2d29711df9
The overview keeps the store invariant, the mTLS exception and the minter/reader/renewal contract. The table of every credential and the operating notes (forge token checks, re-creating agents, revoking a queue credential, store login retries) move unchanged to credentials-reference.md, and the links that asked where a credential lives point there.
27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
# Credentials: the target shape
|
|
|
|
<!-- vale write-good.Passive = NO -->
|
|
|
|
The swarm's credential store is bao. This page is the overview of how the swarm
|
|
treats credentials; [`credentials-reference.md`](credentials-reference.md) lists
|
|
each one: who mints it, who reads it, and how it renews, with the notes for
|
|
operating them. It describes the target, not what's on disk today;
|
|
[`secrets.md`](secrets.md) maps the files that exist right now.
|
|
|
|
<!-- vale write-good.Passive = YES -->
|
|
|
|
**Store secrets stay off disk.** A process pulls a value from the store at
|
|
runtime and holds it in memory only.
|
|
|
|
**The mTLS client certificate is the only credential on disk.** Each
|
|
identity (an agent, a hive, a swarm-level service) has one. It's what logs a
|
|
principal in to the store, so you place a hive's or service's certificate by
|
|
hand. The nix option for it takes a path to the certificate, never its bytes,
|
|
because a literal in a nix expression lands in the world-readable nix store.
|
|
A hive hands each agent its certificate; the agent pulls everything else
|
|
itself.
|
|
|
|
**Each credential has a minter, a reader and a renewal story.** Who mints it, who
|
|
reads it, and whether it renews without an operator are what the
|
|
[reference table](credentials-reference.md) gives for every credential, with the
|
|
operating notes that go with them.
|