vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: a gateway host without the services-issuer pair evaluates and goes red at runtime

Browse source 
Drop the eval assertion b78190e1 added. It refused every self-signed
gateway host that does not run the store, which is the default hive
shape, and contradicts docs/swarm/secrets.md's supported no-store
deployment. The approved #4921 plan has such a host evaluate and fail
at runtime; `requireServicesIssuer` already exits 1 naming both
options, on the root-fetch branch and before issuing.

The module-eval case that pinned `hiveWithController { }` as refused
now pins it, and a hive-less gateway with no pair, as evaluating with
the unit's refusal in the script. The fixture pairs the assertion
forced into forge-placement, nats-tls and swarm-otel-identity are
reverted.

Refs #4921
This commit is contained in:
atlas 2026-10-06 11:53:17 +02:00 • committed by mara
commit 6a9c819136
7 changed files with 37 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/swarm/ca.md
View file

@ -129,8 +129,9 @@ every gateway host:
`services-issuer-key.pem` from the store's host and set both options.
A host whose gateway serves the self-signed leaf without both options set
fails evaluation, naming them. One that names files it can't read fails
`swarm-services-cert.service`, naming the paths. The old spellings,
still evaluates and deploys, and `swarm-services-cert.service` fails, naming
them. One that names files it can't read fails the same unit, naming the
paths. The old spellings,
`deploy.hive-controller.tls.baoClientCertFile` and `baoClientKeyFile`, are
renames of these two: a config that still sets them evaluates with a warning
naming both paths.