vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: the hive's leaf does not read every secret in the store

Browse source 
Six more comments and option descriptions across five modules said the hive's leaf or grant reads every secret in the store. It reads swarm/agents/* and swarm/hives/<hive>/* and nothing else, so they now say that, in the wording the clientCertFile option already used. Also the matrix-ctl check's label no longer calls the hive's leaf store-wide.
This commit is contained in:
iris 2026-10-12 00:49:44 +02:00 • committed by mara
commit d39ad6c465
7 changed files with 22 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/swarm-grafana.nix
View file

@ -432,10 +432,10 @@ in
band, and every other secret comes from the store with it.
⚠️ Grafana's OWN leaf, not deploy.bao.clientCertFile. That one is the
hive's, and its grant reads every secret in the store; this role
reads the one path Grafana's client secret lives at. Pointing this
option at the hive's leaf would evaluate, deploy and log in — and
undo the split.
hive's, and its grant reads every agent credential in the swarm and
this hive's own secrets; this role reads the one path Grafana's
client secret lives at. Pointing this option at the hive's leaf would
evaluate, deploy and log in — and undo the split.
On a hive that runs the store, glue-bao-tls.nix supplies both as
defaults and there is nothing to do. Elsewhere the leaf is issued