vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: keep ca-key.pem on disk, and re-issue a leaf that does not match its key

Browse source 
hive-tls-ca no longer deletes a ca-key.pem an earlier generation left:
nothing reads it, and leaving it means a rollback finds the old key instead
of minting a new anchor. Deleting it moves to PR 3, beside dropping ca.pem
from the trust bundle.

hive-tls-resign now also re-issues when the leaf's public key differs from
the key file's. The leaf and key are moved into place by two renames, and an
interrupted pair left a certificate beside the wrong key that the validity
check accepted.

Refs #4588
This commit is contained in:
atlas 2026-10-04 15:49:31 +02:00 • committed by mara
commit fc33a62bf8
4 changed files with 39 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/swarm/ca.md
View file

@ -48,9 +48,9 @@ identity a swarm service uses.
**When it issues.** The unit runs at boot, on every deploy, and from
`hive-tls-resign.timer` once a day. It asks the store for a new leaf when
the current one is missing, past half the role's 720-hour lifetime, missing
a configured name, or doesn't chain to the store's root
(`swarm-services-root.pem`). That last check is what replaces a leaf the
retired hive CA signed, on the first run that reaches the store.
a configured name, doesn't match the key beside it, or doesn't chain to the
store's root (`swarm-services-root.pem`). That last check is what replaces a
leaf the retired hive CA signed, on the first run that reaches the store.
**The gateway doesn't wait for the store.** Nothing orders the gateway after
`hive-tls-resign.service`, so a hive holding a valid leaf starts its gateway
@ -76,9 +76,10 @@ the file every consumer anchors on. It holds whichever of these exist:
- the swarm root, `<swarm.ca.stateDir>/root.pem`, on the host that generates
it.
No hive keeps a CA key. `hive-tls-ca.service` deletes
`<deploy.hive-controller.tls.stateDir>/ca-key.pem` where an earlier
generation left one, and generates no CA.
No hive generates a CA or signs with a CA key. A
`<deploy.hive-controller.tls.stateDir>/ca-key.pem` an earlier generation left
stays on disk, unread: removing it comes with dropping `ca.pem` from the
bundle.
⚠️ **A consumer reads its trust when it starts.** An agent or service
container that last started before the store's root reached the bundle