2d29711df9
The overview keeps the store invariant, the mTLS exception and the minter/reader/renewal contract. The table of every credential and the operating notes (forge token checks, re-creating agents, revoking a queue credential, store login retries) move unchanged to credentials-reference.md, and the links that asked where a credential lives point there.
1.3 KiB
Credentials: the target shape
The swarm's credential store is bao. This page is the overview of how the swarm
treats credentials; credentials-reference.md lists
each one: who mints it, who reads it, and how it renews, with the notes for
operating them. It describes the target, not what's on disk today;
secrets.md maps the files that exist right now.
Store secrets stay off disk. A process pulls a value from the store at runtime and holds it in memory only.
The mTLS client certificate is the only credential on disk. Each identity (an agent, a hive, a swarm-level service) has one. It's what logs a principal in to the store, so you place a hive's or service's certificate by hand. The nix option for it takes a path to the certificate, never its bytes, because a literal in a nix expression lands in the world-readable nix store. A hive hands each agent its certificate; the agent pulls everything else itself.
Each credential has a minter, a reader and a renewal story. Who mints it, who reads it, and whether it renews without an operator are what the reference table gives for every credential, with the operating notes that go with them.