leaf comes from the store's pki mount, so a hive CA's
certificates anchor nothing and its key is a secret outside the store.

- hive-tls-ca writes trust-bundle.pem from swarm-services-root.pem alone;
  the ca.pem and ca-previous.pem slots are gone.
- Every host deletes ca.pem, ca-previous.pem and ca-key.pem in
  deploy.hive-controller.tls.stateDir with tmpfiles `r` rules that follow
  the option. The removal shim, now host-ca-removed.nix, holds these
  beside the /var/lib/swarm-ca rule and the swarm.ca.* removals.
- deploy.bao.clientCaFile, deploy.bao.serverCaFile and
  deploy.swarm-controller.hiveClientCaFile naming /var/lib/swarm-ca or one
  of the deleted hive CA files fail evaluation, naming the store's mTLS CA
  (/var/lib/swarm-bao-pki/ca.pem on the store's host) as the replacement.

module-eval hive-tls covers the single-anchor bundle, the deletion (incl.
a relocated stateDir) and the assertion on all three options.

Refs #4588
This commit is contained in:
atlas 2026-10-05 19:54:55 +02:00 • committed by mara
commit 4e5a642928
10 changed files with 170 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

33
docs/swarm/ca.md
View file

@ -75,21 +75,10 @@ issues it.
## The trust bundle
`hive-tls-ca.service` writes `<deploy.hive-controller.tls.stateDir>/trust-bundle.pem`,
the file every consumer anchors on. It holds whichever of these exist:
- `swarm-services-root.pem`, the store's `pki` root, which the gateway leaf
and the swarm-services leaf both chain to.
- `ca.pem` and `ca-previous.pem`: a hive CA's public certificates. Nothing
issues under that CA; they stay in the bundle so a leaf it signed verifies
until `hive-tls-resign` replaces it. Removing them is a deliberate later
step.
No other anchor goes in: the store's `pki` root is the only root the swarm
has.
No hive generates a CA or signs with a CA key. A
`<deploy.hive-controller.tls.stateDir>/ca-key.pem` stays on disk, unread:
removing it comes with dropping `ca.pem` from the bundle.
the file every consumer anchors on. It holds one certificate, a copy of
`swarm-services-root.pem`: the store's `pki` root, which the gateway leaf and
the swarm-services leaf both chain to. It's the only root the swarm has. Until
the first fetch of that root lands, the bundle is empty.
⚠️ **A consumer reads its trust when it starts.** An agent or service
container that last started before the store's root reached the bundle
@ -164,9 +153,17 @@ role's `allowed_domains`, enforced by the store at issue time: a hive's
identity that leaks can get certificates for that hive's names and no
others.
No hive holds a root CA or its key, and nothing under `/var/lib/swarm-ca`
exists: every host deletes that directory at boot and on every deploy. The
swarm distributes only certificates.
No host holds a CA or its key, except the store's mTLS CA
(`glue-bao-tls.nix`), which signs only the store's server certificate and the
certificates that log in to it. At boot and on every deploy, every host
deletes `/var/lib/swarm-ca` and the `ca.pem`, `ca-previous.pem` and
`ca-key.pem` in `<deploy.hive-controller.tls.stateDir>`. The swarm distributes
only certificates.
A host whose `deploy.bao.clientCaFile`, `deploy.bao.serverCaFile` or
`deploy.swarm-controller.hiveClientCaFile` names one of those paths fails
evaluation. Those options name the store's mTLS CA,
`/var/lib/swarm-bao-pki/ca.pem` on the host that runs the store.
## What to hand a peer