vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

swarm-controller: hand the daemon the authority hives are issued from

Browse source 
Creating a hive's cert-auth role means writing the authority into the role
by value -- the store matches a presented certificate against the role's own
copy -- and nothing gave this daemon that file.

Named separately from deploy.bao.clientCaFile rather than read off it: that
option is the store's, saying which readers the store trusts on the host
that runs it, while a controller runs anywhere. The glue module supplies it
where the two are co-located, which is the same split baoClientCertFile
already makes against the hive reader's leaf.

Gated on the identity as well as the CA. Without a leaf there is nothing to
write a role with, so the file would reach a daemon that cannot act on it.

The module-eval arm needed a fixture of its own: a deployment that
self-signs both ends points clientCaFile and serverCaFile at one file, so on
the existing fixture the two authorities are the same string and wiring
either into the other's slot passes. controllerTwoCas is where they differ.
This commit is contained in:
atlas 2026-09-09 16:32:29 +02:00 • committed by mara
commit 7f9e65e923
3 changed files with 93 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

48
nix/module-eval.nix
View file

@ -268,6 +268,20 @@ let
# files this host will never have.
controllerNoStore = hive { deploy.swarm-controller.enable = true; };
# The two authorities told apart. A deployment that self-signs both ends
# points `clientCaFile` and `serverCaFile` at one file, so on the fixture
# above the CA a hive is issued from and the CA the store is verified by are
# the same string — and a case wiring either into the other's slot passes.
# This is the deployment where they differ, which is what makes the arm
# below able to fail at all.
controllerTwoCas = hive {
deploy.bao.enable = true;
deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
deploy.swarm-controller.enable = true;
deploy.bao.clientCaFile = lib.mkForce "/etc/pki/hive-clients-ca.pem";
deploy.bao.serverCaFile = lib.mkForce "/etc/pki/store-server-ca.pem";
};
# The store and the token, with no CA to trust. `mkForce` because the PKI
# glue supplies one by default here — this is the deployment that brings its
# own certificates and has not named the authority yet, and it separates
@ -621,6 +635,40 @@ let
&& builtins.elem "bao-client.pem:/var/lib/swarm-bao-pki/controller.pem" s.swarm-controller.serviceConfig.LoadCredential
&& builtins.elem "bao-client-key.pem:/var/lib/swarm-bao-pki/controller-key.pem" s.swarm-controller.serviceConfig.LoadCredential;
}
{
# A hive's cert-auth role carries the authority by value, so the daemon
# has to be handed the file rather than a path into the store's own
# directory it cannot read.
#
# ⚠️ The LoadCredential source is asserted, not just the `%d` name, for
# the reason the arm above gives — and here the wrong file is a
# *plausible* one: `deploy.bao.serverCaFile` is the CA a reader checks
# the store's certificate with, evaluates fine in this slot, and would
# make every hive role trust the wrong authority.
name = "the controller is handed the CA hives are issued from";
ok =
let
s = controllerTwoCas.systemd.services;
m = controllerTwoCas.services.hyperhive;
in
(s.swarm-controller.environment.SWARM_CONTROLLER_HIVE_CLIENT_CA_FILE or null)
== "%d/hive-client-ca.pem"
&& builtins.elem "hive-client-ca.pem:/etc/pki/hive-clients-ca.pem" s.swarm-controller.serviceConfig.LoadCredential
&& !builtins.elem "hive-client-ca.pem:/etc/pki/store-server-ca.pem" s.swarm-controller.serviceConfig.LoadCredential
&& m.deploy.swarm-controller.hiveClientCaFile == m.deploy.bao.clientCaFile;
}
{
# Absence arm for the one above: without a store identity there is
# nothing to write a role with, so handing over the authority would be
# giving a file to a daemon that cannot act on it.
name = "a controller with no store leaf is given no hive CA either";
ok =
let
s = controllerNoStore.systemd.services;
in
!(s.swarm-controller.environment ? SWARM_CONTROLLER_HIVE_CLIENT_CA_FILE)
&& !(lib.any (c: lib.hasPrefix "hive-client-ca" c) s.swarm-controller.serviceConfig.LoadCredential);
}
{
# Absence arm for the one above, and what makes it mean anything: a
# controller with no leaf gets no store environment at all rather than