vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: say the root fetch uses the reader cert for the handshake only

Browse source 
`baoClientCertFile`'s description said the services-cert unit had no
business holding `deploy.bao.clientCertFile`. Under mara's ruling that
every hive has a store identity, the root fetch presents that reader
cert. It is used only for the mTLS handshake of `pki/ca/pem`, which takes
no token, and the unit never logs in with it. The description now says
so, and the fetch is marked interim until each hive has its own narrow
store identity.

Refs #4588 (review c88790).
This commit is contained in:
atlas 2026-09-30 22:12:13 +02:00 • committed by mara
commit 8c2f81abad
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nix/host-modules/hive-tls.nix
View file

@ -389,8 +389,9 @@ in
A **separate** credential from
{option}`services.hyperhive.deploy.bao.clientCertFile`, which is this
hive's own reader identity and whose policy reads every secret the
hive is entitled to. A unit that renews one server certificate has no
business holding that.
hive is entitled to. `swarm-services-cert` never logs in with that one:
on a hive fronting no swarm name it presents it only for the mTLS
handshake of the root fetch, since `pki/ca/pem` takes no token.
On a hive that mints its own store PKI a glue module supplies the leaf
as a `mkDefault`; everywhere else it is the credential an operator
@ -806,6 +807,8 @@ in
err="$(mktemp)"
raw="$(mktemp "$d/swarm-services-root.XXXXXX")"
trap 'rm -f "$err" "$raw"' EXIT
# Interim: the reader cert is the handshake identity until each hive
# has its own narrow store identity for issuing its leaf.
if ! curl --fail --silent --show-error \
${storeRootCurlTls} --output "$raw" \
"$BAO_ADDR/v1/${baoServicesPkiMount}/ca/pem" 2>"$err"; then