vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: skip the store root fetch on a hive with no store identity

Browse source 
The `want_svc=0` root fetch presents `deploy.bao.clientCertFile`/
`clientKeyFile` to a listener that demands a client certificate. On a
hive with neither set, the handshake is refused every time, and
`swarm-services-cert` went from green to failed-and-retrying for 24h.

The branch is now chosen at eval: with no reader identity, the unit
logs that the store root was not staged and names the option, then
exits 0, and no fetch is rendered. A hive with an identity fetches as
before. `hivectl peer-config` already handles the absent file.

Refs #4588 (review c88774, point 2).
This commit is contained in:
atlas 2026-09-30 21:34:07 +02:00 • committed by mara
commit 56335b24c0
4 changed files with 72 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/swarm/ca.md
View file

@ -65,7 +65,8 @@ gateway can't serve a swarm service that runs behind another.
`/var/lib/hive-tls/swarm-services-root.pem` (0644), written beside the
leaf it signed and folded into `trust-bundle.pem`. A hive fronting no
swarm name asks for no leaf and reads the root alone, from the store's
`pki/ca/pem`. On the host running
`pki/ca/pem`, when it holds a store identity (`deploy.bao.clientCertFile`).
On the host running
the store it's also at
`/var/lib/swarm-bao-services-pki/services-root.pem`. That's the file to
hand a browser, and reading it needs no store login — which matters,