vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

swarm-bao: shrink the read-grant comment under the comment-block max

Browse source
This commit is contained in:
atlas 2026-09-23 18:46:32 +02:00 • committed by mara
commit ebcc5bde89
1 changed files with 3 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/host-modules/swarm-bao.nix
View file

@ -180,17 +180,9 @@ let
# `secret`, and the engine inserts `data/`. Matching the code's spelling # `secret`, and the engine inserts `data/`. Matching the code's spelling
# literally would grant nothing. # literally would grant nothing.
# #
# `read` is there because the controller mints idempotently: `mint_and_verify` # `read` too: `mint_and_verify` reads a credential back before writing so a
# reads the queue credential back before writing so that a re-run keeps the # re-run keeps the value a live agent already holds instead of rotating it —
# value a live agent is already authenticating with instead of rotating it. # the read is required, not incidental.
# That read is `read_optional`, which treats only a 404 as absence — a denial
# stays an error on purpose, so without `read` the first re-run of a mint
# aborts on a 403 rather than concluding the path is empty.
#
# It is the whole of the widening: `read` on the paths this same stanza
# already lets the controller create and replace, and no `list`, so it can
# only fetch a credential for an agent it was told the name of — which is an
# agent it could already overwrite.
controllerPolicyText = '' controllerPolicyText = ''
path "auth/cert/certs/hive-*" { path "auth/cert/certs/hive-*" {
capabilities = ["create", "update", "read", "delete"] capabilities = ["create", "update", "read", "delete"]