vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: the root fetch presents the hive identity, as on main

Browse source 
On a hive fronting no swarm name, swarm-services-cert's token-less
GET pki/ca/pem presents baoHiveIdentity{Cert,Key}File again. The fetch
never logs in and grants nothing; the client certificate only completes
the store listener's mTLS. A hive host without the store therefore needs
no copy of the services-issuer pair.

The issue path, which logs in to pki/issue/swarm-services, still presents
only deploy.bao.servicesIssuerClient{Cert,Key}File.

module-eval-hive-tls: the root-fetch cases pin the hive identity and the
absence of the services-issuer pair (a fixture holding both, and one
holding only the hive identity); the issue-path case pins the pair on a
hive host and on a host without a hive; a gateway without the pair
evaluates and its issue path names both options.

Root-fetch identity: option (a), mara on PR #5002 (comment 92591).

Refs #4921
This commit is contained in:
atlas 2026-10-06 13:32:55 +02:00 • committed by mara
commit a66670be87
4 changed files with 143 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/swarm-bao.nix
View file

@ -1955,10 +1955,8 @@ in
default = null;
example = "/var/lib/swarm-bao-pki/services-issuer.pem";
description = ''
Certificate `swarm-services-cert` presents to the store: to log in and
ask for the swarm-services leaf the gateway serves, and for the
handshake of the root fetch on a host fronting no swarm name. Its
subject must be
Certificate `swarm-services-cert` logs in to the store with to ask for
the swarm-services leaf the gateway serves. Its subject must be
{option}`services.hyperhive.deploy.bao.servicesIssuerCommonName`.
⚠️ Neither the reader's
@ -1967,13 +1965,17 @@ in
`pki/issue/swarm-services` and nothing else, and it is the same on
every gateway host, whether or not a hive runs there.
Required on every host whose gateway serves the self-signed leaf.
Unset, the host evaluates and `swarm-services-cert` fails, naming
both options.
Required on every self-signed gateway host that fronts a swarm-service
name ({option}`services.hyperhive.swarm.localServiceDomains` not
empty). Unset there, the host evaluates and `swarm-services-cert`
fails, naming both options. A host fronting none only fetches the
store's root, presenting
{option}`services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile`,
and needs no services-issuer pair.
./glue-bao-tls.nix points it at the leaf it mints on the store's host.
On a gateway host without the store, it is a file the operator copies
from the store's host. A path, never a value.
On any other gateway host that needs it, it is a file the operator
copies from the store's host. A path, never a value.
'';
};